Analysis
- max time kernel
121s - max time network
122s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
13/02/2025, 03:35
General
- Target SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.10350.31223.exe
- Size 681KB
- Sample250213-d5hrpasrfv
- SHA256 5fc7edc1a948e79253b8fa103afae335d09745d2cde4240175f423a2df9af401
Malware Config
Extracted
-
formbook
-
4.1
-
oi08
-
om-masshff.top
-
griculture-jobs-13665.bond
-
lvosuperfood.info
-
omalaysianwebsitedirectory.shop
-
mandlaamasha.africa
-
estimport.biz
-
flrt.info
-
helon.net
-
log555fastbest.shop
-
asinol.press
-
futbffod.top
-
arriage-therapy-69521.bond
-
85uz.top
-
oreadefensearmy.net
-
fhcoy.buzz
-
anda-casinoyyzz.top
-
almainwebdesign.info
-
odfitness.net
-
odafenptss.top
-
dfght.xyz
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook family
- Formbook payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.10350.31223.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.10350.31223.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.10350.31223.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\STPpQuBkqd.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\STPpQuBkqd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp19F6.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.10350.31223.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.10350.31223.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
tmp19F6.tmp
MAGTUKY78WXJBL2V651S.temp
memory/2632-21-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2632-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2632-24-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2632-19-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2748-3-0x0000000000420000-0x000000000043E000-memory.dmp
memory/2748-6-0x00000000006B0000-0x0000000000728000-memory.dmp
memory/2748-5-0x0000000074420000-0x0000000074B0E000-memory.dmp
memory/2748-4-0x000000007442E000-0x000000007442F000-memory.dmp
memory/2748-0-0x000000007442E000-0x000000007442F000-memory.dmp
memory/2748-2-0x0000000074420000-0x0000000074B0E000-memory.dmp
memory/2748-1-0x0000000000C00000-0x0000000000CB0000-memory.dmp
memory/2748-25-0x0000000074420000-0x0000000074B0E000-memory.dmp