formbook | acb58cf1f819372ca5f461636f47ef790ec5d2748a5eaa3676104e46cdca1b19

General

Target

acb58cf1f819372ca5f461636f47ef790ec5d2748a5eaa3676104e46cdca1b19.msi
Size

480KB
MD5

6d7ada8915023eb188f47444a77d169d
SHA1

f87023a7c0de6b0ff4b0b2b799e58f41b938c332
SHA256

acb58cf1f819372ca5f461636f47ef790ec5d2748a5eaa3676104e46cdca1b19
SHA512

d37cf81df8f8dc64c5d5f0d68a2ad428b7d7d31658dd6980bc27db0d3dbc3ef44776012ea72feafc1c3348b0c9cd3599ce89168aa7edd992769dca26a98cc084
SSDEEP

12288:TEqy7sSW7kNUhBiTL1wuG2YVkp455oaomdIbTbq:TE5wzAQUTO/2SkpWon

Score

10^/10

formbook ai rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

ai

Decoy

theapschool.com

riseupfloridakeys.com

xn--mgbb2awa9dm20i.com

apnee-coach.com

christianmarketinggifts.com

eurothereum.biz

solutionfull.com

equifaxqsecurity2017.com

roboeye-tech.com

living-isar.immo

cable-online-zone.sale

parfumirza.com

civilizationsprice.com

zealasia.com

billet-bateau-tanger.com

andrewkurtsummers.net

darylandkaitlyn.com

ddaak.com

seattlepetadventures.com

iopuern.online

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1556-17-0x0000000000400000-0x000000000042A000-memory.dmp	formbook

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

MSI2F5C.tmpMSI2F5C.tmpcmstp.exe

description	pid	process	target process
PID 1608 set thread context of 1556	1608	MSI2F5C.tmp	MSI2F5C.tmp
PID 1556 set thread context of 1372	1556	MSI2F5C.tmp	Explorer.EXE
PID 1104 set thread context of 1372	1104	cmstp.exe	Explorer.EXE

Drops file in Windows directory 10 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File created	C:\Windows\Installer\f761748.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\f761748.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\f76174b.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2F2B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2F5C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76174b.ipi	msiexec.exe

Executes dropped EXE 2 IoCs

Processes:

MSI2F5C.tmpMSI2F5C.tmp

pid process

1608 MSI2F5C.tmp
1556 MSI2F5C.tmp

pid	process
1608	MSI2F5C.tmp
1556	MSI2F5C.tmp

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

msiexec.exeMSI2F5C.tmpcmstp.exe

pid	process
1964	msiexec.exe
1964	msiexec.exe
1556	MSI2F5C.tmp
1556	MSI2F5C.tmp
1104	cmstp.exe
1104	cmstp.exe
1104	cmstp.exe
1104	cmstp.exe
1104	cmstp.exe
1104	cmstp.exe
1104	cmstp.exe
1104	cmstp.exe
1104	cmstp.exe
1104	cmstp.exe
1104	cmstp.exe
1104	cmstp.exe
1104	cmstp.exe
1104	cmstp.exe
1104	cmstp.exe
1104	cmstp.exe
1104	cmstp.exe
1104	cmstp.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

MSI2F5C.tmpcmstp.exe

pid process

1556 MSI2F5C.tmp
1556 MSI2F5C.tmp
1556 MSI2F5C.tmp
1104 cmstp.exe
1104 cmstp.exe

pid	process
1556	MSI2F5C.tmp
1556	MSI2F5C.tmp
1556	MSI2F5C.tmp
1104	cmstp.exe
1104	cmstp.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exevssvc.exeDrvInst.exeMSI2F5C.tmpMSI2F5C.tmp

