Analysis
- max time kernel
94s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
14/11/2024, 01:00
General
- Target 4a78c8f9b9321dd93c0e1c9e325271c434aa194d67e9d63b73c66c054d44049f.exe
- Size 586KB
- Sample241114-bcpnesvrgp
- SHA256 4a78c8f9b9321dd93c0e1c9e325271c434aa194d67e9d63b73c66c054d44049f
Malware Config
Extracted
-
formbook
-
4.1
-
m17o
-
kzqh72.top
-
arket-obybqq.xyz
-
afechoice.click
-
ote-knplpa.xyz
-
aqgpie.xyz
-
orker-ornp.xyz
-
he-beds321.today
-
ut-nlvv.xyz
-
31231827.xyz
-
milymariephotography.net
-
wquqo.click
-
veu-where.xyz
-
mjcpo-pick.xyz
-
yself-lpnbdl.xyz
-
austoowagosha.net
-
ive-wgag.xyz
-
lay-drift-palace.xyz
-
old-vubgv.xyz
-
ideo-shooting-courses.today
-
ntendsisaiasjazmin.shop
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook family
- Formbook payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a78c8f9b9321dd93c0e1c9e325271c434aa194d67e9d63b73c66c054d44049f.exe"C:\Users\Admin\AppData\Local\Temp\4a78c8f9b9321dd93c0e1c9e325271c434aa194d67e9d63b73c66c054d44049f.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\4a78c8f9b9321dd93c0e1c9e325271c434aa194d67e9d63b73c66c054d44049f.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\4a78c8f9b9321dd93c0e1c9e325271c434aa194d67e9d63b73c66c054d44049f.exe"C:\Users\Admin\AppData\Local\Temp\4a78c8f9b9321dd93c0e1c9e325271c434aa194d67e9d63b73c66c054d44049f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_tcvxs23r.tys.ps1
memory/2592-8-0x0000000074CFE000-0x0000000074CFF000-memory.dmp
memory/2592-1-0x0000000000C60000-0x0000000000CF8000-memory.dmp
memory/2592-3-0x00000000056F0000-0x0000000005782000-memory.dmp
memory/2592-4-0x00000000058B0000-0x00000000058BA000-memory.dmp
memory/2592-5-0x0000000074CF0000-0x00000000754A0000-memory.dmp
memory/2592-6-0x0000000005960000-0x00000000059FC000-memory.dmp
memory/2592-2-0x0000000005BC0000-0x0000000006164000-memory.dmp
memory/2592-0-0x0000000074CFE000-0x0000000074CFF000-memory.dmp
memory/2592-7-0x0000000005B10000-0x0000000005B22000-memory.dmp
memory/2592-10-0x0000000006C40000-0x0000000006CB8000-memory.dmp
memory/2592-9-0x0000000074CF0000-0x00000000754A0000-memory.dmp
memory/2592-14-0x0000000074CF0000-0x00000000754A0000-memory.dmp
memory/2612-13-0x0000000001340000-0x000000000168A000-memory.dmp
memory/2612-61-0x0000000001340000-0x000000000168A000-memory.dmp
memory/2612-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4436-25-0x0000000005E80000-0x0000000005EE6000-memory.dmp
memory/4436-47-0x0000000007530000-0x00000000075D3000-memory.dmp
memory/4436-24-0x0000000005DE0000-0x0000000005E02000-memory.dmp
memory/4436-18-0x0000000005770000-0x0000000005D98000-memory.dmp
memory/4436-16-0x0000000004FB0000-0x0000000004FE6000-memory.dmp
memory/4436-30-0x0000000006190000-0x00000000061F6000-memory.dmp
memory/4436-31-0x0000000006200000-0x0000000006554000-memory.dmp
memory/4436-32-0x0000000006560000-0x000000000657E000-memory.dmp
memory/4436-33-0x00000000065B0000-0x00000000065FC000-memory.dmp
memory/4436-35-0x0000000070BB0000-0x0000000070BFC000-memory.dmp
memory/4436-34-0x0000000006B30000-0x0000000006B62000-memory.dmp
memory/4436-46-0x0000000006B10000-0x0000000006B2E000-memory.dmp
memory/4436-45-0x0000000074D90000-0x0000000075540000-memory.dmp
memory/4436-17-0x0000000074D90000-0x0000000075540000-memory.dmp
memory/4436-48-0x0000000074D90000-0x0000000075540000-memory.dmp
memory/4436-49-0x0000000007EF0000-0x000000000856A000-memory.dmp
memory/4436-50-0x00000000078B0000-0x00000000078CA000-memory.dmp
memory/4436-51-0x0000000007920000-0x000000000792A000-memory.dmp
memory/4436-52-0x0000000007B30000-0x0000000007BC6000-memory.dmp
memory/4436-53-0x0000000007AB0000-0x0000000007AC1000-memory.dmp
memory/4436-54-0x0000000007AE0000-0x0000000007AEE000-memory.dmp
memory/4436-55-0x0000000007AF0000-0x0000000007B04000-memory.dmp
memory/4436-56-0x0000000007BF0000-0x0000000007C0A000-memory.dmp
memory/4436-57-0x0000000007BD0000-0x0000000007BD8000-memory.dmp
memory/4436-60-0x0000000074D90000-0x0000000075540000-memory.dmp
memory/4436-15-0x0000000074D9E000-0x0000000074D9F000-memory.dmp