Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
26-07-2021 22:48
Static task
static1
Behavioral task
behavioral1
Sample
PO91206762.exe
Resource
win7v20210408
General
-
Target
PO91206762.exe
-
Size
194KB
-
MD5
54c6e68d889239ef978e4221f8add60f
-
SHA1
500f8852aa4cf26eb57d544fa3017bbab75aafce
-
SHA256
71cb97b67ebcc50a0bef217b3ca9591cfa49f6b8c8d11ee9952c2cde0b7b6a51
-
SHA512
09d0bc694eababc0de157884383fff81c07b5c576bfcbfdf763b41b8a96a845b4fc29b04ccd0b82e70de085696f86afd79b94f2be210b545e0a91d0ffd793a7e
Malware Config
Extracted
formbook
4.1
http://www.yjhlgg.com/grve/
jrvinganimalexterminator.com
smallsyalls.com
po1c3.com
mencg.com
aussieenjoyment.today
espace22.com
aanmelding-desk.info
gallopshoes.com
nftsexy.com
ricosdulcesmexicanos.com
riseswift.com
thechicthirty.com
matdcg.com
alternet.today
creativehuesdesigns.com
rjkcrafts.com
lowdosemortgage.com
adoptahamster.com
wellness-sense.com
jacardcapital.com
pastiindonesia.com
lindsaynathan2021.com
brisbanemagicians.com
tvglanz.com
388384.com
mitgrim.com
endonelatrading.com
political.singles
ganjegirls.com
democratscancelled.com
ytzhubao.com
roiskylands.com
zamlgroup.com
winstonsalemathleticclub.com
62qtz2.com
caddyys.com
ecorarte.com
coonier.com
cbgmanhattan-hub.com
givanon.com
tioniis11.com
variceselite.com
tasaciona.com
hiphopeconomicdevelopment.com
citrixfile.com
piebuilder.com
drmetalpublishing.com
themesthatyoulike.com
vinhomes-phamhung.info
ardecentro.com
gameshowsatwork.com
go-rillathebrand.com
virtualppo.com
nogodbeforeme.net
fabrezeairpurifiers.com
roorisor.com
elaraberentcar.com
rugpat.com
renewalbyheather.com
innocox.com
ztsj10086.com
channelarmor.info
thecarbonbox.store
edicionesvita.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1240-116-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/1240-118-0x0000000000570000-0x00000000006BA000-memory.dmp formbook behavioral2/memory/3528-124-0x00000000001F0000-0x000000000021E000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
PO91206762.exePO91206762.exewscript.exedescription pid process target process PID 3908 set thread context of 1240 3908 PO91206762.exe PO91206762.exe PID 1240 set thread context of 2996 1240 PO91206762.exe Explorer.EXE PID 1240 set thread context of 2996 1240 PO91206762.exe Explorer.EXE PID 3528 set thread context of 2996 3528 wscript.exe Explorer.EXE -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
PO91206762.exewscript.exepid process 1240 PO91206762.exe 1240 PO91206762.exe 1240 PO91206762.exe 1240 PO91206762.exe 1240 PO91206762.exe 1240 PO91206762.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe 3528 wscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2996 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
PO91206762.exePO91206762.exewscript.exepid process 3908 PO91206762.exe 1240 PO91206762.exe 1240 PO91206762.exe 1240 PO91206762.exe 1240 PO91206762.exe 3528 wscript.exe 3528 wscript.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
Processes:
PO91206762.exeExplorer.EXEwscript.exedescription pid process Token: SeDebugPrivilege 1240 PO91206762.exe Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeDebugPrivilege 3528 wscript.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2996 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
PO91206762.exeExplorer.EXEwscript.exedescription pid process target process PID 3908 wrote to memory of 1240 3908 PO91206762.exe PO91206762.exe PID 3908 wrote to memory of 1240 3908 PO91206762.exe PO91206762.exe PID 3908 wrote to memory of 1240 3908 PO91206762.exe PO91206762.exe PID 3908 wrote to memory of 1240 3908 PO91206762.exe PO91206762.exe PID 2996 wrote to memory of 3528 2996 Explorer.EXE wscript.exe PID 2996 wrote to memory of 3528 2996 Explorer.EXE wscript.exe PID 2996 wrote to memory of 3528 2996 Explorer.EXE wscript.exe PID 3528 wrote to memory of 3292 3528 wscript.exe cmd.exe PID 3528 wrote to memory of 3292 3528 wscript.exe cmd.exe PID 3528 wrote to memory of 3292 3528 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO91206762.exe"C:\Users\Admin\AppData\Local\Temp\PO91206762.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO91206762.exe"C:\Users\Admin\AppData\Local\Temp\PO91206762.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO91206762.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1240-114-0x000000000041EAF0-mapping.dmp
-
memory/1240-120-0x0000000002750000-0x0000000002764000-memory.dmpFilesize
80KB
-
memory/1240-116-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1240-117-0x0000000000A20000-0x0000000000D40000-memory.dmpFilesize
3.1MB
-
memory/1240-118-0x0000000000570000-0x00000000006BA000-memory.dmpFilesize
1.3MB
-
memory/2996-121-0x0000000004D10000-0x0000000004EB2000-memory.dmpFilesize
1.6MB
-
memory/2996-119-0x0000000002740000-0x00000000027F1000-memory.dmpFilesize
708KB
-
memory/2996-128-0x0000000004EC0000-0x0000000004F9C000-memory.dmpFilesize
880KB
-
memory/3292-126-0x0000000000000000-mapping.dmp
-
memory/3528-122-0x0000000000000000-mapping.dmp
-
memory/3528-123-0x0000000000300000-0x0000000000327000-memory.dmpFilesize
156KB
-
memory/3528-124-0x00000000001F0000-0x000000000021E000-memory.dmpFilesize
184KB
-
memory/3528-125-0x00000000045A0000-0x00000000048C0000-memory.dmpFilesize
3.1MB
-
memory/3528-127-0x0000000004370000-0x0000000004403000-memory.dmpFilesize
588KB
-
memory/3908-115-0x0000000000410000-0x000000000055A000-memory.dmpFilesize
1.3MB