Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
10/05/2024, 01:41
General
- Target 93ffb46ce3a6d27b2cb64dbda30d1594d39c305d665bdc6665516be2a280a243.exe
- Size 781KB
- Sample240510-b35sbsbd7v
- SHA256 93ffb46ce3a6d27b2cb64dbda30d1594d39c305d665bdc6665516be2a280a243
Malware Config
Extracted
-
formbook
-
4.1
-
jn17
-
hynasty.com
-
africacementreview.com
-
5280micropantry.com
-
qcyu2.us
-
jl777-web.com
-
hcwsports.com
-
update-number-au.com
-
ymymvip.top
-
postds.buzz
-
dogwifnobrim.com
-
usapubpong.com
-
shopscoopido.com
-
medical-equipment.company
-
onyagu.com
-
tldrparent.com
-
jvpeople.com
-
seangalbraithphotography.com
-
ptt-gov.art
-
mutcosmeticsec.com
-
metameme.online
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\93ffb46ce3a6d27b2cb64dbda30d1594d39c305d665bdc6665516be2a280a243.exe"C:\Users\Admin\AppData\Local\Temp\93ffb46ce3a6d27b2cb64dbda30d1594d39c305d665bdc6665516be2a280a243.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RiILrGgNwcpLS.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RiILrGgNwcpLS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9579.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\93ffb46ce3a6d27b2cb64dbda30d1594d39c305d665bdc6665516be2a280a243.exe"C:\Users\Admin\AppData\Local\Temp\93ffb46ce3a6d27b2cb64dbda30d1594d39c305d665bdc6665516be2a280a243.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_4almoays.5ol.ps1
tmp9579.tmp
memory/1036-45-0x0000000075730000-0x000000007577C000-memory.dmp
memory/1036-57-0x0000000007B90000-0x000000000820A000-memory.dmp
memory/1036-68-0x0000000074EA0000-0x0000000075650000-memory.dmp
memory/1036-65-0x0000000007860000-0x0000000007868000-memory.dmp
memory/1036-64-0x0000000007880000-0x000000000789A000-memory.dmp
memory/1036-63-0x0000000007780000-0x0000000007794000-memory.dmp
memory/1036-62-0x0000000007770000-0x000000000777E000-memory.dmp
memory/1036-61-0x0000000007740000-0x0000000007751000-memory.dmp
memory/1036-60-0x00000000077C0000-0x0000000007856000-memory.dmp
memory/1036-59-0x00000000075C0000-0x00000000075CA000-memory.dmp
memory/1036-16-0x00000000028F0000-0x0000000002926000-memory.dmp
memory/1036-58-0x0000000007540000-0x000000000755A000-memory.dmp
memory/1036-19-0x00000000055A0000-0x0000000005BC8000-memory.dmp
memory/1036-18-0x0000000074EA0000-0x0000000075650000-memory.dmp
memory/1036-20-0x0000000005250000-0x0000000005272000-memory.dmp
memory/1036-22-0x00000000053D0000-0x0000000005436000-memory.dmp
memory/1036-23-0x0000000074EA0000-0x0000000075650000-memory.dmp
memory/1036-21-0x00000000052F0000-0x0000000005356000-memory.dmp
memory/1036-56-0x0000000007210000-0x00000000072B3000-memory.dmp
memory/1036-55-0x00000000071F0000-0x000000000720E000-memory.dmp
memory/1036-44-0x00000000067C0000-0x00000000067F2000-memory.dmp
memory/1036-35-0x0000000074EA0000-0x0000000075650000-memory.dmp
memory/1036-43-0x000000007FBE0000-0x000000007FBF0000-memory.dmp
memory/1036-33-0x0000000005C00000-0x0000000005F54000-memory.dmp
memory/1036-41-0x0000000006200000-0x000000000621E000-memory.dmp
memory/1036-42-0x0000000006540000-0x000000000658C000-memory.dmp
memory/1592-36-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1592-40-0x0000000000EA0000-0x00000000011EA000-memory.dmp
memory/2280-10-0x00000000046E0000-0x0000000004756000-memory.dmp
memory/2280-0-0x0000000074EAE000-0x0000000074EAF000-memory.dmp
memory/2280-1-0x0000000000240000-0x000000000030A000-memory.dmp
memory/2280-38-0x0000000074EA0000-0x0000000075650000-memory.dmp
memory/2280-3-0x0000000004D60000-0x0000000004DF2000-memory.dmp
memory/2280-11-0x0000000008800000-0x000000000889C000-memory.dmp
memory/2280-2-0x0000000005270000-0x0000000005814000-memory.dmp
memory/2280-9-0x00000000062B0000-0x000000000632E000-memory.dmp
memory/2280-8-0x0000000005240000-0x0000000005254000-memory.dmp
memory/2280-7-0x00000000050B0000-0x00000000050BE000-memory.dmp
memory/2280-6-0x0000000005070000-0x0000000005088000-memory.dmp
memory/2280-5-0x0000000074EA0000-0x0000000075650000-memory.dmp
memory/2280-4-0x0000000004D10000-0x0000000004D1A000-memory.dmp