Resubmissions

01/07/2025, 06:41

250701-hf9akasp12 10

01/07/2025, 06:22

250701-g43bgsdl5v 10

10/06/2025, 16:01

250610-tgnk2azqw5 10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250619-en
  • resource tags

    arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    01/07/2025, 06:41

General

  • Target

    271JaJbQjMLGbcc.exe

  • Size

    667KB

  • MD5

    17043ee76cd32800262fa06cfc3ac690

  • SHA1

    0f11ac97736fb42fd30d6c4abf1da4549e8f0101

  • SHA256

    6781be8abda50b0cc7d27b9466f7b39572f978cf16151092554e7b4557f0ac06

  • SHA512

    0ec8c106a4d55deee49da8a9696f36cbcfb55872d0d2e982416be34ab7e81faa2b2c12f86575e195093d24b78978691c4c242fe7bdf1ab728a68bf92b57d31d7

  • SSDEEP

    12288:disP8yffxahqfDGZW17k0+YHPEd8MwP0WAra3OjuBGy1kuOEXuVjCqfkR:n8yffxQqbuWZk9DNWAr6u+3OCq6

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hi26

Decoy

ctopeaux.shop

isui.shop

huangyusij.top

tsgfa.lol

bcjpp.top

ccess1logsmexico.lat

6vhv7.vip

3i1mp.vip

isy.art

rterracaudill.today

377278d.app

izoc.xyz

guiwe.xyz

81rwp.vip

hi8t3b5a3.shop

omnerror.shop

hm6l1w9o5.shop

saondemandswag.net

sig.xyz

andbags-48525.bond

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 61 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3308
    • C:\Users\Admin\AppData\Local\Temp\271JaJbQjMLGbcc.exe
      "C:\Users\Admin\AppData\Local\Temp\271JaJbQjMLGbcc.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5260
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\271JaJbQjMLGbcc.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1012
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xQKiRiS.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5012
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xQKiRiS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8D1D.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3944
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2128
    • C:\Windows\SysWOW64\cmmon32.exe
      "C:\Windows\SysWOW64\cmmon32.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3140
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2188

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          d0c46cad6c0778401e21910bd6b56b70

          SHA1

          7be418951ea96326aca445b8dfe449b2bfa0dca6

          SHA256

          9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

          SHA512

          057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          18KB

          MD5

          5153b5e4354b9ecd435ac7e8c94a4f4b

          SHA1

          cc3bc40bb084a80e8dfbacb4d77dc470d0e8cf34

          SHA256

          d22a350d12e961f438cd57d1084646e7349921789f01251e0de5a1d786159f5d

          SHA512

          a985b8fc6041d8f3dac59405c2f24e66132c29c206067ef6e6719e9b725ebc6dc1ab05bc686a8d5f13bfd020818027c17f3c69f65b4766f94de0d019a8f29156

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xm4tzvqp.cpe.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\tmp8D1D.tmp

          Filesize

          1KB

          MD5

          965c6297e30b91a9a300c7e7c5c49267

          SHA1

          dd11f956de931ce179f6be125b65434bc7f05e59

          SHA256

          3230714493351b7cc2b12453f4ca9a2c945997fcdb0b8deda970a91662cacf9d

          SHA512

          8989c5002e96bec5bb5bd0d414681280cbb0603bb0882576b056bd2d318f72a6a78db5a3d5d7b4533f22f87d0d51396d3b82103b4681455812e271eb5bc4254f

