Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-05-2024 07:35

General

  • Target

    LS24SDE.exe

  • Size

    634KB

  • MD5

    70625bcdbd35c6873bfef64197312647

  • SHA1

    64864eed1451eae8d076458fb6bc005137d1e7c4

  • SHA256

    0445cc730c308b40378c9133d394004d55dfdcb03db7d26485736471af6ba41e

  • SHA512

    f2f709d3586c95daa1cf50715974fb0f55252142edcba96ee069b2e9ad10feb7ee83d56a68a0e7c0cc4792aacd944b4fe10de5b8459b23d80ce4f6ea2172725f

  • SSDEEP

    12288:biETpbMlZRJIC/6GEmg3NQOqRK5sK3LIsbqZBma+LTpkh8WINLKtlcPK5S4T:HbmJIC/3DRTK3wmpmtQK5p

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

jn17

Decoy

hynasty.com

africacementreview.com

5280micropantry.com

qcyu2.us

jl777-web.com

hcwsports.com

update-number-au.com

ymymvip.top

postds.buzz

dogwifnobrim.com

usapubpong.com

shopscoopido.com

medical-equipment.company

onyagu.com

tldrparent.com

jvpeople.com

seangalbraithphotography.com

ptt-gov.art

mutcosmeticsec.com

metameme.online

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    PID:3520
    • C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe
      "C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4120
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mIsRPVu.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2444
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mIsRPVu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp613A.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:2456
      • C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe
        "C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1492
        • C:\Windows\SysWOW64\wscript.exe
          "C:\Windows\SysWOW64\wscript.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2780
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe"
            5⤵
              PID:1688

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lpkwlosb.0hf.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmp613A.tmp

      Filesize

      1KB

      MD5

      045fc609cbb3250b4b3ee5f66db9e6de

      SHA1

      2feaf1ed19330dce7166712de26bfc2d8737ecee

      SHA256

      b1195c55170e4a49c01da7f9b10e3d6d16d350e41a5446141c336cd4be971b1f

      SHA512

      f76b52a33d8b6b0c16674659c0d6814ad036e8ad22316764a41814d57ba45bfc2e9f3c6f11f75587ebc64a3263cd129b833954c9427842454f2b2c5f589893d7

    • memory/1492-74-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/1492-39-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/1492-40-0x0000000000F60000-0x0000000000F75000-memory.dmp

      Filesize

      84KB

    • memory/1492-37-0x0000000001060000-0x00000000013AA000-memory.dmp

      Filesize

      3.3MB

    • memory/1492-21-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2444-15-0x0000000002960000-0x0000000002996000-memory.dmp

