Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
07/10/2024, 08:13
General
- Target tnbws7pyQvMUSjF.exe
- Size 731KB
- Sample241007-j4ge5avepr
- SHA256 03b5cfab3f0ffdf96e415006004be9a0c05e6365e1d5834984cfd5cea9df85fe
Malware Config
Extracted
-
formbook
-
4.1
-
t18n
-
tmusicoregon.net
-
atici.online
-
j7u7.xyz
-
iewunucierwuerwnziqi1.info
-
ruvabetgiris.website
-
acik.lat
-
obsk.top
-
sphaltpaving-ttp1-shd-us-2.shop
-
ispensarynearme.news
-
b3nd.bond
-
urelook.xyz
-
gearlpfbm.top
-
aconstructionjob.bond
-
killsnexis.info
-
oshon.xyz
-
ashabsxw.top
-
ussiatraiding.buzz
-
raipsehumus.homes
-
6ae23rx.forum
-
edar88vvip.shop
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 60 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tnbws7pyQvMUSjF.exe"C:\Users\Admin\AppData\Local\Temp\tnbws7pyQvMUSjF.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\tnbws7pyQvMUSjF.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\tnbws7pyQvMUSjF.exe"C:\Users\Admin\AppData\Local\Temp\tnbws7pyQvMUSjF.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tnbws7pyQvMUSjF.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_mfmkbafe.3re.ps1
memory/3336-55-0x00000000070B0000-0x00000000070CA000-memory.dmp
memory/3336-57-0x0000000007330000-0x00000000073C6000-memory.dmp
memory/3336-68-0x0000000074CA0000-0x0000000075450000-memory.dmp
memory/3336-64-0x00000000073D0000-0x00000000073D8000-memory.dmp
memory/3336-63-0x00000000073F0000-0x000000000740A000-memory.dmp
memory/3336-62-0x00000000072F0000-0x0000000007304000-memory.dmp
memory/3336-36-0x0000000005950000-0x0000000005CA4000-memory.dmp
memory/3336-58-0x00000000072B0000-0x00000000072C1000-memory.dmp
memory/3336-37-0x0000000005D80000-0x0000000005D9E000-memory.dmp
memory/3336-56-0x0000000007120000-0x000000000712A000-memory.dmp
memory/3336-54-0x00000000076F0000-0x0000000007D6A000-memory.dmp
memory/3336-53-0x0000000006D90000-0x0000000006E33000-memory.dmp
memory/3336-51-0x0000000002530000-0x0000000002540000-memory.dmp
memory/3336-52-0x0000000006330000-0x000000000634E000-memory.dmp
memory/3336-41-0x0000000070AC0000-0x0000000070B0C000-memory.dmp
memory/3336-23-0x0000000002530000-0x0000000002540000-memory.dmp
memory/3336-40-0x0000000006D50000-0x0000000006D82000-memory.dmp
memory/3336-21-0x0000000074CA0000-0x0000000075450000-memory.dmp
memory/3336-20-0x0000000004F10000-0x0000000005538000-memory.dmp
memory/3336-19-0x0000000002470000-0x00000000024A6000-memory.dmp
memory/3336-18-0x0000000074CAE000-0x0000000074CAF000-memory.dmp
memory/3336-39-0x000000007F2B0000-0x000000007F2C0000-memory.dmp
memory/3336-33-0x0000000005760000-0x0000000005782000-memory.dmp
memory/3336-34-0x0000000005870000-0x00000000058D6000-memory.dmp
memory/3336-38-0x0000000005E20000-0x0000000005E6C000-memory.dmp
memory/3336-61-0x00000000072E0000-0x00000000072EE000-memory.dmp
memory/3336-35-0x00000000058E0000-0x0000000005946000-memory.dmp
memory/3548-69-0x00000000087D0000-0x0000000008932000-memory.dmp
memory/3548-73-0x0000000008940000-0x0000000008A97000-memory.dmp
memory/3548-22-0x00000000087D0000-0x0000000008932000-memory.dmp
memory/3892-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3892-14-0x0000000000EF0000-0x000000000123A000-memory.dmp
memory/3892-16-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3892-17-0x0000000000DC0000-0x0000000000DD4000-memory.dmp
memory/4204-60-0x0000000000AB0000-0x0000000000AD7000-memory.dmp
memory/4204-67-0x0000000000F20000-0x0000000000F4F000-memory.dmp
memory/4204-59-0x0000000000AB0000-0x0000000000AD7000-memory.dmp
memory/4764-0-0x0000000074C2E000-0x0000000074C2F000-memory.dmp
memory/4764-13-0x0000000074C20000-0x00000000753D0000-memory.dmp
memory/4764-10-0x000000000B3D0000-0x000000000B46C000-memory.dmp
memory/4764-2-0x0000000005AC0000-0x0000000006064000-memory.dmp
memory/4764-7-0x0000000074C2E000-0x0000000074C2F000-memory.dmp
memory/4764-6-0x0000000005620000-0x000000000563E000-memory.dmp
memory/4764-5-0x0000000074C20000-0x00000000753D0000-memory.dmp
memory/4764-4-0x00000000054C0000-0x00000000054CA000-memory.dmp
memory/4764-3-0x0000000005510000-0x00000000055A2000-memory.dmp
memory/4764-9-0x0000000004F80000-0x0000000004FF6000-memory.dmp
memory/4764-8-0x0000000074C20000-0x00000000753D0000-memory.dmp
memory/4764-1-0x0000000000B40000-0x0000000000BFC000-memory.dmp