Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
08/05/2024, 07:35
General
- Target LS24SDE.exe
- Size 634KB
- Sample240508-jepp7sca83
- SHA256 0445cc730c308b40378c9133d394004d55dfdcb03db7d26485736471af6ba41e
Malware Config
Extracted
-
formbook
-
4.1
-
jn17
-
hynasty.com
-
africacementreview.com
-
5280micropantry.com
-
qcyu2.us
-
jl777-web.com
-
hcwsports.com
-
update-number-au.com
-
ymymvip.top
-
postds.buzz
-
dogwifnobrim.com
-
usapubpong.com
-
shopscoopido.com
-
medical-equipment.company
-
onyagu.com
-
tldrparent.com
-
jvpeople.com
-
seangalbraithphotography.com
-
ptt-gov.art
-
mutcosmeticsec.com
-
metameme.online
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 25 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe"C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mIsRPVu.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mIsRPVu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp613A.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe"C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\LS24SDE.exe"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_lpkwlosb.0hf.ps1
tmp613A.tmp
memory/1492-74-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1492-39-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1492-40-0x0000000000F60000-0x0000000000F75000-memory.dmp
memory/1492-37-0x0000000001060000-0x00000000013AA000-memory.dmp
memory/1492-21-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2444-15-0x0000000002960000-0x0000000002996000-memory.dmp
memory/2444-61-0x0000000007580000-0x000000000759A000-memory.dmp
memory/2444-71-0x0000000074BA0000-0x0000000075350000-memory.dmp
memory/2444-68-0x00000000078A0000-0x00000000078A8000-memory.dmp
memory/2444-67-0x00000000078C0000-0x00000000078DA000-memory.dmp
memory/2444-16-0x0000000074BA0000-0x0000000075350000-memory.dmp
memory/2444-66-0x00000000077C0000-0x00000000077D4000-memory.dmp
memory/2444-18-0x0000000074BA0000-0x0000000075350000-memory.dmp
memory/2444-19-0x00000000054C0000-0x0000000005AE8000-memory.dmp
memory/2444-20-0x0000000074BA0000-0x0000000075350000-memory.dmp
memory/2444-65-0x00000000077B0000-0x00000000077BE000-memory.dmp
memory/2444-64-0x0000000007780000-0x0000000007791000-memory.dmp
memory/2444-24-0x0000000005390000-0x00000000053B2000-memory.dmp
memory/2444-26-0x0000000005BD0000-0x0000000005C36000-memory.dmp
memory/2444-25-0x0000000005B60000-0x0000000005BC6000-memory.dmp
memory/2444-63-0x0000000007800000-0x0000000007896000-memory.dmp
memory/2444-36-0x0000000005C50000-0x0000000005FA4000-memory.dmp
memory/2444-62-0x00000000075F0000-0x00000000075FA000-memory.dmp
memory/2444-60-0x0000000007BC0000-0x000000000823A000-memory.dmp
memory/2444-59-0x0000000007470000-0x0000000007513000-memory.dmp
memory/2444-56-0x0000000007450000-0x000000000746E000-memory.dmp
memory/2444-42-0x0000000006250000-0x000000000626E000-memory.dmp
memory/2444-43-0x00000000062A0000-0x00000000062EC000-memory.dmp
memory/2444-44-0x000000007FD60000-0x000000007FD70000-memory.dmp
memory/2444-45-0x0000000006830000-0x0000000006862000-memory.dmp
memory/2444-46-0x0000000071460000-0x00000000714AC000-memory.dmp
memory/2444-58-0x0000000002930000-0x0000000002940000-memory.dmp
memory/2444-57-0x0000000002930000-0x0000000002940000-memory.dmp
memory/2780-75-0x0000000001130000-0x000000000115F000-memory.dmp
memory/2780-73-0x00000000009F0000-0x0000000000A17000-memory.dmp
memory/3520-41-0x0000000008AF0000-0x0000000008C94000-memory.dmp
memory/3520-78-0x0000000008CA0000-0x0000000008D96000-memory.dmp
memory/4120-4-0x0000000005950000-0x000000000595A000-memory.dmp
memory/4120-5-0x0000000074BA0000-0x0000000075350000-memory.dmp
memory/4120-23-0x0000000074BA0000-0x0000000075350000-memory.dmp
memory/4120-6-0x0000000005AA0000-0x0000000005ABE000-memory.dmp
memory/4120-7-0x0000000005EE0000-0x0000000005EF0000-memory.dmp
memory/4120-0-0x0000000074BAE000-0x0000000074BAF000-memory.dmp
memory/4120-10-0x0000000009950000-0x00000000099EC000-memory.dmp
memory/4120-9-0x00000000072F0000-0x0000000007366000-memory.dmp
memory/4120-8-0x0000000006BD0000-0x0000000006BE6000-memory.dmp
memory/4120-1-0x0000000000E00000-0x0000000000EA4000-memory.dmp
memory/4120-3-0x0000000005880000-0x0000000005912000-memory.dmp
memory/4120-2-0x0000000005EF0000-0x0000000006494000-memory.dmp