        • memory/1012-15-0x00000000050B0000-0x00000000050C0000-memory.dmp

          Filesize

          64KB

        • memory/1012-69-0x0000000007970000-0x0000000007A06000-memory.dmp

          Filesize

          600KB

        • memory/1012-56-0x0000000007390000-0x0000000007434000-memory.dmp

          Filesize

          656KB

        • memory/1012-55-0x0000000007330000-0x000000000734E000-memory.dmp

          Filesize

          120KB

        • memory/1012-45-0x0000000007350000-0x0000000007384000-memory.dmp

          Filesize

          208KB

        • memory/1012-13-0x0000000002B90000-0x0000000002BC6000-memory.dmp

          Filesize

          216KB

        • memory/1012-71-0x0000000007920000-0x000000000792E000-memory.dmp

          Filesize

          56KB

        • memory/1012-14-0x00000000050B0000-0x00000000050C0000-memory.dmp

          Filesize

          64KB

        • memory/1012-16-0x00000000056F0000-0x0000000005D1A000-memory.dmp

          Filesize

          6.2MB

        • memory/1012-46-0x00000000755E0000-0x000000007562C000-memory.dmp

          Filesize

          304KB

        • memory/1012-68-0x0000000007760000-0x000000000776A000-memory.dmp

          Filesize

          40KB

        • memory/1012-66-0x0000000007D20000-0x000000000839A000-memory.dmp

          Filesize

          6.5MB

        • memory/1012-67-0x00000000076E0000-0x00000000076FA000-memory.dmp

          Filesize

          104KB

        • memory/2128-40-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/3140-80-0x0000000000E10000-0x0000000000E1C000-memory.dmp

          Filesize

          48KB

        • memory/3140-81-0x0000000000D70000-0x0000000000D9E000-memory.dmp

          Filesize

          184KB

        • memory/3308-83-0x0000000006150000-0x0000000006238000-memory.dmp

          Filesize

          928KB

        • memory/5012-18-0x00000000047D0000-0x00000000047E0000-memory.dmp

          Filesize

          64KB

        • memory/5012-74-0x0000000007390000-0x0000000007398000-memory.dmp

          Filesize

          32KB

        • memory/5012-73-0x00000000073A0000-0x00000000073BA000-memory.dmp

          Filesize

          104KB

        • memory/5012-44-0x0000000005D30000-0x0000000005D7C000-memory.dmp

          Filesize

          304KB

        • memory/5012-31-0x0000000005840000-0x0000000005B97000-memory.dmp

          Filesize

          3.3MB

        • memory/5012-21-0x00000000057D0000-0x0000000005836000-memory.dmp

          Filesize

          408KB

        • memory/5012-72-0x00000000072A0000-0x00000000072B5000-memory.dmp

          Filesize

          84KB

        • memory/5012-57-0x00000000755E0000-0x000000007562C000-memory.dmp

          Filesize

          304KB

        • memory/5012-20-0x00000000056B0000-0x0000000005716000-memory.dmp

          Filesize

          408KB

        • memory/5012-19-0x0000000004D50000-0x0000000004D72000-memory.dmp

          Filesize

          136KB

        • memory/5012-43-0x0000000005D10000-0x0000000005D2E000-memory.dmp

          Filesize

          120KB

        • memory/5012-17-0x00000000047D0000-0x00000000047E0000-memory.dmp

          Filesize

          64KB

        • memory/5012-70-0x0000000007260000-0x0000000007271000-memory.dmp

          Filesize

          68KB

        • memory/5260-0-0x00000000005B0000-0x000000000065A000-memory.dmp

          Filesize

          680KB

        • memory/5260-4-0x0000000004FC0000-0x0000000004FCA000-memory.dmp

          Filesize

          40KB

        • memory/5260-3-0x00000000052D0000-0x00000000052E0000-memory.dmp

          Filesize

          64KB

        • memory/5260-5-0x00000000052E0000-0x000000000537C000-memory.dmp

          Filesize

          624KB

        • memory/5260-2-0x0000000005040000-0x00000000050D2000-memory.dmp

          Filesize

          584KB

        • memory/5260-1-0x00000000055F0000-0x0000000005B96000-memory.dmp

          Filesize

          5.6MB

        • memory/5260-8-0x00000000062C0000-0x0000000006338000-memory.dmp

          Filesize

          480KB

        • memory/5260-7-0x00000000052D0000-0x00000000052E0000-memory.dmp

          Filesize

          64KB

        • memory/5260-6-0x0000000005270000-0x0000000005280000-memory.dmp

          Filesize

          64KB