      Filesize

      216KB

    • memory/2444-61-0x0000000007580000-0x000000000759A000-memory.dmp

      Filesize

      104KB

    • memory/2444-71-0x0000000074BA0000-0x0000000075350000-memory.dmp

      Filesize

      7.7MB

    • memory/2444-68-0x00000000078A0000-0x00000000078A8000-memory.dmp

      Filesize

      32KB

    • memory/2444-67-0x00000000078C0000-0x00000000078DA000-memory.dmp

      Filesize

      104KB

    • memory/2444-16-0x0000000074BA0000-0x0000000075350000-memory.dmp

      Filesize

      7.7MB

    • memory/2444-66-0x00000000077C0000-0x00000000077D4000-memory.dmp

      Filesize

      80KB

    • memory/2444-18-0x0000000074BA0000-0x0000000075350000-memory.dmp

      Filesize

      7.7MB

    • memory/2444-19-0x00000000054C0000-0x0000000005AE8000-memory.dmp

      Filesize

      6.2MB

    • memory/2444-20-0x0000000074BA0000-0x0000000075350000-memory.dmp

      Filesize

      7.7MB

    • memory/2444-65-0x00000000077B0000-0x00000000077BE000-memory.dmp

      Filesize

      56KB

    • memory/2444-64-0x0000000007780000-0x0000000007791000-memory.dmp

      Filesize

      68KB

    • memory/2444-24-0x0000000005390000-0x00000000053B2000-memory.dmp

      Filesize

      136KB

    • memory/2444-26-0x0000000005BD0000-0x0000000005C36000-memory.dmp

      Filesize

      408KB

    • memory/2444-25-0x0000000005B60000-0x0000000005BC6000-memory.dmp

      Filesize

      408KB

    • memory/2444-63-0x0000000007800000-0x0000000007896000-memory.dmp

      Filesize

      600KB

    • memory/2444-36-0x0000000005C50000-0x0000000005FA4000-memory.dmp

      Filesize

      3.3MB

    • memory/2444-62-0x00000000075F0000-0x00000000075FA000-memory.dmp

      Filesize

      40KB

    • memory/2444-60-0x0000000007BC0000-0x000000000823A000-memory.dmp

      Filesize

      6.5MB

    • memory/2444-59-0x0000000007470000-0x0000000007513000-memory.dmp

      Filesize

      652KB

    • memory/2444-56-0x0000000007450000-0x000000000746E000-memory.dmp

      Filesize

      120KB

    • memory/2444-42-0x0000000006250000-0x000000000626E000-memory.dmp

      Filesize

      120KB

    • memory/2444-43-0x00000000062A0000-0x00000000062EC000-memory.dmp

      Filesize

      304KB

    • memory/2444-44-0x000000007FD60000-0x000000007FD70000-memory.dmp

      Filesize

      64KB

    • memory/2444-45-0x0000000006830000-0x0000000006862000-memory.dmp

      Filesize

      200KB

    • memory/2444-46-0x0000000071460000-0x00000000714AC000-memory.dmp

      Filesize

      304KB

    • memory/2444-58-0x0000000002930000-0x0000000002940000-memory.dmp

      Filesize

      64KB

    • memory/2444-57-0x0000000002930000-0x0000000002940000-memory.dmp

      Filesize

      64KB

    • memory/2780-75-0x0000000001130000-0x000000000115F000-memory.dmp

      Filesize

      188KB

    • memory/2780-73-0x00000000009F0000-0x0000000000A17000-memory.dmp

      Filesize

      156KB

    • memory/3520-41-0x0000000008AF0000-0x0000000008C94000-memory.dmp

      Filesize

      1.6MB

    • memory/3520-78-0x0000000008CA0000-0x0000000008D96000-memory.dmp

      Filesize

      984KB

    • memory/4120-4-0x0000000005950000-0x000000000595A000-memory.dmp

      Filesize

      40KB

    • memory/4120-5-0x0000000074BA0000-0x0000000075350000-memory.dmp

      Filesize

      7.7MB

    • memory/4120-23-0x0000000074BA0000-0x0000000075350000-memory.dmp

      Filesize

      7.7MB

    • memory/4120-6-0x0000000005AA0000-0x0000000005ABE000-memory.dmp

      Filesize

      120KB

    • memory/4120-7-0x0000000005EE0000-0x0000000005EF0000-memory.dmp

      Filesize

      64KB

    • memory/4120-0-0x0000000074BAE000-0x0000000074BAF000-memory.dmp

      Filesize

      4KB

    • memory/4120-10-0x0000000009950000-0x00000000099EC000-memory.dmp

      Filesize

      624KB

    • memory/4120-9-0x00000000072F0000-0x0000000007366000-memory.dmp

      Filesize

      472KB

    • memory/4120-8-0x0000000006BD0000-0x0000000006BE6000-memory.dmp

      Filesize

      88KB

    • memory/4120-1-0x0000000000E00000-0x0000000000EA4000-memory.dmp

      Filesize

      656KB

    • memory/4120-3-0x0000000005880000-0x0000000005912000-memory.dmp

      Filesize

      584KB

    • memory/4120-2-0x0000000005EF0000-0x0000000006494000-memory.dmp

      Filesize

      5.6MB