Analysis
- max time kernel
146s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
02/09/2024, 04:18
General
- Target SecuriteInfo.com.Win32.CrypterX-gen.29279.29610.exe
- Size 695KB
- Sample240902-ewybfssdra
- SHA256 8140718075fb3cf55e098f68fa8dfc75022a22fb658611503880b4c0c674d71f
Malware Config
Extracted
-
formbook
-
4.1
-
m49z
-
ormswarm.xyz
-
awn-care-63587.bond
-
uymetanail5.online
-
mergencyloan007.xyz
-
545.top
-
eiliao596.pro
-
ackersandmoverschennai.net
-
ehdiahmadvandmusicbest.click
-
tlgxmb2024.cloud
-
ulfcoastharborhopper.pro
-
rohns-disease-early-signs.today
-
oldenhorizonsbgcl.click
-
weetindulgencepro.xyz
-
yexoiup.xyz
-
yself-solar.net
-
kfirsatimla.online
-
bropub3.online
-
ouljourney.online
-
usvf76f.shop
-
onnaberich.online
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.29279.29610.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.29279.29610.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.29279.29610.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_vprwri1r.fv3.ps1
memory/2004-63-0x0000000000C70000-0x0000000000C7E000-memory.dmp
memory/2004-65-0x0000000000C70000-0x0000000000C7E000-memory.dmp
memory/2004-70-0x0000000000A30000-0x0000000000A5F000-memory.dmp
memory/2008-52-0x00000000068F0000-0x000000000690E000-memory.dmp
memory/2008-54-0x0000000007C50000-0x00000000082CA000-memory.dmp
memory/2008-36-0x0000000005D00000-0x0000000006054000-memory.dmp
memory/2008-62-0x0000000007930000-0x0000000007938000-memory.dmp
memory/2008-61-0x0000000007950000-0x000000000796A000-memory.dmp
memory/2008-60-0x0000000007850000-0x0000000007864000-memory.dmp
memory/2008-59-0x0000000007840000-0x000000000784E000-memory.dmp
memory/2008-58-0x0000000007810000-0x0000000007821000-memory.dmp
memory/2008-57-0x0000000007890000-0x0000000007926000-memory.dmp
memory/2008-56-0x0000000007680000-0x000000000768A000-memory.dmp
memory/2008-23-0x0000000004E70000-0x0000000004E80000-memory.dmp
memory/2008-55-0x0000000007610000-0x000000000762A000-memory.dmp
memory/2008-21-0x0000000074860000-0x0000000075010000-memory.dmp
memory/2008-20-0x00000000054B0000-0x0000000005AD8000-memory.dmp
memory/2008-19-0x000000007486E000-0x000000007486F000-memory.dmp
memory/2008-24-0x0000000005230000-0x0000000005252000-memory.dmp
memory/2008-25-0x0000000005AE0000-0x0000000005B46000-memory.dmp
memory/2008-68-0x0000000074860000-0x0000000075010000-memory.dmp
memory/2008-53-0x00000000072D0000-0x0000000007373000-memory.dmp
memory/2008-40-0x0000000006850000-0x0000000006882000-memory.dmp
memory/2008-26-0x0000000005C90000-0x0000000005CF6000-memory.dmp
memory/2008-16-0x0000000004D40000-0x0000000004D76000-memory.dmp
memory/2008-47-0x0000000004E70000-0x0000000004E80000-memory.dmp
memory/2008-37-0x00000000062F0000-0x000000000630E000-memory.dmp
memory/2008-38-0x00000000068A0000-0x00000000068EC000-memory.dmp
memory/2008-39-0x000000007EEB0000-0x000000007EEC0000-memory.dmp
memory/2008-41-0x0000000070680000-0x00000000706CC000-memory.dmp
memory/3472-4-0x00000000747E0000-0x0000000074F90000-memory.dmp
memory/3472-13-0x00000000747E0000-0x0000000074F90000-memory.dmp
memory/3472-5-0x0000000004EB0000-0x0000000004EBA000-memory.dmp
memory/3472-0-0x00000000747EE000-0x00000000747EF000-memory.dmp
memory/3472-1-0x00000000003B0000-0x0000000000460000-memory.dmp
memory/3472-3-0x0000000004DE0000-0x0000000004E72000-memory.dmp
memory/3472-6-0x0000000007A60000-0x0000000007A78000-memory.dmp
memory/3472-9-0x0000000006030000-0x00000000060A6000-memory.dmp
memory/3472-2-0x0000000005480000-0x0000000005A24000-memory.dmp
memory/3472-10-0x00000000062B0000-0x000000000634C000-memory.dmp
memory/3472-7-0x00000000747EE000-0x00000000747EF000-memory.dmp
memory/3472-8-0x00000000747E0000-0x0000000074F90000-memory.dmp
memory/3516-74-0x0000000007C90000-0x0000000007DE9000-memory.dmp
memory/3516-22-0x00000000026D0000-0x00000000027A1000-memory.dmp
memory/3516-69-0x00000000026D0000-0x00000000027A1000-memory.dmp
memory/3752-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3752-17-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3752-18-0x0000000001450000-0x0000000001464000-memory.dmp
memory/3752-14-0x0000000001950000-0x0000000001C9A000-memory.dmp