Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20250129-en - resource tags
- submitted
03/02/2025, 06:38
General
- Target payment Copy882pdf.exe
- Size 682KB
- Sample250203-hd6fwsvpfp
- SHA256 60ccea072df0c91b1b0f2cc18a88eff5e373c68f4d13c7d93e66fb17d211ec9e
Malware Config
Extracted
-
formbook
-
4.1
-
a02d
-
coplus.market
-
oofing-jobs-74429.bond
-
healchemists.xyz
-
oofcarpenternearme-jp.xyz
-
enewebsolutions.online
-
harepoint.legal
-
88977.club
-
omptables.xyz
-
eat-pumps-31610.bond
-
endown.graphics
-
amsexgirls.website
-
ovevibes.xyz
-
u-thiensu.online
-
yblinds.xyz
-
rumpchiefofstaff.store
-
erzog.fun
-
rrm.lat
-
agiclime.pro
-
agaviet59.shop
-
lbdoanhnhan.net
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook family
- Formbook payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 62 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 17 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\payment Copy882pdf.exe"C:\Users\Admin\AppData\Local\Temp\payment Copy882pdf.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\payment Copy882pdf.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\KtITRcPJlV.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KtITRcPJlV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF184.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_qatazg4j.1ls.ps1
tmpF184.tmp
memory/1684-92-0x0000000000F40000-0x0000000000F6F000-memory.dmp
memory/1684-91-0x0000000000160000-0x0000000000187000-memory.dmp
memory/3468-95-0x0000000008300000-0x0000000008402000-memory.dmp
memory/4208-35-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4352-22-0x0000000005100000-0x0000000005122000-memory.dmp
memory/4352-64-0x0000000075450000-0x000000007549C000-memory.dmp
memory/4352-90-0x0000000074BC0000-0x0000000075370000-memory.dmp
memory/4352-15-0x00000000049F0000-0x0000000004A26000-memory.dmp
memory/4352-17-0x00000000051B0000-0x00000000057D8000-memory.dmp
memory/4352-16-0x0000000074BC0000-0x0000000075370000-memory.dmp
memory/4352-18-0x0000000074BC0000-0x0000000075370000-memory.dmp
memory/4352-19-0x0000000074BC0000-0x0000000075370000-memory.dmp
memory/4352-83-0x0000000007610000-0x0000000007618000-memory.dmp
memory/4352-82-0x0000000007630000-0x000000000764A000-memory.dmp
memory/4352-24-0x0000000005940000-0x00000000059A6000-memory.dmp
memory/4352-31-0x00000000059B0000-0x0000000005D04000-memory.dmp
memory/4352-81-0x0000000007530000-0x0000000007544000-memory.dmp
memory/4352-79-0x00000000074F0000-0x0000000007501000-memory.dmp
memory/4352-78-0x0000000007570000-0x0000000007606000-memory.dmp
memory/4352-23-0x00000000057E0000-0x0000000005846000-memory.dmp
memory/4352-75-0x0000000007940000-0x0000000007FBA000-memory.dmp
memory/4836-52-0x0000000006E10000-0x0000000006E42000-memory.dmp
memory/4836-36-0x0000000074BC0000-0x0000000075370000-memory.dmp
memory/4836-50-0x0000000005C60000-0x0000000005C7E000-memory.dmp
memory/4836-51-0x0000000005C90000-0x0000000005CDC000-memory.dmp
memory/4836-89-0x0000000074BC0000-0x0000000075370000-memory.dmp
memory/4836-63-0x0000000006E50000-0x0000000006E6E000-memory.dmp
memory/4836-21-0x0000000074BC0000-0x0000000075370000-memory.dmp
memory/4836-53-0x0000000075450000-0x000000007549C000-memory.dmp
memory/4836-74-0x0000000006E70000-0x0000000006F13000-memory.dmp
memory/4836-46-0x0000000074BC0000-0x0000000075370000-memory.dmp
memory/4836-76-0x0000000006FA0000-0x0000000006FBA000-memory.dmp
memory/4836-77-0x0000000007010000-0x000000000701A000-memory.dmp
memory/4836-80-0x00000000071D0000-0x00000000071DE000-memory.dmp
memory/5016-48-0x0000000074BC0000-0x0000000075370000-memory.dmp
memory/5016-6-0x0000000005A50000-0x0000000005AEC000-memory.dmp
memory/5016-7-0x0000000005C70000-0x0000000005C8E000-memory.dmp
memory/5016-0-0x0000000074BCE000-0x0000000074BCF000-memory.dmp
memory/5016-8-0x0000000074BCE000-0x0000000074BCF000-memory.dmp
memory/5016-4-0x0000000005790000-0x000000000579A000-memory.dmp
memory/5016-5-0x0000000074BC0000-0x0000000075370000-memory.dmp
memory/5016-10-0x0000000003130000-0x00000000031AA000-memory.dmp
memory/5016-9-0x0000000074BC0000-0x0000000075370000-memory.dmp
memory/5016-3-0x00000000057C0000-0x0000000005852000-memory.dmp
memory/5016-2-0x0000000005CD0000-0x0000000006274000-memory.dmp
memory/5016-1-0x0000000000D30000-0x0000000000DE2000-memory.dmp