Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
21/06/2024, 14:13
General
- Target Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe
- Size 628KB
- Sample240621-rjed2atana
- SHA256 e10280c91dc1fb46756d9473163eec9052b8c8a352955d0f21a24246da054ba2
Malware Config
Extracted
-
formbook
-
4.1
-
pz12
-
paucanyes.com
-
autonwheels.com
-
cowboysandcaviarbar.com
-
fitnessengineeredworkouts.com
-
nuevobajonfavorito.com
-
dflx8.com
-
rothability.com
-
sxybet88.com
-
onesource.live
-
brenjitu1904.com
-
airdrop-zero1labs.com
-
guangdongqiangzhetc.com
-
apartments-for-rent-72254.bond
-
ombak99.lol
-
qqfoodsolutions.com
-
kyyzz.com
-
thepicklematch.com
-
ainth.com
-
missorris.com
-
gabbygomez.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 56 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe"C:\Users\Admin\AppData\Local\Temp\Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe"C:\Users\Admin\AppData\Local\Temp\Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_nsypsp4w.m2j.ps1
memory/2188-0-0x00000000746FE000-0x00000000746FF000-memory.dmp
memory/2188-1-0x0000000000770000-0x0000000000814000-memory.dmp
memory/2188-2-0x0000000005800000-0x0000000005DA4000-memory.dmp
memory/2188-3-0x0000000005250000-0x00000000052E2000-memory.dmp
memory/2188-5-0x00000000746F0000-0x0000000074EA0000-memory.dmp
memory/2188-4-0x0000000005210000-0x000000000521A000-memory.dmp
memory/2188-6-0x0000000005790000-0x00000000057AA000-memory.dmp
memory/2188-7-0x00000000054E0000-0x00000000054F0000-memory.dmp
memory/2188-8-0x00000000080F0000-0x0000000008166000-memory.dmp
memory/2188-9-0x000000000A880000-0x000000000A91C000-memory.dmp
memory/2188-12-0x00000000746F0000-0x0000000074EA0000-memory.dmp
memory/2524-10-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2524-19-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2524-17-0x0000000000EF0000-0x000000000123A000-memory.dmp
memory/2524-64-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3492-73-0x00000000086D0000-0x0000000008800000-memory.dmp
memory/3492-20-0x0000000008000000-0x0000000008171000-memory.dmp
memory/3492-65-0x00000000086D0000-0x0000000008800000-memory.dmp
memory/3492-76-0x0000000008800000-0x0000000008954000-memory.dmp
memory/4020-70-0x00000000005B0000-0x00000000005DF000-memory.dmp
memory/4020-67-0x0000000001120000-0x000000000113E000-memory.dmp
memory/4020-69-0x0000000001120000-0x000000000113E000-memory.dmp
memory/4896-30-0x0000000005F50000-0x00000000062A4000-memory.dmp
memory/4896-55-0x0000000007B90000-0x0000000007BA1000-memory.dmp
memory/4896-35-0x0000000006640000-0x000000000665E000-memory.dmp
memory/4896-36-0x00000000066D0000-0x000000000671C000-memory.dmp
memory/4896-37-0x000000007F310000-0x000000007F320000-memory.dmp
memory/4896-38-0x0000000006BF0000-0x0000000006C22000-memory.dmp
memory/4896-39-0x0000000070590000-0x00000000705DC000-memory.dmp
memory/4896-49-0x0000000006C50000-0x0000000006C6E000-memory.dmp
memory/4896-50-0x0000000007670000-0x0000000007713000-memory.dmp
memory/4896-51-0x0000000007FD0000-0x000000000864A000-memory.dmp
memory/4896-52-0x0000000007990000-0x00000000079AA000-memory.dmp
memory/4896-53-0x0000000007A00000-0x0000000007A0A000-memory.dmp
memory/4896-54-0x0000000007C10000-0x0000000007CA6000-memory.dmp
memory/4896-13-0x000000007477E000-0x000000007477F000-memory.dmp
memory/4896-56-0x0000000007BC0000-0x0000000007BCE000-memory.dmp
memory/4896-57-0x0000000007BD0000-0x0000000007BE4000-memory.dmp
memory/4896-58-0x0000000007CD0000-0x0000000007CEA000-memory.dmp
memory/4896-59-0x0000000007CB0000-0x0000000007CB8000-memory.dmp
memory/4896-62-0x0000000000ED0000-0x0000000000F3D000-memory.dmp
memory/4896-22-0x00000000055A0000-0x00000000055C2000-memory.dmp
memory/4896-24-0x0000000005760000-0x00000000057C6000-memory.dmp
memory/4896-23-0x0000000005640000-0x00000000056A6000-memory.dmp
memory/4896-16-0x0000000005820000-0x0000000005E48000-memory.dmp
memory/4896-18-0x0000000000ED0000-0x0000000000F3D000-memory.dmp
memory/4896-21-0x0000000002E20000-0x0000000002E30000-memory.dmp
memory/4896-14-0x0000000002D50000-0x0000000002D86000-memory.dmp