Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240709-en
  • resource tags

    arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    12-07-2024 07:57

General

  • Target

    konfirmim.exe

  • Size

    1.0MB

  • MD5

    c9ad0db8c48595796320909adcf7a303

  • SHA1

    a9a21e3819907bba8fc0661e84fe0a7e49b4905c

  • SHA256

    909903adda36dcfc103a5260990c7ca1f47b4644672f2d94446c7e6e86f25a35

  • SHA512

    cdb375e941627757cc78f4bb1b7360b8512c4f0f3a145203b5807f7027d4a952f129f4a6367e7cbd9e0bd3613bd573eafb17e6967beb36e1039f99cb20f05f4f

  • SSDEEP

    24576:3r+gYZO1+u+KAgevoPUENFs0Y09Ea9P+Ex4yE:QRnyHp9O

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn03

Decoy

almouranipainting.com

cataloguia.shop

zaparielectric.com

whcqsc.com

ioco.in

aduredmond.com

vavada611a.fun

humtivers.com

jewellerytml.com

mcapitalparticipacoes.com

inhlcq.shop

solanamall.xyz

moviepropgroup.com

thegenesis.ltd

cyberxdefend.com

skinbykoco.com

entermintlead.com

honestaireviews.com

wyclhj7gqfustzp.buzz

w937xb.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3312
    • C:\Users\Admin\AppData\Local\Temp\konfirmim.exe
      "C:\Users\Admin\AppData\Local\Temp\konfirmim.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2412
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\konfirmim.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2352
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
          PID:240
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1832
      • C:\Windows\SysWOW64\cmmon32.exe
        "C:\Windows\SysWOW64\cmmon32.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:364
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          3⤵
            PID:3616

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jiucvcyk.mtl.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • memory/364-70-0x0000000000800000-0x000000000082F000-memory.dmp

        Filesize

        188KB

      • memory/364-68-0x00000000008A0000-0x00000000008AC000-memory.dmp

        Filesize

        48KB

      • memory/364-67-0x00000000008A0000-0x00000000008AC000-memory.dmp

        Filesize

        48KB

      • memory/1832-10-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/1832-65-0x0000000003860000-0x0000000003874000-memory.dmp

        Filesize

        80KB

      • memory/1832-64-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/1832-13-0x0000000001AD0000-0x0000000001E26000-memory.dmp

        Filesize

        3.3MB

      • memory/1832-15-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/1832-16-0x0000000001A80000-0x0000000001A94000-memory.dmp

        Filesize

        80KB

      • memory/2352-35-0x0000000006830000-0x000000000684E000-memory.dmp

        Filesize

        120KB

      • memory/2352-48-0x0000000006E00000-0x0000000006E1E000-memory.dmp

        Filesize

        120KB

      • memory/2352-62-0x0000000074860000-0x0000000075011000-memory.dmp

        Filesize

        7.7MB

      • memory/2352-59-0x0000000007EC0000-0x0000000007EC8000-memory.dmp

        Filesize

        32KB

      • memory/2352-58-0x0000000007ED0000-0x0000000007EEA000-memory.dmp

        Filesize

        104KB

      • memory/2352-57-0x0000000007DD0000-0x0000000007DE5000-memory.dmp

        Filesize

        84KB

      • memory/2352-18-0x0000000003020000-0x0000000003056000-memory.dmp

        Filesize

        216KB

      • memory/2352-21-0x0000000074860000-0x0000000075011000-memory.dmp

        Filesize

        7.7MB

      • memory/2352-20-0x0000000005B80000-0x00000000061AA000-memory.dmp

        Filesize

        6.2MB

      • memory/2352-19-0x000000007486E000-0x000000007486F000-memory.dmp

        Filesize

        4KB

      • memory/2352-22-0x00000000058A0000-0x00000000058C2000-memory.dmp

        Filesize

        136KB

      • memory/2352-23-0x0000000005AC0000-0x0000000005B26000-memory.dmp

        Filesize

        408KB

      • memory/2352-25-0x0000000074860000-0x0000000075011000-memory.dmp

        Filesize

        7.7MB

      • memory/2352-24-0x0000000006320000-0x0000000006386000-memory.dmp

        Filesize

        408KB

      • memory/2352-56-0x0000000007DC0000-0x0000000007DCE000-memory.dmp

        Filesize

        56KB

      • memory/2352-26-0x0000000006390000-0x00000000066E7000-memory.dmp

        Filesize

        3.3MB

      • memory/2352-55-0x0000000007D90000-0x0000000007DA1000-memory.dmp

        Filesize

        68KB

      • memory/2352-36-0x0000000006D70000-0x0000000006DBC000-memory.dmp

        Filesize

        304KB

      • memory/2352-37-0x00000000077E0000-0x0000000007814000-memory.dmp

        Filesize

        208KB

      • memory/2352-47-0x0000000074860000-0x0000000075011000-memory.dmp

        Filesize

        7.7MB

      • memory/2352-49-0x0000000007820000-0x00000000078C4000-memory.dmp

        Filesize

        656KB

      • memory/2352-54-0x0000000007E10000-0x0000000007EA6000-memory.dmp

        Filesize

        600KB

      • memory/2352-50-0x0000000074860000-0x0000000075011000-memory.dmp

        Filesize

        7.7MB

      • memory/2352-38-0x0000000070A50000-0x0000000070A9C000-memory.dmp

        Filesize

        304KB

      • memory/2352-51-0x0000000008260000-0x00000000088DA000-memory.dmp

        Filesize

        6.5MB

      • memory/2352-52-0x0000000007970000-0x000000000798A000-memory.dmp

        Filesize

        104KB

      • memory/2352-53-0x0000000007C00000-0x0000000007C0A000-memory.dmp

        Filesize

        40KB

      • memory/2412-9-0x0000000005120000-0x00000000051BC000-memory.dmp

        Filesize

        624KB

      • memory/2412-4-0x00000000747E0000-0x0000000074F91000-memory.dmp

        Filesize

        7.7MB

      • memory/2412-6-0x00000000075A0000-0x00000000075B0000-memory.dmp

        Filesize

        64KB

      • memory/2412-7-0x0000000002960000-0x000000000296E000-memory.dmp

        Filesize

        56KB

      • memory/2412-8-0x0000000008DC0000-0x0000000008E36000-memory.dmp

        Filesize

        472KB

      • memory/2412-1-0x00000000003A0000-0x00000000004AC000-memory.dmp

        Filesize

        1.0MB

      • memory/2412-0-0x00000000747EE000-0x00000000747EF000-memory.dmp

        Filesize

        4KB

      • memory/2412-5-0x0000000007430000-0x000000000743A000-memory.dmp

        Filesize

        40KB

      • memory/2412-12-0x00000000747E0000-0x0000000074F91000-memory.dmp

        Filesize

        7.7MB

      • memory/2412-2-0x00000000079B0000-0x0000000007F56000-memory.dmp

        Filesize

        5.6MB

      • memory/2412-3-0x00000000074A0000-0x0000000007532000-memory.dmp

        Filesize

        584KB

      • memory/3312-66-0x0000000002700000-0x00000000027DF000-memory.dmp

        Filesize

        892KB

      • memory/3312-69-0x0000000006440000-0x00000000065D5000-memory.dmp

        Filesize

        1.6MB

      • memory/3312-17-0x0000000006440000-0x00000000065D5000-memory.dmp

        Filesize

        1.6MB

      • memory/3312-74-0x0000000003910000-0x00000000039C2000-memory.dmp

        Filesize

        712KB