Resubmissions

01/07/2025, 06:41

250701-hf9akasp12 10

01/07/2025, 06:22

250701-g43bgsdl5v 10

10/06/2025, 16:01

250610-tgnk2azqw5 10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250610-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250610-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    01/07/2025, 06:41

General

  • Target

    271JaJbQjMLGbcc.exe

  • Size

    667KB

  • MD5

    17043ee76cd32800262fa06cfc3ac690

  • SHA1

    0f11ac97736fb42fd30d6c4abf1da4549e8f0101

  • SHA256

    6781be8abda50b0cc7d27b9466f7b39572f978cf16151092554e7b4557f0ac06

  • SHA512

    0ec8c106a4d55deee49da8a9696f36cbcfb55872d0d2e982416be34ab7e81faa2b2c12f86575e195093d24b78978691c4c242fe7bdf1ab728a68bf92b57d31d7

  • SSDEEP

    12288:disP8yffxahqfDGZW17k0+YHPEd8MwP0WAra3OjuBGy1kuOEXuVjCqfkR:n8yffxQqbuWZk9DNWAr6u+3OCq6

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hi26

Decoy

ctopeaux.shop

isui.shop

huangyusij.top

tsgfa.lol

bcjpp.top

ccess1logsmexico.lat

6vhv7.vip

3i1mp.vip

isy.art

rterracaudill.today

377278d.app

izoc.xyz

guiwe.xyz

81rwp.vip

hi8t3b5a3.shop

omnerror.shop

hm6l1w9o5.shop

saondemandswag.net

sig.xyz

andbags-48525.bond

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3516
    • C:\Users\Admin\AppData\Local\Temp\271JaJbQjMLGbcc.exe
      "C:\Users\Admin\AppData\Local\Temp\271JaJbQjMLGbcc.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2168
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\271JaJbQjMLGbcc.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4012
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xQKiRiS.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3564
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xQKiRiS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA22B.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:1952
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3232
    • C:\Windows\SysWOW64\ipconfig.exe
      "C:\Windows\SysWOW64\ipconfig.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Gathers network information
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4848
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:656

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          f9349064c7c8f8467cc12d78a462e5f9

          SHA1

          5e1d27fc64751cd8c0e9448ee47741da588b3484

          SHA256

          883481fe331cb89fb6061e76b43acd4dd638c16f499b10088b261036c6d0547b

          SHA512

          3229668491b5e4068e743b31f2896b30b1842faf96aff09fad01b08771c2f11eb8d8f02a3b76e31f0d6ad650c2894c5ac1822204e132c03d9c2b8df6ca4cd7cf

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          21KB

          MD5

          7e75dde1d60e370aade884037e36e8fe

          SHA1

          d319a029a9c25d46853d718dbcb396e9f1b635b1

          SHA256

          3e2eeccff0686ac0793359c0caf74fdebe868c8dd5f211201e16e97b5d5b52b9

          SHA512

          6fa0dbf67edeef04021f69c7b27c5567f380d010a7c451d25e7ac86becc9c1f2d4dc12f5ff09e48f4c4bcf76dff93749162f0e640025664d41add005009cacbc

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jhcdnhra.jwx.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\tmpA22B.tmp

          Filesize

          1KB

          MD5

          e74ef35146fac1f7010fdd45f9f2b2ce

          SHA1

          d3ddb70fd316827b156edde48054a0c982c75abd

          SHA256

          567d7d0c91134ee7c6c482379d3c150e5d0dee887b24767aed5768f2ae035c9a

          SHA512

          f1d0a7ae031ecddfa63c83818ed3a90e635e6423ddb3725928e5414dd478e1b6f2fdebf319a99b1830c6b6c6427f8c1726553caab58ec0112d044caae4f111a2

        • memory/2168-4-0x00000000051E0000-0x00000000051EA000-memory.dmp

          Filesize

          40KB

        • memory/2168-5-0x0000000005310000-0x00000000053AC000-memory.dmp

          Filesize

          624KB

        • memory/2168-6-0x00000000053B0000-0x00000000053C0000-memory.dmp

          Filesize

          64KB

        • memory/2168-7-0x0000000005410000-0x0000000005420000-memory.dmp

          Filesize

          64KB

        • memory/2168-8-0x0000000008810000-0x0000000008888000-memory.dmp

          Filesize

          480KB

        • memory/2168-3-0x0000000005410000-0x0000000005420000-memory.dmp

          Filesize

          64KB

        • memory/2168-0-0x00000000006B0000-0x000000000075A000-memory.dmp

          Filesize

          680KB

        • memory/2168-2-0x0000000005120000-0x00000000051B2000-memory.dmp

          Filesize

          584KB

        • memory/2168-1-0x0000000005810000-0x0000000005DB6000-memory.dmp

          Filesize

          5.6MB

        • memory/3232-76-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/3232-17-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/3516-80-0x0000000009B10000-0x0000000009C36000-memory.dmp

          Filesize

          1.1MB

        • memory/3564-65-0x0000000007210000-0x000000000722E000-memory.dmp

          Filesize

          120KB

        • memory/3564-70-0x00000000075E0000-0x0000000007676000-memory.dmp

          Filesize

          600KB

        • memory/3564-20-0x00000000059E0000-0x0000000005A46000-memory.dmp

          Filesize

          408KB

        • memory/3564-19-0x0000000005880000-0x00000000058E6000-memory.dmp

          Filesize

          408KB

        • memory/3564-23-0x0000000005A50000-0x0000000005DA7000-memory.dmp

          Filesize

          3.3MB

        • memory/3564-13-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

          Filesize

          64KB

        • memory/3564-43-0x00000000060B0000-0x00000000060FC000-memory.dmp

          Filesize

          304KB

        • memory/3564-42-0x0000000006020000-0x000000000603E000-memory.dmp

          Filesize

          120KB

        • memory/3564-12-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

          Filesize

          64KB

        • memory/3564-18-0x0000000004FE0000-0x0000000005002000-memory.dmp

          Filesize

          136KB

        • memory/3564-55-0x0000000073CF0000-0x0000000073D3C000-memory.dmp

          Filesize

          304KB

        • memory/3564-67-0x00000000079C0000-0x000000000803A000-memory.dmp

          Filesize

          6.5MB

        • memory/4012-66-0x0000000007150000-0x00000000071F3000-memory.dmp

          Filesize

          652KB

        • memory/4012-14-0x0000000002690000-0x00000000026A0000-memory.dmp

          Filesize

          64KB

        • memory/4012-68-0x00000000072A0000-0x00000000072BA000-memory.dmp

          Filesize

          104KB

        • memory/4012-69-0x0000000007300000-0x000000000730A000-memory.dmp

          Filesize

          40KB

        • memory/4012-45-0x0000000073CF0000-0x0000000073D3C000-memory.dmp

          Filesize

          304KB

        • memory/4012-44-0x0000000006F10000-0x0000000006F42000-memory.dmp

          Filesize

          200KB

        • memory/4012-15-0x0000000005180000-0x000000000584A000-memory.dmp

          Filesize

          6.8MB

        • memory/4012-10-0x00000000025A0000-0x00000000025D6000-memory.dmp

          Filesize

          216KB

        • memory/4012-11-0x0000000002690000-0x00000000026A0000-memory.dmp

          Filesize

          64KB

        • memory/4848-77-0x0000000000460000-0x000000000046B000-memory.dmp

          Filesize

          44KB

        • memory/4848-78-0x0000000000DA0000-0x0000000000DCE000-memory.dmp

          Filesize

          184KB