Analysis
-
max time kernel
148s -
max time network
164s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
26-07-2021 11:38
Static task
static1
Behavioral task
behavioral1
Sample
PO LS632911DX.exe
Resource
win7v20210410
General
-
Target
PO LS632911DX.exe
-
Size
823KB
-
MD5
27816f5bbff9bb6d4cc2e1be225a435b
-
SHA1
fd1f06a502d374711697015cc897fdb28e402e16
-
SHA256
c2a7767b9323fd3630a56a3fb09a7884bd7dfb0f7146d5caafff472205e1ebdc
-
SHA512
4bee32d2df168aeba05ceb9e511f84d4a7aa5d08c96047cf6ca0f3241e6d4fb8e4cf5e1cee3e6389e9ceaca400769032bd85b5f323975fdbed4963a3e5a7a217
Malware Config
Extracted
formbook
4.1
http://www.survivai.com/bsdd/
533dh.com
galerisikayet.xyz
tipsyalligator.com
crystalwellnessstudio.com
moovaap.com
lelfie.network
speedy-trips.com
prospectsolucoes.com
24x7customersservice.com
szbinsen.com
shikhardeals.com
totaldenta.com
ayksjx.com
avxrja.online
24kyule888.com
ufaw.net
spinozone.com
castvoicesmsreg.com
lajollawoodworks.com
renetyson.com
stephanieodennewsletter.com
tuben8.com
thescriptshack.com
macooperativeinc.com
franklinmachado.com
breezeescape.com
conv2app.com
kreditkarten-profi.com
czscjx.com
pvj2019.com
boosagroup.com
inesperienced.com
leschenaultpottery.com
sitvsfit.net
dwsykj.com
touchsquad.com
healthythomas.com
lphomeinspections.com
officialbondandunion.com
snowgreerfamilymemories.com
superheroesindisguise.com
topimportant.com
drillinginsider.com
esflog.net
baliyogacruise.net
sdys999.com
rugpat.com
solarpollo.com
kindrehearts.com
marijuana-medicine.com
thefinal7.com
guardiadeorixa.com
kayeducates.com
francorp.business
wegatherwegrow.com
quientequitalobailado.net
ghostridercreative.com
rachaeveal.com
sourcesysstems.com
xiuli100.com
xmjer.com
support-center-login.network
conversoronlline.com
misinformationnationmovie.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/664-68-0x000000000041EB30-mapping.dmp formbook behavioral1/memory/664-69-0x0000000000080000-0x00000000000AE000-memory.dmp formbook behavioral1/memory/1852-76-0x0000000000090000-0x00000000000BE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 384 cmd.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/1820-63-0x0000000000B70000-0x0000000000B91000-memory.dmp agile_net -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO LS632911DX.exePO LS632911DX.execmstp.exedescription pid process target process PID 1820 set thread context of 664 1820 PO LS632911DX.exe PO LS632911DX.exe PID 664 set thread context of 1228 664 PO LS632911DX.exe Explorer.EXE PID 1852 set thread context of 1228 1852 cmstp.exe Explorer.EXE -
Processes:
PO LS632911DX.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C PO LS632911DX.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 PO LS632911DX.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 PO LS632911DX.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
PO LS632911DX.exePO LS632911DX.execmstp.exepid process 1820 PO LS632911DX.exe 1820 PO LS632911DX.exe 664 PO LS632911DX.exe 664 PO LS632911DX.exe 1852 cmstp.exe 1852 cmstp.exe 1852 cmstp.exe 1852 cmstp.exe 1852 cmstp.exe 1852 cmstp.exe 1852 cmstp.exe 1852 cmstp.exe 1852 cmstp.exe 1852 cmstp.exe 1852 cmstp.exe 1852 cmstp.exe 1852 cmstp.exe 1852 cmstp.exe 1852 cmstp.exe 1852 cmstp.exe 1852 cmstp.exe 1852 cmstp.exe 1852 cmstp.exe 1852 cmstp.exe 1852 cmstp.exe 1852 cmstp.exe 1852 cmstp.exe 1852 cmstp.exe 1852 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PO LS632911DX.execmstp.exepid process 664 PO LS632911DX.exe 664 PO LS632911DX.exe 664 PO LS632911DX.exe 1852 cmstp.exe 1852 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PO LS632911DX.exePO LS632911DX.execmstp.exedescription pid process Token: SeDebugPrivilege 1820 PO LS632911DX.exe Token: SeDebugPrivilege 664 PO LS632911DX.exe Token: SeDebugPrivilege 1852 cmstp.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
