Analysis
- max time kernel
67s - max time network
54s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
01/05/2024, 01:34
General
- Target 690955d5af76a8aaac2f4d703f182b0b2d42939d13dce8783313a232ed942719.exe
- Size 601KB
- Sample240501-bzag1sch3w
- SHA256 690955d5af76a8aaac2f4d703f182b0b2d42939d13dce8783313a232ed942719
Malware Config
Extracted
-
formbook
-
4.1
-
mx21
-
mexiwow.com
-
oneightycreative.com
-
ask2fairplay.com
-
innovativeindustires.com
-
orderhypnosis.com
-
qualitycriticalcare.com
-
scalestarloop.com
-
francostamales.com
-
immortalgameclothing.com
-
kccapcc.com
-
pauruiz.cat
-
eddyindyman.com
-
yourarchivedfashion.com
-
plantpoweredpodiatrist.com
-
silvekoski.net
-
ketoapuwarabson.cloud
-
themooncartomanzia.com
-
ikjd7v.cc
-
listmyhousefast.com
-
owl3.net
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\690955d5af76a8aaac2f4d703f182b0b2d42939d13dce8783313a232ed942719.exe"C:\Users\Admin\AppData\Local\Temp\690955d5af76a8aaac2f4d703f182b0b2d42939d13dce8783313a232ed942719.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\690955d5af76a8aaac2f4d703f182b0b2d42939d13dce8783313a232ed942719.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\690955d5af76a8aaac2f4d703f182b0b2d42939d13dce8783313a232ed942719.exe"C:\Users\Admin\AppData\Local\Temp\690955d5af76a8aaac2f4d703f182b0b2d42939d13dce8783313a232ed942719.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\690955d5af76a8aaac2f4d703f182b0b2d42939d13dce8783313a232ed942719.exe"C:\Users\Admin\AppData\Local\Temp\690955d5af76a8aaac2f4d703f182b0b2d42939d13dce8783313a232ed942719.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_lmdzddrw.04h.ps1
memory/468-6-0x0000000004F90000-0x0000000004FA8000-memory.dmp
memory/468-2-0x0000000005170000-0x0000000005714000-memory.dmp
memory/468-3-0x0000000004C60000-0x0000000004CF2000-memory.dmp
memory/468-4-0x0000000004E20000-0x0000000004E30000-memory.dmp
memory/468-5-0x0000000004C30000-0x0000000004C3A000-memory.dmp
memory/468-14-0x0000000074AF0000-0x00000000752A0000-memory.dmp
memory/468-7-0x0000000004FD0000-0x0000000004FDE000-memory.dmp
memory/468-8-0x0000000005160000-0x0000000005176000-memory.dmp
memory/468-9-0x0000000005E60000-0x0000000005ED6000-memory.dmp
memory/468-10-0x0000000008650000-0x00000000086EC000-memory.dmp
memory/468-1-0x0000000074AF0000-0x00000000752A0000-memory.dmp
memory/468-0-0x00000000002E0000-0x000000000037C000-memory.dmp
memory/1920-19-0x00000000057C0000-0x00000000057E2000-memory.dmp
memory/1920-35-0x0000000006E70000-0x0000000006EA2000-memory.dmp
memory/1920-16-0x0000000074AF0000-0x00000000752A0000-memory.dmp
memory/1920-59-0x0000000074AF0000-0x00000000752A0000-memory.dmp
memory/1920-15-0x0000000005940000-0x0000000005F68000-memory.dmp
memory/1920-20-0x0000000005FE0000-0x0000000006046000-memory.dmp
memory/1920-21-0x0000000006140000-0x00000000061A6000-memory.dmp
memory/1920-13-0x00000000052C0000-0x00000000052F6000-memory.dmp
memory/1920-56-0x0000000007EE0000-0x0000000007EE8000-memory.dmp
memory/1920-31-0x00000000062B0000-0x0000000006604000-memory.dmp
memory/1920-32-0x00000000068A0000-0x00000000068BE000-memory.dmp
memory/1920-33-0x0000000006D40000-0x0000000006D8C000-memory.dmp
memory/1920-34-0x000000007F300000-0x000000007F310000-memory.dmp
memory/1920-17-0x0000000005300000-0x0000000005310000-memory.dmp
memory/1920-36-0x00000000713B0000-0x00000000713FC000-memory.dmp
memory/1920-46-0x0000000006E30000-0x0000000006E4E000-memory.dmp
memory/1920-47-0x00000000078B0000-0x0000000007953000-memory.dmp
memory/1920-48-0x0000000008200000-0x000000000887A000-memory.dmp
memory/1920-49-0x0000000007BC0000-0x0000000007BDA000-memory.dmp
memory/1920-50-0x0000000007C30000-0x0000000007C3A000-memory.dmp
memory/1920-51-0x0000000007E40000-0x0000000007ED6000-memory.dmp
memory/1920-52-0x0000000007DC0000-0x0000000007DD1000-memory.dmp
memory/1920-53-0x0000000007DF0000-0x0000000007DFE000-memory.dmp
memory/1920-54-0x0000000007E00000-0x0000000007E14000-memory.dmp
memory/1920-55-0x0000000007F00000-0x0000000007F1A000-memory.dmp
memory/2320-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2320-18-0x00000000017F0000-0x0000000001B3A000-memory.dmp