Analysis
- max time kernel
11s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
07/06/2024, 11:46
General
- Target RFQ#10112023Q4.exe
- Size 733KB
- Sample240607-nxaffsgf37
- SHA256 943a21a3e37c9d1a350da6edd3487c05d2e77e960f55dd647928021e3bc57ce2
Malware Config
Extracted
-
formbook
-
4.1
-
mw62
-
abpdainik.in
-
luxuryprojectmalad.co.in
-
cajunbellebeauty.com
-
fpmfstudios.com
-
spedyz.shop
-
wilddogphotographics.com
-
apollomoda1.com
-
evrimciftciportfolio.com
-
99977bet.com
-
inefavel.com
-
mf85.com
-
online-doctor-nl-1.bond
-
zqi2lv.vip
-
thewebdesignhub.co
-
botwitter.com
-
18comic-palwoeld.club
-
loveweldpermanentjewelry.com
-
l3er39pc-gaywn6kv-d7fs4t7u.cc
-
31yoyogamestudio.com
-
yhvh.cloud
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ#10112023Q4.exe"C:\Users\Admin\AppData\Local\Temp\RFQ#10112023Q4.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wxwSYh.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wxwSYh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7251.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"1⤵
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_smbklibx.0nr.ps1
tmp7251.tmp
memory/1436-73-0x0000000001280000-0x00000000012AF000-memory.dmp
memory/1436-72-0x0000000000940000-0x0000000000947000-memory.dmp
memory/3084-7-0x0000000006AF0000-0x0000000006AFE000-memory.dmp
memory/3084-0-0x0000000074BAE000-0x0000000074BAF000-memory.dmp
memory/3084-6-0x0000000007290000-0x00000000072A6000-memory.dmp
memory/3084-8-0x0000000006B00000-0x0000000006B10000-memory.dmp
memory/3084-24-0x0000000074BA0000-0x0000000075350000-memory.dmp
memory/3084-10-0x00000000096F0000-0x000000000978C000-memory.dmp
memory/3084-9-0x0000000006B20000-0x0000000006B96000-memory.dmp
memory/3084-5-0x0000000074BA0000-0x0000000075350000-memory.dmp
memory/3084-1-0x0000000000ED0000-0x0000000000F8C000-memory.dmp
memory/3084-4-0x0000000005A30000-0x0000000005A3A000-memory.dmp
memory/3084-2-0x0000000006030000-0x00000000065D4000-memory.dmp
memory/3084-3-0x0000000005970000-0x0000000005A02000-memory.dmp
memory/3424-78-0x0000000008DE0000-0x0000000008F29000-memory.dmp
memory/3424-28-0x0000000008C60000-0x0000000008DDD000-memory.dmp
memory/3424-75-0x0000000008C60000-0x0000000008DDD000-memory.dmp
memory/3924-62-0x0000000007970000-0x000000000797A000-memory.dmp
memory/3924-61-0x0000000007900000-0x000000000791A000-memory.dmp
memory/3924-30-0x0000000005E60000-0x0000000005EC6000-memory.dmp
memory/3924-15-0x0000000004F80000-0x0000000004FB6000-memory.dmp
memory/3924-20-0x0000000074BA0000-0x0000000075350000-memory.dmp
memory/3924-29-0x0000000005710000-0x0000000005732000-memory.dmp
memory/3924-42-0x00000000065D0000-0x00000000065EE000-memory.dmp
memory/3924-21-0x0000000074BA0000-0x0000000075350000-memory.dmp
memory/3924-18-0x0000000074BA0000-0x0000000075350000-memory.dmp
memory/3924-17-0x0000000005740000-0x0000000005D68000-memory.dmp
memory/3924-41-0x00000000061F0000-0x0000000006544000-memory.dmp
memory/3924-46-0x0000000071460000-0x00000000714AC000-memory.dmp
memory/3924-58-0x0000000005100000-0x0000000005110000-memory.dmp
memory/3924-59-0x0000000007600000-0x00000000076A3000-memory.dmp
memory/3924-57-0x0000000005100000-0x0000000005110000-memory.dmp
memory/3924-43-0x0000000006620000-0x000000000666C000-memory.dmp
memory/3924-60-0x0000000007F40000-0x00000000085BA000-memory.dmp
memory/3924-36-0x0000000005F40000-0x0000000005FA6000-memory.dmp
memory/3924-56-0x0000000006BC0000-0x0000000006BDE000-memory.dmp
memory/3924-45-0x00000000075C0000-0x00000000075F2000-memory.dmp
memory/3924-63-0x0000000007B80000-0x0000000007C16000-memory.dmp
memory/3924-64-0x0000000007B00000-0x0000000007B11000-memory.dmp
memory/3924-44-0x000000007F780000-0x000000007F790000-memory.dmp
memory/3924-66-0x0000000007B40000-0x0000000007B54000-memory.dmp
memory/3924-68-0x0000000007C20000-0x0000000007C28000-memory.dmp
memory/3924-67-0x0000000007C40000-0x0000000007C5A000-memory.dmp
memory/3924-65-0x0000000007B30000-0x0000000007B3E000-memory.dmp
memory/3924-71-0x0000000074BA0000-0x0000000075350000-memory.dmp
memory/5048-25-0x00000000018A0000-0x0000000001BEA000-memory.dmp
memory/5048-26-0x0000000000400000-0x000000000042F000-memory.dmp
memory/5048-19-0x0000000000400000-0x000000000042F000-memory.dmp
memory/5048-27-0x0000000001410000-0x0000000001424000-memory.dmp