Analysis
- max time kernel
146s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
29/08/2024, 08:55
General
- Target 2.exe
- Size 26KB
- Sample240829-kvjdssvfpr
- SHA256 5a0cf9e038ccec4e878a683c917c93d28a9aa301d478711b01c199e9fb14aa30
Malware Config
Extracted
-
formbook
-
4.1
-
rn94
-
st68v.xyz
-
conciergenotary.net
-
qwechaotk.top
-
rtpdonatoto29.xyz
-
8ad.xyz
-
powermove.top
-
cameras-30514.bond
-
vanguardcoffee.shop
-
umoe53fxc1bsujv.buzz
-
consultoriamax.net
-
hplxx.com
-
ndu.wtf
-
yzh478c.xyz
-
bigbrown999.site
-
xiake07.asia
-
resdai.xyz
-
the35678.shop
-
ba6rf.rest
-
ceo688.com
-
phimxhot.xyz
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Formbook payload 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Enumerates system info in registry 2 TTPs 1 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 57 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\2.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1152-1092-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1152-1093-0x00000000015C0000-0x000000000190A000-memory.dmp
memory/1152-1097-0x00000000014A0000-0x00000000014B5000-memory.dmp
memory/1152-1096-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2952-1101-0x0000000000B60000-0x0000000000B6A000-memory.dmp
memory/3420-1098-0x0000000008970000-0x0000000008AAE000-memory.dmp
memory/3420-1109-0x0000000008AB0000-0x0000000008BE9000-memory.dmp
memory/3420-1106-0x0000000008AB0000-0x0000000008BE9000-memory.dmp
memory/3420-1103-0x0000000008970000-0x0000000008AAE000-memory.dmp
memory/3652-33-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-23-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-61-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-67-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-65-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-63-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-59-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-57-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-55-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-53-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-51-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-49-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-47-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-43-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-41-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-45-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-39-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-37-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-35-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-11-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-31-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-29-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-25-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-17-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-21-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-19-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-15-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-13-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-9-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-7-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-5-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-27-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-4-0x00000000065C0000-0x00000000066B8000-memory.dmp
memory/3652-898-0x000000007446E000-0x000000007446F000-memory.dmp
memory/3652-1079-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/3652-1080-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/3652-1081-0x0000000006800000-0x0000000006878000-memory.dmp
memory/3652-1082-0x0000000006880000-0x00000000068CC000-memory.dmp
memory/3652-1083-0x00000000071B0000-0x0000000007754000-memory.dmp
memory/3652-1084-0x0000000006AA0000-0x0000000006AF4000-memory.dmp
memory/3652-3-0x00000000065C0000-0x00000000066BE000-memory.dmp
memory/3652-2-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/3652-1-0x0000000000B10000-0x0000000000B1E000-memory.dmp
memory/3652-0-0x000000007446E000-0x000000007446F000-memory.dmp
memory/3652-1088-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/3652-1089-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/3652-1090-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/3652-1095-0x0000000074460000-0x0000000074C10000-memory.dmp