Analysis
- max time kernel
95s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
13/11/2024, 02:06
General
- Target 1091372b812b70532f2d29f18f41f1618a0d72ec9e03caa5bc02dda877ff04f9.exe
- Size 743KB
- Sample241113-cjsjbstncw
- SHA256 1091372b812b70532f2d29f18f41f1618a0d72ec9e03caa5bc02dda877ff04f9
Malware Config
Extracted
-
formbook
-
4.1
-
hy29
-
obswell.online
-
etflix.luxury
-
ulunguwethu.store
-
ulbcenter.shop
-
nswering-service-mi-de-tt.click
-
upport-marketplace84.click
-
wepxbd163.lat
-
mplants-doctors.today
-
aofexf90yj.top
-
hermodynamic.space
-
dfg3n489.cyou
-
off.gay
-
alkak.cam
-
ijanarko.net
-
7tl.site
-
yaanincma.store
-
ires-47022.bond
-
elek4dalt77.xyz
-
foxsakepeople.online
-
ndefeatedqs.shop
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook family
- Formbook payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1091372b812b70532f2d29f18f41f1618a0d72ec9e03caa5bc02dda877ff04f9.exe"C:\Users\Admin\AppData\Local\Temp\1091372b812b70532f2d29f18f41f1618a0d72ec9e03caa5bc02dda877ff04f9.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tqLSItFXSP.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tqLSItFXSP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCFF2.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\1091372b812b70532f2d29f18f41f1618a0d72ec9e03caa5bc02dda877ff04f9.exe"C:\Users\Admin\AppData\Local\Temp\1091372b812b70532f2d29f18f41f1618a0d72ec9e03caa5bc02dda877ff04f9.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_f1vcppgm.bca.ps1
tmpCFF2.tmp
memory/1928-23-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1928-37-0x00000000015D0000-0x000000000191A000-memory.dmp
memory/2388-8-0x0000000074F9E000-0x0000000074F9F000-memory.dmp
memory/2388-5-0x0000000074F90000-0x0000000075740000-memory.dmp
memory/2388-6-0x0000000005820000-0x00000000058BC000-memory.dmp
memory/2388-7-0x00000000069C0000-0x00000000069DC000-memory.dmp
memory/2388-4-0x0000000005590000-0x000000000559A000-memory.dmp
memory/2388-9-0x0000000074F90000-0x0000000075740000-memory.dmp
memory/2388-10-0x0000000002F10000-0x0000000002F86000-memory.dmp
memory/2388-3-0x00000000055F0000-0x0000000005682000-memory.dmp
memory/2388-36-0x0000000074F90000-0x0000000075740000-memory.dmp
memory/2388-2-0x0000000005BA0000-0x0000000006144000-memory.dmp
memory/2388-1-0x0000000000AE0000-0x0000000000BA0000-memory.dmp
memory/2388-0-0x0000000074F9E000-0x0000000074F9F000-memory.dmp
memory/2832-25-0x0000000074F90000-0x0000000075740000-memory.dmp
memory/2832-42-0x0000000075820000-0x000000007586C000-memory.dmp
memory/2832-19-0x0000000005440000-0x0000000005462000-memory.dmp
memory/2832-21-0x0000000005550000-0x00000000055B6000-memory.dmp
memory/2832-22-0x0000000074F90000-0x0000000075740000-memory.dmp
memory/2832-17-0x0000000004CD0000-0x00000000052F8000-memory.dmp
memory/2832-16-0x0000000074F90000-0x0000000075740000-memory.dmp
memory/2832-24-0x00000000055C0000-0x0000000005914000-memory.dmp
memory/2832-15-0x00000000022F0000-0x0000000002326000-memory.dmp
memory/2832-38-0x0000000005BC0000-0x0000000005BDE000-memory.dmp
memory/2832-39-0x0000000005C50000-0x0000000005C9C000-memory.dmp
memory/2832-40-0x000000007EEE0000-0x000000007EEF0000-memory.dmp
memory/2832-41-0x0000000006B80000-0x0000000006BB2000-memory.dmp
memory/2832-20-0x00000000054E0000-0x0000000005546000-memory.dmp
memory/2832-53-0x0000000006190000-0x00000000061AE000-memory.dmp
memory/2832-52-0x0000000002340000-0x0000000002350000-memory.dmp
memory/2832-54-0x0000000006DC0000-0x0000000006E63000-memory.dmp
memory/2832-55-0x0000000007550000-0x0000000007BCA000-memory.dmp
memory/2832-56-0x0000000006F00000-0x0000000006F1A000-memory.dmp
memory/2832-57-0x0000000006F70000-0x0000000006F7A000-memory.dmp
memory/2832-58-0x0000000007180000-0x0000000007216000-memory.dmp
memory/2832-59-0x0000000007100000-0x0000000007111000-memory.dmp
memory/2832-60-0x0000000007130000-0x000000000713E000-memory.dmp
memory/2832-61-0x0000000007140000-0x0000000007154000-memory.dmp
memory/2832-62-0x0000000007240000-0x000000000725A000-memory.dmp
memory/2832-63-0x0000000007220000-0x0000000007228000-memory.dmp
memory/2832-66-0x0000000074F90000-0x0000000075740000-memory.dmp