Resubmissions

01/07/2025, 06:41

250701-hf9akasp12 10

01/07/2025, 06:22

250701-g43bgsdl5v 10

10/06/2025, 16:01

250610-tgnk2azqw5 10

Analysis

  • max time kernel
    147s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250610-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/07/2025, 06:22

General

  • Target

    271JaJbQjMLGbcc.exe

  • Size

    667KB

  • MD5

    17043ee76cd32800262fa06cfc3ac690

  • SHA1

    0f11ac97736fb42fd30d6c4abf1da4549e8f0101

  • SHA256

    6781be8abda50b0cc7d27b9466f7b39572f978cf16151092554e7b4557f0ac06

  • SHA512

    0ec8c106a4d55deee49da8a9696f36cbcfb55872d0d2e982416be34ab7e81faa2b2c12f86575e195093d24b78978691c4c242fe7bdf1ab728a68bf92b57d31d7

  • SSDEEP

    12288:disP8yffxahqfDGZW17k0+YHPEd8MwP0WAra3OjuBGy1kuOEXuVjCqfkR:n8yffxQqbuWZk9DNWAr6u+3OCq6

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hi26

Decoy

ctopeaux.shop

isui.shop

huangyusij.top

tsgfa.lol

bcjpp.top

ccess1logsmexico.lat

6vhv7.vip

3i1mp.vip

isy.art

rterracaudill.today

377278d.app

izoc.xyz

guiwe.xyz

81rwp.vip

hi8t3b5a3.shop

omnerror.shop

hm6l1w9o5.shop

saondemandswag.net

sig.xyz

andbags-48525.bond

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3528
    • C:\Users\Admin\AppData\Local\Temp\271JaJbQjMLGbcc.exe
      "C:\Users\Admin\AppData\Local\Temp\271JaJbQjMLGbcc.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2384
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\271JaJbQjMLGbcc.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2900
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xQKiRiS.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5640
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xQKiRiS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA950.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3160
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        3⤵
          PID:5196
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
          3⤵
            PID:5472
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
            3⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            PID:3680
        • C:\Windows\SysWOW64\wlanext.exe
          "C:\Windows\SysWOW64\wlanext.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4664
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5124

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

              Filesize

              2KB

              MD5

              968cb9309758126772781b83adb8a28f

              SHA1

              8da30e71accf186b2ba11da1797cf67f8f78b47c

              SHA256

              92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

              SHA512

              4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1tadjw5w.ht2.ps1

              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            • C:\Users\Admin\AppData\Local\Temp\tmpA950.tmp

              Filesize

              1KB

              MD5

              bd4d345e000025b577754e00d4f9662c

              SHA1

              b6da423825f6c5f530f0841138dc028483f07656

              SHA256

              cf5c7ca4dd0651c4fab373ef8540adb6423793b0c8a61eaff0a52979b7728464

              SHA512

              bab188a7440298fbdaad668cd1d1d7d70bad867537055460dac62c14b754be91336fc4834657b63cdacc0e40468e0df7181aa9881176f8b91211be7f96510e67

            • memory/2384-1-0x00000000058D0000-0x0000000005E74000-memory.dmp

              Filesize

              5.6MB

            • memory/2384-2-0x0000000005320000-0x00000000053B2000-memory.dmp

              Filesize

              584KB

            • memory/2384-3-0x00000000054A0000-0x00000000054B0000-memory.dmp

              Filesize

              64KB

            • memory/2384-4-0x00000000052C0000-0x00000000052CA000-memory.dmp

              Filesize

              40KB

            • memory/2384-5-0x00000000055A0000-0x000000000563C000-memory.dmp

              Filesize

              624KB

            • memory/2384-6-0x0000000005480000-0x0000000005490000-memory.dmp

              Filesize

              64KB

            • memory/2384-7-0x00000000054A0000-0x00000000054B0000-memory.dmp

              Filesize

              64KB

            • memory/2384-8-0x0000000006580000-0x00000000065F8000-memory.dmp

              Filesize

              480KB

            • memory/2384-0-0x0000000000830000-0x00000000008DA000-memory.dmp

              Filesize

              680KB

            • memory/2900-71-0x0000000007260000-0x000000000726A000-memory.dmp

              Filesize

              40KB

            • memory/2900-58-0x0000000074E70000-0x0000000074EBC000-memory.dmp

              Filesize

              304KB

            • memory/2900-19-0x0000000005720000-0x0000000005742000-memory.dmp

              Filesize

              136KB

            • memory/2900-21-0x0000000005830000-0x0000000005896000-memory.dmp

              Filesize

              408KB

            • memory/2900-20-0x00000000057C0000-0x0000000005826000-memory.dmp

              Filesize

              408KB

            • memory/2900-13-0x0000000004910000-0x0000000004946000-memory.dmp

              Filesize

              216KB

            • memory/2900-14-0x0000000004A30000-0x0000000004A40000-memory.dmp

              Filesize

              64KB

            • memory/2900-77-0x0000000007500000-0x0000000007508000-memory.dmp

              Filesize

              32KB

            • memory/2900-76-0x0000000007520000-0x000000000753A000-memory.dmp

              Filesize

              104KB

            • memory/2900-75-0x0000000007420000-0x0000000007434000-memory.dmp

              Filesize

              80KB

            • memory/2900-15-0x0000000004A30000-0x0000000004A40000-memory.dmp

              Filesize

              64KB

            • memory/2900-70-0x00000000071E0000-0x00000000071FA000-memory.dmp

              Filesize

              104KB

            • memory/3528-87-0x00000000081A0000-0x0000000008260000-memory.dmp

              Filesize

              768KB

            • memory/3680-41-0x0000000000400000-0x000000000042E000-memory.dmp

              Filesize

              184KB

            • memory/4664-82-0x0000000000600000-0x0000000000617000-memory.dmp

              Filesize

              92KB

            • memory/4664-84-0x0000000000550000-0x000000000057E000-memory.dmp

              Filesize

              184KB

            • memory/4664-83-0x0000000000600000-0x0000000000617000-memory.dmp

              Filesize

              92KB

            • memory/5640-47-0x0000000074E70000-0x0000000074EBC000-memory.dmp

              Filesize

              304KB

            • memory/5640-57-0x0000000006290000-0x00000000062AE000-memory.dmp

              Filesize

              120KB

            • memory/5640-72-0x0000000007240000-0x00000000072D6000-memory.dmp

              Filesize

              600KB

            • memory/5640-73-0x00000000071C0000-0x00000000071D1000-memory.dmp

              Filesize

              68KB

            • memory/5640-74-0x00000000071F0000-0x00000000071FE000-memory.dmp

              Filesize

              56KB

            • memory/5640-44-0x0000000005CA0000-0x0000000005CBE000-memory.dmp

              Filesize

              120KB

            • memory/5640-45-0x0000000006240000-0x000000000628C000-memory.dmp

              Filesize

              304KB

            • memory/5640-17-0x0000000004F30000-0x0000000005558000-memory.dmp

              Filesize

              6.2MB

            • memory/5640-40-0x00000000056B0000-0x0000000005A04000-memory.dmp

              Filesize

              3.3MB

            • memory/5640-69-0x0000000007610000-0x0000000007C8A000-memory.dmp

              Filesize

              6.5MB

            • memory/5640-46-0x0000000006CA0000-0x0000000006CD2000-memory.dmp

              Filesize

              200KB

            • memory/5640-60-0x0000000006CE0000-0x0000000006D83000-memory.dmp

              Filesize

              652KB

            • memory/5640-16-0x00000000048F0000-0x0000000004900000-memory.dmp

              Filesize

              64KB