description	pid	process
Token: SeShutdownPrivilege	2364	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2364	msiexec.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeTakeOwnershipPrivilege	1964	msiexec.exe
Token: SeSecurityPrivilege	1964	msiexec.exe
Token: SeCreateTokenPrivilege	2364	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2364	msiexec.exe
Token: SeLockMemoryPrivilege	2364	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2364	msiexec.exe
Token: SeMachineAccountPrivilege	2364	msiexec.exe
Token: SeTcbPrivilege	2364	msiexec.exe
Token: SeSecurityPrivilege	2364	msiexec.exe
Token: SeTakeOwnershipPrivilege	2364	msiexec.exe
Token: SeLoadDriverPrivilege	2364	msiexec.exe
Token: SeSystemProfilePrivilege	2364	msiexec.exe
Token: SeSystemtimePrivilege	2364	msiexec.exe
Token: SeProfSingleProcessPrivilege	2364	msiexec.exe
Token: SeIncBasePriorityPrivilege	2364	msiexec.exe
Token: SeCreatePagefilePrivilege	2364	msiexec.exe
Token: SeCreatePermanentPrivilege	2364	msiexec.exe
Token: SeBackupPrivilege	2364	msiexec.exe
Token: SeRestorePrivilege	2364	msiexec.exe
Token: SeShutdownPrivilege	2364	msiexec.exe
Token: SeDebugPrivilege	2364	msiexec.exe
Token: SeAuditPrivilege	2364	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2364	msiexec.exe
Token: SeChangeNotifyPrivilege	2364	msiexec.exe
Token: SeRemoteShutdownPrivilege	2364	msiexec.exe
Token: SeUndockPrivilege	2364	msiexec.exe
Token: SeSyncAgentPrivilege	2364	msiexec.exe
Token: SeEnableDelegationPrivilege	2364	msiexec.exe
Token: SeManageVolumePrivilege	2364	msiexec.exe
Token: SeImpersonatePrivilege	2364	msiexec.exe
Token: SeCreateGlobalPrivilege	2364	msiexec.exe
Token: SeBackupPrivilege	2536	vssvc.exe
Token: SeRestorePrivilege	2536	vssvc.exe
Token: SeAuditPrivilege	2536	vssvc.exe
Token: SeBackupPrivilege	1964	msiexec.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeTakeOwnershipPrivilege	1964	msiexec.exe
Token: SeBackupPrivilege	2484	vssvc.exe
Token: SeRestorePrivilege	2484	vssvc.exe
Token: SeAuditPrivilege	2484	vssvc.exe
Token: SeBackupPrivilege	1964	msiexec.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeRestorePrivilege	2572	DrvInst.exe
Token: SeRestorePrivilege	2572	DrvInst.exe
Token: SeRestorePrivilege	2572	DrvInst.exe
Token: SeRestorePrivilege	2572	DrvInst.exe
Token: SeRestorePrivilege	2572	DrvInst.exe
Token: SeRestorePrivilege	2572	DrvInst.exe
Token: SeRestorePrivilege	2572	DrvInst.exe
Token: SeLoadDriverPrivilege	2572	DrvInst.exe
Token: SeLoadDriverPrivilege	2572	DrvInst.exe
Token: SeLoadDriverPrivilege	2572	DrvInst.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeTakeOwnershipPrivilege	1964	msiexec.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeTakeOwnershipPrivilege	1964	msiexec.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeTakeOwnershipPrivilege	1964	msiexec.exe
Token: SeDebugPrivilege	1608	MSI2F5C.tmp
Token: SeDebugPrivilege	1556	MSI2F5C.tmp

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

2364 msiexec.exe
2364 msiexec.exe

pid	process
2364	msiexec.exe
2364	msiexec.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

