Analysis
- max time kernel
146s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
27/08/2024, 13:19
General
- Target HBL NO. A809001229 Overdue Invoice.exe
- Size 616KB
- Sample240827-qkr6vasemf
- SHA256 678004924997022281c09d32fb5aea4e95154e26f42891764628c74e2cd9a117
Malware Config
Extracted
-
formbook
-
4.1
-
p25o
-
hrist-centered-soulcare.net
-
pacerpa.shop
-
hicandcurvy.shop
-
ocfamilyto.llc
-
9ds87666.men
-
sia918ku.shop
-
nvestment-broker-35141.bond
-
ltralicencas.shop
-
g1lmb.cyou
-
eyo.live
-
pupt.rest
-
indsetperfection.net
-
1duqqrzs65zxz.bond
-
eren138-pro2.click
-
leaning-products-35959.bond
-
oodea.online
-
hlbadienug.info
-
innivip.bio
-
funnygame.top
-
roperty-in-dubai-f.pro
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 54 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\HBL NO. A809001229 Overdue Invoice.exe"C:\Users\Admin\AppData\Local\Temp\HBL NO. A809001229 Overdue Invoice.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\HBL NO. A809001229 Overdue Invoice.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\HBL NO. A809001229 Overdue Invoice.exe"C:\Users\Admin\AppData\Local\Temp\HBL NO. A809001229 Overdue Invoice.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\HBL NO. A809001229 Overdue Invoice.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_lgqjeydq.5fb.ps1
memory/2056-74-0x0000000000540000-0x000000000056F000-memory.dmp
memory/2056-73-0x0000000000A40000-0x0000000000A97000-memory.dmp
memory/2056-72-0x0000000000A40000-0x0000000000A97000-memory.dmp
memory/3464-19-0x0000000002570000-0x00000000026AC000-memory.dmp
memory/3464-79-0x0000000008340000-0x00000000084A3000-memory.dmp
memory/3464-75-0x00000000081B0000-0x0000000008332000-memory.dmp
memory/3464-71-0x00000000081B0000-0x0000000008332000-memory.dmp
memory/3464-70-0x0000000002570000-0x00000000026AC000-memory.dmp
memory/3628-58-0x0000000007A40000-0x0000000007AD6000-memory.dmp
memory/3628-52-0x0000000074C60000-0x0000000075410000-memory.dmp
memory/3628-66-0x0000000074C60000-0x0000000075410000-memory.dmp
memory/3628-63-0x0000000007AE0000-0x0000000007AE8000-memory.dmp
memory/3628-62-0x0000000007B00000-0x0000000007B1A000-memory.dmp
memory/3628-61-0x0000000007A00000-0x0000000007A14000-memory.dmp
memory/3628-60-0x00000000079F0000-0x00000000079FE000-memory.dmp
memory/3628-20-0x0000000074C6E000-0x0000000074C6F000-memory.dmp
memory/3628-59-0x00000000079C0000-0x00000000079D1000-memory.dmp
memory/3628-18-0x0000000004F20000-0x0000000004F56000-memory.dmp
memory/3628-21-0x0000000005590000-0x0000000005BB8000-memory.dmp
memory/3628-23-0x0000000074C60000-0x0000000075410000-memory.dmp
memory/3628-22-0x0000000074C60000-0x0000000075410000-memory.dmp
memory/3628-24-0x0000000005C20000-0x0000000005C42000-memory.dmp
memory/3628-25-0x0000000005D40000-0x0000000005DA6000-memory.dmp
memory/3628-26-0x0000000005E60000-0x0000000005EC6000-memory.dmp
memory/3628-57-0x0000000007830000-0x000000000783A000-memory.dmp
memory/3628-36-0x0000000005ED0000-0x0000000006224000-memory.dmp
memory/3628-37-0x00000000064B0000-0x00000000064CE000-memory.dmp
memory/3628-38-0x0000000006530000-0x000000000657C000-memory.dmp
memory/3628-40-0x0000000070A80000-0x0000000070ACC000-memory.dmp
memory/3628-51-0x0000000006A00000-0x0000000006A1E000-memory.dmp
memory/3628-50-0x0000000074C60000-0x0000000075410000-memory.dmp
memory/3628-56-0x00000000077C0000-0x00000000077DA000-memory.dmp
memory/3628-39-0x00000000069C0000-0x00000000069F2000-memory.dmp
memory/3628-53-0x00000000076F0000-0x0000000007793000-memory.dmp
memory/3628-54-0x0000000074C60000-0x0000000075410000-memory.dmp
memory/3628-55-0x0000000007E20000-0x000000000849A000-memory.dmp
memory/4960-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4960-14-0x0000000001310000-0x000000000165A000-memory.dmp
memory/4960-69-0x00000000017C0000-0x00000000017D4000-memory.dmp
memory/4960-68-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4960-16-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4960-17-0x0000000000D90000-0x0000000000DA4000-memory.dmp
memory/5048-7-0x0000000074BEE000-0x0000000074BEF000-memory.dmp
memory/5048-13-0x0000000074BE0000-0x0000000075390000-memory.dmp
memory/5048-8-0x0000000074BE0000-0x0000000075390000-memory.dmp
memory/5048-10-0x0000000006B30000-0x0000000006BCC000-memory.dmp
memory/5048-9-0x0000000006860000-0x00000000068D6000-memory.dmp
memory/5048-0-0x0000000074BEE000-0x0000000074BEF000-memory.dmp
memory/5048-6-0x0000000005C70000-0x0000000005C88000-memory.dmp
memory/5048-5-0x0000000005810000-0x000000000581A000-memory.dmp
memory/5048-4-0x0000000074BE0000-0x0000000075390000-memory.dmp
memory/5048-3-0x0000000005650000-0x00000000056E2000-memory.dmp
memory/5048-2-0x0000000005CB0000-0x0000000006254000-memory.dmp
memory/5048-1-0x0000000000BF0000-0x0000000000C8E000-memory.dmp