Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
10-05-2021 18:09
Static task
static1
Behavioral task
behavioral1
Sample
PL_106104.exe
Resource
win7v20210410
General
-
Target
PL_106104.exe
-
Size
503KB
-
MD5
77f1784fa00332d5623aba88277eb8c1
-
SHA1
248f8ad49c0d3ef5ddbfaa5a8721aa4dc08acdf5
-
SHA256
7515beb02e1280d143b4716f8919e34fadfc7c806e5a354dc3dcd1dd3318882c
-
SHA512
28e6d83ed4f71557ad2d6a8c026d4ce57082cc95517aae0f7243aafc3edd5f1db70778a290b62f433fb4a5d31d3d8c9c8f119d45f9e01b8a0d6343e7a3e077c7
Malware Config
Extracted
formbook
4.1
http://www.cornerstonerecruitmentasia.com/nke/
igroomed.com
teksoles.com
day7.today
workseap.com
arvinlapid.com
tigerk2.com
serenablackcreatives.com
ladyyougotballs.com
sahnakz.com
farmandranchexchange.com
sentinam.info
slapnmacs.com
healthygut365.com
maximepilorge.com
ishratsvalley.com
peridotalchemy.com
solevux.com
xn--vkc6b6baa6ac1jbwc6l.com
dailyruminant.com
loocalcryptos.com
elysiancards.com
felkenbaby.com
blueridgeholisticdental.com
kd-construction.com
ciberematinfantil.com
3556a.com
shoplovevibes.com
2811152641.com
ecoconsciousart.com
surgemngmt.com
babyjim.com
copydvdmac.com
magnoliamaycandleco.com
strongroadcoaching.com
monstercustomtees.com
portoola.com
sallah-kw.com
reciperoast.com
fosnocht.com
onlineturkiye.net
soqbtiup.icu
rockjanesville.com
jxsaigonanhvu.store
bluebelttvwd.com
shipwithmrpostman.com
local-find.com
pram-essex.com
milianidelacruz.com
powellmodels.com
chathansannidhi.com
uesanjoseobrero.com
glamrescue.com
lyzy168.com
shootingstarsilver.com
peacelove.one
zhf2883.com
daisy.photos
goocir.com
mitarbeiterbekleidung.net
allsecure4u.com
gel-sitzkissen.com
jonathanmontoyalive.com
scotiabankmortgages.com
theshawarmahut.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1692-65-0x000000000041EB70-mapping.dmp formbook behavioral1/memory/1692-64-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/332-73-0x0000000000070000-0x000000000009E000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 640 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PL_106104.exePL_106104.execscript.exedescription pid process target process PID 540 set thread context of 1692 540 PL_106104.exe PL_106104.exe PID 1692 set thread context of 1256 1692 PL_106104.exe Explorer.EXE PID 332 set thread context of 1256 332 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
PL_106104.exePL_106104.execscript.exepid process 540 PL_106104.exe 540 PL_106104.exe 540 PL_106104.exe 540 PL_106104.exe 540 PL_106104.exe 540 PL_106104.exe 540 PL_106104.exe 540 PL_106104.exe 540 PL_106104.exe 540 PL_106104.exe 1692 PL_106104.exe 1692 PL_106104.exe 332 cscript.exe 332 cscript.exe 332 cscript.exe 332 cscript.exe 332 cscript.exe 332 cscript.exe 332 cscript.exe 332 cscript.exe 332 cscript.exe 332 cscript.exe 332 cscript.exe 332 cscript.exe 332 cscript.exe 332 cscript.exe 332 cscript.exe 332 cscript.exe 332 cscript.exe 332 cscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PL_106104.execscript.exepid process 1692 PL_106104.exe 1692 PL_106104.exe 1692 PL_106104.exe 332 cscript.exe 332 cscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PL_106104.exePL_106104.execscript.exedescription pid process Token: SeDebugPrivilege 540 PL_106104.exe Token: SeDebugPrivilege 1692 PL_106104.exe Token: SeDebugPrivilege 332 cscript.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
PL_106104.exeExplorer.EXEcscript.exedescription pid process target process PID 540 wrote to memory of 1368 540 PL_106104.exe PL_106104.exe PID 540 wrote to memory of 1368 540 PL_106104.exe PL_106104.exe PID 540 wrote to memory of 1368 540 PL_106104.exe PL_106104.exe PID 540 wrote to memory of 1368 540 PL_106104.exe PL_106104.exe PID 540 wrote to memory of 1548 540 PL_106104.exe PL_106104.exe PID 540 wrote to memory of 1548 540 PL_106104.exe PL_106104.exe PID 540 wrote to memory of 1548 540 PL_106104.exe PL_106104.exe PID 540 wrote to memory of 1548 540 PL_106104.exe PL_106104.exe PID 540 wrote to memory of 1692 540 PL_106104.exe PL_106104.exe PID 540 wrote to memory of 1692 540 PL_106104.exe PL_106104.exe PID 540 wrote to memory of 1692 540 PL_106104.exe PL_106104.exe PID 540 wrote to memory of 1692 540 PL_106104.exe PL_106104.exe PID 540 wrote to memory of 1692 540 PL_106104.exe PL_106104.exe PID 540 wrote to memory of 1692 540 PL_106104.exe PL_106104.exe PID 540 wrote to memory of 1692 540 PL_106104.exe PL_106104.exe PID 1256 wrote to memory of 332 1256 Explorer.EXE cscript.exe PID 1256 wrote to memory of 332 1256 Explorer.EXE cscript.exe PID 1256 wrote to memory of 332 1256 Explorer.EXE cscript.exe PID 1256 wrote to memory of 332 1256 Explorer.EXE cscript.exe PID 332 wrote to memory of 640 332 cscript.exe cmd.exe PID 332 wrote to memory of 640 332 cscript.exe cmd.exe PID 332 wrote to memory of 640 332 cscript.exe cmd.exe PID 332 wrote to memory of 640 332 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\PL_106104.exe"C:\Users\Admin\AppData\Local\Temp\PL_106104.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\PL_106104.exeC:\Users\Admin\AppData\Local\Temp\PL_106104.exe3⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\PL_106104.exeC:\Users\Admin\AppData\Local\Temp\PL_106104.exe3⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\PL_106104.exeC:\Users\Admin\AppData\Local\Temp\PL_106104.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1692 -
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PL_106104.exe"3⤵
- Deletes itself
PID:640
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/332-75-0x0000000000560000-0x00000000005F3000-memory.dmpFilesize
588KB
-
memory/332-74-0x00000000022D0000-0x00000000025D3000-memory.dmpFilesize
3.0MB
-
memory/332-73-0x0000000000070000-0x000000000009E000-memory.dmpFilesize
184KB
-
memory/332-72-0x0000000000EA0000-0x0000000000EC2000-memory.dmpFilesize
136KB
-
memory/332-70-0x0000000000000000-mapping.dmp
-
memory/540-61-0x00000000047E0000-0x00000000047E1000-memory.dmpFilesize
4KB
-
memory/540-62-0x00000000046C0000-0x000000000474A000-memory.dmpFilesize
552KB
-
memory/540-63-0x0000000001EB0000-0x0000000001EE7000-memory.dmpFilesize
220KB
-
memory/540-59-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/640-71-0x0000000000000000-mapping.dmp
-
memory/1256-69-0x0000000006640000-0x000000000674B000-memory.dmpFilesize
1.0MB
-
memory/1256-76-0x0000000004070000-0x0000000004115000-memory.dmpFilesize
660KB
-
memory/1692-67-0x0000000000800000-0x0000000000B03000-memory.dmpFilesize
3.0MB
-
memory/1692-68-0x00000000001D0000-0x00000000001E4000-memory.dmpFilesize
80KB
-
memory/1692-64-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1692-65-0x000000000041EB70-mapping.dmp