Analysis

  • max time kernel
    92s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-07-2024 07:37

General

  • Target

    6887db1f6c75ae73f95dc1e8b7ba45f0N.exe

  • Size

    700KB

  • MD5

    6887db1f6c75ae73f95dc1e8b7ba45f0

  • SHA1

    a6eae243627dd243dfc1ba7d8ecb0db32d2b04e0

  • SHA256

    e1153fa8e128ce45bc1fd82c073aa9724653ae65a621f7accf41a7b4ea542906

  • SHA512

    8ce6ac3dd86793027a12f48f451d141d809b0c757177e60aedfef2d8e57ae12f039035f43e45696e059edffe4edf7f10e42a53f1b796f7740f23483399984fad

  • SSDEEP

    12288:GVkFuwcbZzHNoW1XMn+oCUufZv7ftOwz3geqeDWSmb6+Sg:hZAZzHNoW1O+oWZv7frzwvTb6+Sg

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

h209

Decoy

sbtstuff.site

omlyes.com

movershifting.com

gearballer.com

oketoto.pro

myringleader.com

lrcjc750s.xyz

ata2024.xyz

password-manager-89409.bond

aiassistanthub.net

changvolt.cfd

netino.site

wear-wale.com

omnipresenceagency.com

huangguan.ooo

propersonnelmedia.com

9332952.com

k3s.support

ciytrw.xyz

cb095.pro

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6887db1f6c75ae73f95dc1e8b7ba45f0N.exe
    "C:\Users\Admin\AppData\Local\Temp\6887db1f6c75ae73f95dc1e8b7ba45f0N.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2232
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PYyvJhGBctVHN.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2184
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PYyvJhGBctVHN" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE87B.tmp"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2696
    • C:\Users\Admin\AppData\Local\Temp\6887db1f6c75ae73f95dc1e8b7ba45f0N.exe
      "C:\Users\Admin\AppData\Local\Temp\6887db1f6c75ae73f95dc1e8b7ba45f0N.exe"
      2⤵
        PID:2608
      • C:\Users\Admin\AppData\Local\Temp\6887db1f6c75ae73f95dc1e8b7ba45f0N.exe
        "C:\Users\Admin\AppData\Local\Temp\6887db1f6c75ae73f95dc1e8b7ba45f0N.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:5108

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5sj1xos1.2co.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmpE87B.tmp

      Filesize

      1KB

      MD5

      67113f5224cdb3588a605cc26c33509e

      SHA1

      d886ac77d0afadf8c553a6b414b32c1732d4d544

      SHA256

      bc8e75fe93f08099e3bb8a6d152f5aa180fd32e03b35944b8f699cb0adae65ee

      SHA512

      fe1a6fdd197fe95694f51330b3eb498cc02dea8d85f355db5e8fcb8e44580369d858036d59fe39dc0f32eecdfec3adad8e50e8c325539d087d957b40be1c7bbf

    • memory/2184-53-0x0000000006A60000-0x0000000006A7E000-memory.dmp

      Filesize

      120KB

    • memory/2184-19-0x0000000004BF0000-0x0000000005218000-memory.dmp

      Filesize

      6.2MB

    • memory/2184-66-0x0000000074A10000-0x00000000751C0000-memory.dmp

      Filesize

      7.7MB

    • memory/2184-63-0x0000000007130000-0x0000000007138000-memory.dmp

      Filesize

      32KB

    • memory/2184-62-0x0000000007150000-0x000000000716A000-memory.dmp

      Filesize

      104KB

    • memory/2184-61-0x0000000007050000-0x0000000007064000-memory.dmp

      Filesize

      80KB

    • memory/2184-60-0x0000000007040000-0x000000000704E000-memory.dmp

      Filesize

      56KB

    • memory/2184-24-0x0000000005290000-0x00000000052F6000-memory.dmp

      Filesize

      408KB

    • memory/2184-59-0x0000000007010000-0x0000000007021000-memory.dmp

      Filesize

      68KB

    • memory/2184-58-0x0000000007090000-0x0000000007126000-memory.dmp

      Filesize

      600KB

    • memory/2184-16-0x0000000004580000-0x00000000045B6000-memory.dmp

      Filesize

      216KB

    • memory/2184-57-0x0000000006E80000-0x0000000006E8A000-memory.dmp

      Filesize

      40KB

    • memory/2184-18-0x0000000074A10000-0x00000000751C0000-memory.dmp

      Filesize

      7.7MB

    • memory/2184-41-0x0000000006A80000-0x0000000006AB2000-memory.dmp

      Filesize

      200KB

    • memory/2184-20-0x0000000074A10000-0x00000000751C0000-memory.dmp

      Filesize

      7.7MB

    • memory/2184-22-0x0000000004B30000-0x0000000004B52000-memory.dmp

      Filesize

      136KB

    • memory/2184-23-0x0000000005220000-0x0000000005286000-memory.dmp

      Filesize

      408KB

    • memory/2184-26-0x0000000005480000-0x00000000057D4000-memory.dmp

      Filesize

      3.3MB

    • memory/2184-56-0x0000000006E10000-0x0000000006E2A000-memory.dmp

      Filesize

      104KB

    • memory/2184-55-0x0000000007460000-0x0000000007ADA000-memory.dmp

      Filesize

      6.5MB

    • memory/2184-54-0x0000000006AC0000-0x0000000006B63000-memory.dmp

      Filesize

      652KB

    • memory/2184-52-0x00000000021F0000-0x0000000002200000-memory.dmp

      Filesize

      64KB

    • memory/2184-42-0x00000000734E0000-0x000000007352C000-memory.dmp

      Filesize

      304KB

    • memory/2184-38-0x0000000005AD0000-0x0000000005AEE000-memory.dmp

      Filesize

      120KB

    • memory/2184-39-0x0000000005C10000-0x0000000005C5C000-memory.dmp

      Filesize

      304KB

    • memory/2184-40-0x000000007FCA0000-0x000000007FCB0000-memory.dmp

      Filesize

      64KB

    • memory/2232-2-0x0000000005A00000-0x0000000005FA4000-memory.dmp

      Filesize

      5.6MB

    • memory/2232-3-0x0000000005450000-0x00000000054E2000-memory.dmp

      Filesize

      584KB

    • memory/2232-0-0x0000000074A1E000-0x0000000074A1F000-memory.dmp

      Filesize

      4KB

    • memory/2232-9-0x00000000058D0000-0x00000000058DE000-memory.dmp

      Filesize

      56KB

    • memory/2232-4-0x0000000005410000-0x000000000541A000-memory.dmp

      Filesize

      40KB

    • memory/2232-28-0x0000000074A10000-0x00000000751C0000-memory.dmp

      Filesize

      7.7MB

    • memory/2232-1-0x0000000000940000-0x00000000009F4000-memory.dmp

      Filesize

      720KB

    • memory/2232-7-0x0000000005890000-0x00000000058A2000-memory.dmp

      Filesize

      72KB

    • memory/2232-11-0x0000000008EB0000-0x0000000008F4C000-memory.dmp

      Filesize

      624KB

    • memory/2232-10-0x0000000006B80000-0x0000000006BF6000-memory.dmp

      Filesize

      472KB

    • memory/2232-8-0x00000000058C0000-0x00000000058C8000-memory.dmp

      Filesize

      32KB

    • memory/2232-5-0x0000000074A10000-0x00000000751C0000-memory.dmp

      Filesize

      7.7MB

    • memory/2232-6-0x00000000056A0000-0x000000000572C000-memory.dmp

      Filesize

      560KB

    • memory/5108-27-0x0000000001630000-0x000000000197A000-memory.dmp

      Filesize

      3.3MB

    • memory/5108-21-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB