Analysis
-
max time kernel
146s -
max time network
11s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-01-2021 08:26
Static task
static1
Behavioral task
behavioral1
Sample
PO2364#FD212002.exe
Resource
win7v20201028
General
-
Target
PO2364#FD212002.exe
-
Size
1.0MB
-
MD5
c3298c6e18313176495e56d22f45518c
-
SHA1
42647e355a166c15df4a9e32ea967aa4d67a6ba2
-
SHA256
178ab8c2af1c8e5a0782d79d4910efc280b6fcd1213d84cf5899d28ba232bfaa
-
SHA512
07698e60d8f0f5c0f6a2e9a06795a0cc300df6f82d7a63a39b46854eaf7eb363a76d1952e234c380ad9af1a60cf831144c9e24ac0def85f98b46d86ba3b5e578
Malware Config
Extracted
formbook
http://www.styrelseforum.com/p95n/
kimberlyrutledge.com
auctus.agency
johnemotions.com
guilt-brilliant.com
wxshangdian.com
theolivetreeonline.com
stellarfranchisebrands.com
every1no1.com
hoangthanhgroup.com
psm-gen.com
kingdomwow.com
digitalksr.com
karynpolitoforlg.com
youthdaycalgary.com
libertyhandymanservicesllc.com
breatheohio.com
allenleather.com
transformafter50.info
hnhsylsb.com
hmtradebd.com
besrhodislandhomes.com
zuwozo.com
southernhighlandsnails.com
kaaxg.com
bauer-cobolt.com
steelyourselfshop.net
linksoflondoncharmscheap.com
groundwork-pt.com
beautifulangelicskin.com
aduhelmfinancialsupport.com
xn--carpinteratarifa-hsb.com
thekingink.net
ocotegrill.com
gilbertdodge.com
insuranceinquirer.com
withagentcy.com
deeparchivesvpn.com
blamekd.com
acsdealta.xyz
dsxcj.com
kimonoshihan.com
bosquefamily.com
5587sk.com
integrative.life
unitedjournal.info
lynxdeck.com
onlyfanyou.com
aminomedicalscience.com
rachenstern-technik.com
thejewelrybox.net
stopcolleges.com
thesaltlifestyle.com
tappesupportservices.com
andrewgreenhomes.com
meidiansc.com
gobalexporter.com
rvpji571m.xyz
alwekalaaladabeya.com
scientificimaginetics.com
skaizenpharma.com
balloonpost.club
thefunnythingabout.com
premium-vitality.com
businesscalmcoaching.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1664-8-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1664-9-0x000000000041EDF0-mapping.dmp formbook behavioral1/memory/368-19-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1424 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
PO2364#FD212002.exePO2364#FD212002.exechkdsk.exedescription pid process target process PID 1832 set thread context of 1664 1832 PO2364#FD212002.exe PO2364#FD212002.exe PID 1664 set thread context of 1244 1664 PO2364#FD212002.exe Explorer.EXE PID 1664 set thread context of 1244 1664 PO2364#FD212002.exe Explorer.EXE PID 368 set thread context of 1244 368 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
PO2364#FD212002.exePO2364#FD212002.exechkdsk.exepid process 1832 PO2364#FD212002.exe 1832 PO2364#FD212002.exe 1664 PO2364#FD212002.exe 1664 PO2364#FD212002.exe 1664 PO2364#FD212002.exe 368 chkdsk.exe 368 chkdsk.exe 368 chkdsk.exe 368 chkdsk.exe 368 chkdsk.exe 368 chkdsk.exe 368 chkdsk.exe 368 chkdsk.exe 368 chkdsk.exe 368 chkdsk.exe 368 chkdsk.exe 368 chkdsk.exe 368 chkdsk.exe 368 chkdsk.exe 368 chkdsk.exe 368 chkdsk.exe 368 chkdsk.exe 368 chkdsk.exe 368 chkdsk.exe 368 chkdsk.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
PO2364#FD212002.exechkdsk.exepid process 1664 PO2364#FD212002.exe 1664 PO2364#FD212002.exe 1664 PO2364#FD212002.exe 1664 PO2364#FD212002.exe 368 chkdsk.exe 368 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PO2364#FD212002.exePO2364#FD212002.exechkdsk.exedescription pid process Token: SeDebugPrivilege 1832 PO2364#FD212002.exe Token: SeDebugPrivilege 1664 PO2364#FD212002.exe Token: SeDebugPrivilege 368 chkdsk.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
PO2364#FD212002.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1832 wrote to memory of 308 1832 PO2364#FD212002.exe PO2364#FD212002.exe PID 1832 wrote to memory of 308 1832 PO2364#FD212002.exe PO2364#FD212002.exe PID 1832 wrote to memory of 308 1832 PO2364#FD212002.exe PO2364#FD212002.exe PID 1832 wrote to memory of 308 1832 PO2364#FD212002.exe PO2364#FD212002.exe PID 1832 wrote to memory of 1664 1832 PO2364#FD212002.exe PO2364#FD212002.exe PID 1832 wrote to memory of 1664 1832 PO2364#FD212002.exe PO2364#FD212002.exe PID 1832 wrote to memory of 1664 1832 PO2364#FD212002.exe PO2364#FD212002.exe PID 1832 wrote to memory of 1664 1832 PO2364#FD212002.exe PO2364#FD212002.exe PID 1832 wrote to memory of 1664 1832 PO2364#FD212002.exe PO2364#FD212002.exe PID 1832 wrote to memory of 1664 1832 PO2364#FD212002.exe PO2364#FD212002.exe PID 1832 wrote to memory of 1664 1832 PO2364#FD212002.exe PO2364#FD212002.exe PID 1244 wrote to memory of 368 1244 Explorer.EXE chkdsk.exe PID 1244 wrote to memory of 368 1244 Explorer.EXE chkdsk.exe PID 1244 wrote to memory of 368 1244 Explorer.EXE chkdsk.exe PID 1244 wrote to memory of 368 1244 Explorer.EXE chkdsk.exe PID 368 wrote to memory of 1424 368 chkdsk.exe cmd.exe PID 368 wrote to memory of 1424 368 chkdsk.exe cmd.exe PID 368 wrote to memory of 1424 368 chkdsk.exe cmd.exe PID 368 wrote to memory of 1424 368 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO2364#FD212002.exe"C:\Users\Admin\AppData\Local\Temp\PO2364#FD212002.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO2364#FD212002.exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\PO2364#FD212002.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO2364#FD212002.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/368-21-0x0000000001FC0000-0x0000000002053000-memory.dmpFilesize
588KB
-
memory/368-18-0x0000000000B10000-0x0000000000B17000-memory.dmpFilesize
28KB
-
memory/368-20-0x00000000020B0000-0x00000000023B3000-memory.dmpFilesize
3.0MB
-
memory/368-19-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/368-16-0x0000000000000000-mapping.dmp
-
memory/1244-13-0x0000000006A80000-0x0000000006BCB000-memory.dmpFilesize
1.3MB
-
memory/1244-15-0x0000000006BD0000-0x0000000006D3D000-memory.dmpFilesize
1.4MB
-
memory/1424-17-0x0000000000000000-mapping.dmp
-
memory/1664-11-0x0000000000CE0000-0x0000000000FE3000-memory.dmpFilesize
3.0MB
-
memory/1664-14-0x00000000001D0000-0x00000000001E4000-memory.dmpFilesize
80KB
-
memory/1664-12-0x0000000000180000-0x0000000000194000-memory.dmpFilesize
80KB
-
memory/1664-9-0x000000000041EDF0-mapping.dmp
-
memory/1664-8-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1832-2-0x0000000073980000-0x000000007406E000-memory.dmpFilesize
6.9MB
-
memory/1832-7-0x0000000005350000-0x00000000053AC000-memory.dmpFilesize
368KB
-
memory/1832-6-0x0000000000460000-0x000000000046E000-memory.dmpFilesize
56KB
-
memory/1832-5-0x0000000004B70000-0x0000000004B71000-memory.dmpFilesize
4KB
-
memory/1832-3-0x0000000000BD0000-0x0000000000BD1000-memory.dmpFilesize
4KB