vssvc.exemsiexec.exeMSI2F5C.tmpExplorer.EXEcmstp.exe

description	pid	process	target process
PID 2536 wrote to memory of 2608	2536	vssvc.exe	WerFault.exe
PID 2536 wrote to memory of 2608	2536	vssvc.exe	WerFault.exe
PID 2536 wrote to memory of 2608	2536	vssvc.exe	WerFault.exe
PID 1964 wrote to memory of 1608	1964	msiexec.exe	MSI2F5C.tmp
PID 1964 wrote to memory of 1608	1964	msiexec.exe	MSI2F5C.tmp
PID 1964 wrote to memory of 1608	1964	msiexec.exe	MSI2F5C.tmp
PID 1964 wrote to memory of 1608	1964	msiexec.exe	MSI2F5C.tmp
PID 1608 wrote to memory of 1556	1608	MSI2F5C.tmp	MSI2F5C.tmp
PID 1608 wrote to memory of 1556	1608	MSI2F5C.tmp	MSI2F5C.tmp
PID 1608 wrote to memory of 1556	1608	MSI2F5C.tmp	MSI2F5C.tmp
PID 1608 wrote to memory of 1556	1608	MSI2F5C.tmp	MSI2F5C.tmp
PID 1608 wrote to memory of 1556	1608	MSI2F5C.tmp	MSI2F5C.tmp
PID 1608 wrote to memory of 1556	1608	MSI2F5C.tmp	MSI2F5C.tmp
PID 1608 wrote to memory of 1556	1608	MSI2F5C.tmp	MSI2F5C.tmp
PID 1372 wrote to memory of 1104	1372	Explorer.EXE	cmstp.exe
PID 1372 wrote to memory of 1104	1372	Explorer.EXE	cmstp.exe
PID 1372 wrote to memory of 1104	1372	Explorer.EXE	cmstp.exe
PID 1372 wrote to memory of 1104	1372	Explorer.EXE	cmstp.exe
PID 1372 wrote to memory of 1104	1372	Explorer.EXE	cmstp.exe
PID 1372 wrote to memory of 1104	1372	Explorer.EXE	cmstp.exe
PID 1372 wrote to memory of 1104	1372	Explorer.EXE	cmstp.exe
PID 1104 wrote to memory of 784	1104	cmstp.exe	cmd.exe
PID 1104 wrote to memory of 784	1104	cmstp.exe	cmd.exe
PID 1104 wrote to memory of 784	1104	cmstp.exe	cmd.exe
PID 1104 wrote to memory of 784	1104	cmstp.exe	cmd.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\system32\msiexec.exe
  msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\acb58cf1f819372ca5f461636f47ef790ec5d2748a5eaa3676104e46cdca1b19.msi
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2364
- C:\Windows\SysWOW64\cmstp.exe
  "C:\Windows\SysWOW64\cmstp.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Installer\MSI2F5C.tmp"
    3⤵
    PID:784

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\Installer\MSI2F5C.tmp
  "C:\Windows\Installer\MSI2F5C.tmp"
  2⤵
  - Suspicious use of SetThreadContext
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\Installer\MSI2F5C.tmp
    "C:\Windows\Installer\MSI2F5C.tmp"
    3⤵
    - Suspicious use of SetThreadContext
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1556

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2536 -s 548
  2⤵
  PID:2608

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2484

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005B8" "00000000000005A0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76174c.rbs

Filesize
681B

MD5
db0dc89584d4f57c8fc3e5834ba421fc

SHA1
f16489a26fcecf4c9afcb4e8878e2916415529b9

SHA256
6677a6c3855a2e3fb351547d57dd9d9c561c189827c2ad2addbad93a5c2de30d

SHA512
d0da17f50cad5b49f27dfd251982e7ef7c814cd35f16b81124fefc652d6408932eec6d54c5b9aaec1865ba1cf67c3eb9082a1d1e4a6451c089739662fb9d198c

Download Submit
C:\Windows\Installer\MSI2F5C.tmp

Filesize
453KB

MD5
fb6874156f7530ccaac5c0c8b4ab22ba

SHA1
8e70fa2fb16735594c961db602ccd965f7634122

SHA256
6e7119cc172059cedc3933aa66cfbe816196859a1bb87604ac8253ddebf85f8b

SHA512
56f131092278769526e5d8b784be32781d7c36cbdf14e535919ab654b5a5c9ae7d7734c6549e92bad18b3b5289f9b86a820daed2bdc18fc78392455dfefa1f90

Download Submit
\??\PIPE\samr

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1104-30-0x00000000004B0000-0x00000000004C8000-memory.dmp

Filesize
96KB

Download
memory/1372-42-0x0000000007030000-0x00000000071B5000-memory.dmp

Filesize
1.5MB

Download
memory/1556-17-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1608-13-0x00000000009A0000-0x0000000000A1A000-memory.dmp

Filesize
488KB

Download
memory/1608-14-0x00000000004C0000-0x00000000004F0000-memory.dmp

Filesize
192KB

Download
memory/1608-15-0x0000000000460000-0x000000000047E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads