Analysis
-
max time kernel
145s -
max time network
179s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
26-07-2021 22:48
Static task
static1
Behavioral task
behavioral1
Sample
PO91206762.exe
Resource
win7v20210408
General
-
Target
PO91206762.exe
-
Size
194KB
-
MD5
54c6e68d889239ef978e4221f8add60f
-
SHA1
500f8852aa4cf26eb57d544fa3017bbab75aafce
-
SHA256
71cb97b67ebcc50a0bef217b3ca9591cfa49f6b8c8d11ee9952c2cde0b7b6a51
-
SHA512
09d0bc694eababc0de157884383fff81c07b5c576bfcbfdf763b41b8a96a845b4fc29b04ccd0b82e70de085696f86afd79b94f2be210b545e0a91d0ffd793a7e
Malware Config
Extracted
formbook
4.1
http://www.yjhlgg.com/grve/
jrvinganimalexterminator.com
smallsyalls.com
po1c3.com
mencg.com
aussieenjoyment.today
espace22.com
aanmelding-desk.info
gallopshoes.com
nftsexy.com
ricosdulcesmexicanos.com
riseswift.com
thechicthirty.com
matdcg.com
alternet.today
creativehuesdesigns.com
rjkcrafts.com
lowdosemortgage.com
adoptahamster.com
wellness-sense.com
jacardcapital.com
pastiindonesia.com
lindsaynathan2021.com
brisbanemagicians.com
tvglanz.com
388384.com
mitgrim.com
endonelatrading.com
political.singles
ganjegirls.com
democratscancelled.com
ytzhubao.com
roiskylands.com
zamlgroup.com
winstonsalemathleticclub.com
62qtz2.com
caddyys.com
ecorarte.com
coonier.com
cbgmanhattan-hub.com
givanon.com
tioniis11.com
variceselite.com
tasaciona.com
hiphopeconomicdevelopment.com
citrixfile.com
piebuilder.com
drmetalpublishing.com
themesthatyoulike.com
vinhomes-phamhung.info
ardecentro.com
gameshowsatwork.com
go-rillathebrand.com
virtualppo.com
nogodbeforeme.net
fabrezeairpurifiers.com
roorisor.com
elaraberentcar.com
rugpat.com
renewalbyheather.com
innocox.com
ztsj10086.com
channelarmor.info
thecarbonbox.store
edicionesvita.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1616-62-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1436-69-0x00000000000C0000-0x00000000000EE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1572 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO91206762.exePO91206762.exewininit.exedescription pid process target process PID 468 set thread context of 1616 468 PO91206762.exe PO91206762.exe PID 1616 set thread context of 1200 1616 PO91206762.exe Explorer.EXE PID 1436 set thread context of 1200 1436 wininit.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
PO91206762.exewininit.exepid process 1616 PO91206762.exe 1616 PO91206762.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe 1436 wininit.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
PO91206762.exePO91206762.exewininit.exepid process 468 PO91206762.exe 1616 PO91206762.exe 1616 PO91206762.exe 1616 PO91206762.exe 1436 wininit.exe 1436 wininit.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO91206762.exewininit.exedescription pid process Token: SeDebugPrivilege 1616 PO91206762.exe Token: SeDebugPrivilege 1436 wininit.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
PO91206762.exeExplorer.EXEwininit.exedescription pid process target process PID 468 wrote to memory of 1616 468 PO91206762.exe PO91206762.exe PID 468 wrote to memory of 1616 468 PO91206762.exe PO91206762.exe PID 468 wrote to memory of 1616 468 PO91206762.exe PO91206762.exe PID 468 wrote to memory of 1616 468 PO91206762.exe PO91206762.exe PID 468 wrote to memory of 1616 468 PO91206762.exe PO91206762.exe PID 1200 wrote to memory of 1436 1200 Explorer.EXE wininit.exe PID 1200 wrote to memory of 1436 1200 Explorer.EXE wininit.exe PID 1200 wrote to memory of 1436 1200 Explorer.EXE wininit.exe PID 1200 wrote to memory of 1436 1200 Explorer.EXE wininit.exe PID 1436 wrote to memory of 1572 1436 wininit.exe cmd.exe PID 1436 wrote to memory of 1572 1436 wininit.exe cmd.exe PID 1436 wrote to memory of 1572 1436 wininit.exe cmd.exe PID 1436 wrote to memory of 1572 1436 wininit.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO91206762.exe"C:\Users\Admin\AppData\Local\Temp\PO91206762.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO91206762.exe"C:\Users\Admin\AppData\Local\Temp\PO91206762.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO91206762.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/468-61-0x0000000000230000-0x0000000000232000-memory.dmpFilesize
8KB
-
memory/468-59-0x0000000075051000-0x0000000075053000-memory.dmpFilesize
8KB
-
memory/1200-72-0x0000000004ED0000-0x0000000004FB3000-memory.dmpFilesize
908KB
-
memory/1200-65-0x0000000004CF0000-0x0000000004DD3000-memory.dmpFilesize
908KB
-
memory/1436-68-0x0000000000370000-0x000000000038A000-memory.dmpFilesize
104KB
-
memory/1436-66-0x0000000000000000-mapping.dmp
-
memory/1436-69-0x00000000000C0000-0x00000000000EE000-memory.dmpFilesize
184KB
-
memory/1436-70-0x0000000001E80000-0x0000000002183000-memory.dmpFilesize
3.0MB
-
memory/1436-71-0x0000000000430000-0x00000000004C3000-memory.dmpFilesize
588KB
-
memory/1572-67-0x0000000000000000-mapping.dmp
-
memory/1616-64-0x00000000003C0000-0x00000000003D4000-memory.dmpFilesize
80KB
-
memory/1616-63-0x0000000000970000-0x0000000000C73000-memory.dmpFilesize
3.0MB
-
memory/1616-62-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1616-60-0x000000000041EAF0-mapping.dmp