PO LS632911DX.exeExplorer.EXEcmstp.exedescription pid process target process PID 1820 wrote to memory of 664 1820 PO LS632911DX.exe PO LS632911DX.exe PID 1820 wrote to memory of 664 1820 PO LS632911DX.exe PO LS632911DX.exe PID 1820 wrote to memory of 664 1820 PO LS632911DX.exe PO LS632911DX.exe PID 1820 wrote to memory of 664 1820 PO LS632911DX.exe PO LS632911DX.exe PID 1820 wrote to memory of 664 1820 PO LS632911DX.exe PO LS632911DX.exe PID 1820 wrote to memory of 664 1820 PO LS632911DX.exe PO LS632911DX.exe PID 1820 wrote to memory of 664 1820 PO LS632911DX.exe PO LS632911DX.exe PID 1228 wrote to memory of 1852 1228 Explorer.EXE cmstp.exe PID 1228 wrote to memory of 1852 1228 Explorer.EXE cmstp.exe PID 1228 wrote to memory of 1852 1228 Explorer.EXE cmstp.exe PID 1228 wrote to memory of 1852 1228 Explorer.EXE cmstp.exe PID 1228 wrote to memory of 1852 1228 Explorer.EXE cmstp.exe PID 1228 wrote to memory of 1852 1228 Explorer.EXE cmstp.exe PID 1228 wrote to memory of 1852 1228 Explorer.EXE cmstp.exe PID 1852 wrote to memory of 384 1852 cmstp.exe cmd.exe PID 1852 wrote to memory of 384 1852 cmstp.exe cmd.exe PID 1852 wrote to memory of 384 1852 cmstp.exe cmd.exe PID 1852 wrote to memory of 384 1852 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO LS632911DX.exe"C:\Users\Admin\AppData\Local\Temp\PO LS632911DX.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO LS632911DX.exe"C:\Users\Admin\AppData\Local\Temp\PO LS632911DX.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO LS632911DX.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/384-77-0x0000000000000000-mapping.dmp
-
memory/664-69-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/664-70-0x00000000009B0000-0x0000000000CB3000-memory.dmpFilesize
3.0MB
-
memory/664-71-0x0000000000170000-0x0000000000184000-memory.dmpFilesize
80KB
-
memory/664-68-0x000000000041EB30-mapping.dmp
-
memory/1228-80-0x0000000004E50000-0x0000000004F78000-memory.dmpFilesize
1.2MB
-
memory/1228-72-0x0000000004D00000-0x0000000004E50000-memory.dmpFilesize
1.3MB
-
memory/1820-65-0x0000000000EE0000-0x0000000000EEB000-memory.dmpFilesize
44KB
-
memory/1820-66-0x0000000000E90000-0x0000000000E91000-memory.dmpFilesize
4KB
-
memory/1820-59-0x0000000000EF0000-0x0000000000EF1000-memory.dmpFilesize
4KB
-
memory/1820-64-0x0000000000A81000-0x0000000000A82000-memory.dmpFilesize
4KB
-
memory/1820-63-0x0000000000B70000-0x0000000000B91000-memory.dmpFilesize
132KB
-
memory/1820-61-0x0000000000A80000-0x0000000000A81000-memory.dmpFilesize
4KB
-
memory/1852-73-0x0000000000000000-mapping.dmp
-
memory/1852-74-0x0000000075FE1000-0x0000000075FE3000-memory.dmpFilesize
8KB
-
memory/1852-75-0x0000000000C50000-0x0000000000C68000-memory.dmpFilesize
96KB
-
memory/1852-76-0x0000000000090000-0x00000000000BE000-memory.dmpFilesize
184KB
-
memory/1852-78-0x0000000002070000-0x0000000002373000-memory.dmpFilesize
3.0MB
-
memory/1852-79-0x00000000009C0000-0x0000000000A53000-memory.dmpFilesize
588KB