Analysis
- max time kernel
148s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20250314-en - resource tags
- submitted
24/03/2025, 12:25
General
- Target dekont.pdf.exe
- Size 628KB
- Sample250324-pltwdstkt4
- SHA256 3fbcec3b7e1d2b8efef9e2ab1be54a55e2252166cd357fc2ee9cb42581851365
Malware Config
Extracted
-
formbook
-
4.1
-
m13o
-
un20250227-23.fun
-
mallelectricarsgb.bond
-
emvmaasbn.pro
-
ewaraja.xyz
-
olar-systems-panels-18238.bond
-
anjau2.cfd
-
ental-implants-58831.bond
-
riferrari.shop
-
ypham-japan.shop
-
imilarityapi.xyz
-
ealthywayzone.online
-
r33bz.online
-
ureformula.shop
-
arlsjrmenu.net
-
ziugsyw.xyz
-
osmetic-packaging-jobs.click
-
uaizhan.xyz
-
99game.xyz
-
otdrones.shop
-
rettvollmar.shop
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook family
- Formbook payload 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dekont.pdf.exe"C:\Users\Admin\AppData\Local\Temp\dekont.pdf.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\dekont.pdf.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\dekont.pdf.exe"C:\Users\Admin\AppData\Local\Temp\dekont.pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\dekont.pdf.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_hgrfnxhh.oku.ps1
memory/632-13-0x00000000745A0000-0x0000000074D50000-memory.dmp
memory/632-1-0x0000000000690000-0x0000000000734000-memory.dmp
memory/632-2-0x0000000005690000-0x0000000005C34000-memory.dmp
memory/632-3-0x0000000005180000-0x0000000005212000-memory.dmp
memory/632-4-0x0000000005130000-0x000000000513A000-memory.dmp
memory/632-5-0x00000000745A0000-0x0000000074D50000-memory.dmp
memory/632-6-0x0000000005640000-0x0000000005658000-memory.dmp
memory/632-7-0x00000000745AE000-0x00000000745AF000-memory.dmp
memory/632-8-0x00000000745A0000-0x0000000074D50000-memory.dmp
memory/632-9-0x0000000006D70000-0x0000000006DE8000-memory.dmp
memory/632-10-0x0000000009260000-0x00000000092FC000-memory.dmp
memory/632-0-0x00000000745AE000-0x00000000745AF000-memory.dmp
memory/1228-72-0x0000000000780000-0x00000000007A7000-memory.dmp
memory/1228-73-0x0000000000B70000-0x0000000000B9F000-memory.dmp
memory/1228-71-0x0000000000780000-0x00000000007A7000-memory.dmp
memory/3336-69-0x0000000008650000-0x0000000008786000-memory.dmp
memory/3336-78-0x0000000008D20000-0x0000000008EB0000-memory.dmp
memory/3336-74-0x0000000008BC0000-0x0000000008D17000-memory.dmp
memory/3336-19-0x0000000008650000-0x0000000008786000-memory.dmp
memory/3336-70-0x0000000008BC0000-0x0000000008D17000-memory.dmp
memory/4560-17-0x0000000000E20000-0x0000000000E34000-memory.dmp
memory/4560-16-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4560-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4560-14-0x0000000001390000-0x00000000016DA000-memory.dmp
memory/4560-67-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4560-68-0x0000000003120000-0x0000000003134000-memory.dmp
memory/4728-26-0x0000000005F00000-0x0000000005F66000-memory.dmp
memory/4728-36-0x0000000005F70000-0x00000000062C4000-memory.dmp
memory/4728-37-0x0000000006520000-0x000000000653E000-memory.dmp
memory/4728-38-0x00000000065D0000-0x000000000661C000-memory.dmp
memory/4728-40-0x0000000070440000-0x000000007048C000-memory.dmp
memory/4728-39-0x0000000006AE0000-0x0000000006B12000-memory.dmp
memory/4728-52-0x0000000007570000-0x0000000007613000-memory.dmp
memory/4728-51-0x0000000074620000-0x0000000074DD0000-memory.dmp
memory/4728-50-0x0000000006B20000-0x0000000006B3E000-memory.dmp
memory/4728-53-0x0000000074620000-0x0000000074DD0000-memory.dmp
memory/4728-54-0x0000000007EA0000-0x000000000851A000-memory.dmp
memory/4728-55-0x0000000007850000-0x000000000786A000-memory.dmp
memory/4728-56-0x00000000078C0000-0x00000000078CA000-memory.dmp
memory/4728-57-0x0000000007AD0000-0x0000000007B66000-memory.dmp
memory/4728-58-0x0000000007A50000-0x0000000007A61000-memory.dmp
memory/4728-59-0x0000000007A80000-0x0000000007A8E000-memory.dmp
memory/4728-60-0x0000000007A90000-0x0000000007AA4000-memory.dmp
memory/4728-61-0x0000000007B90000-0x0000000007BAA000-memory.dmp
memory/4728-24-0x0000000005460000-0x0000000005482000-memory.dmp
memory/4728-25-0x0000000005CE0000-0x0000000005D46000-memory.dmp
memory/4728-18-0x0000000002C30000-0x0000000002C66000-memory.dmp
memory/4728-20-0x000000007462E000-0x000000007462F000-memory.dmp
memory/4728-21-0x0000000005640000-0x0000000005C68000-memory.dmp
memory/4728-23-0x0000000074620000-0x0000000074DD0000-memory.dmp
memory/4728-22-0x0000000074620000-0x0000000074DD0000-memory.dmp
memory/4728-62-0x0000000007B70000-0x0000000007B78000-memory.dmp
memory/4728-65-0x0000000074620000-0x0000000074DD0000-memory.dmp