Analysis
-
max time kernel
147s -
max time network
184s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-07-2021 04:25
Static task
static1
Behavioral task
behavioral1
Sample
excel.DLLW32.dll
Resource
win7v20210410
General
-
Target
excel.DLLW32.dll
-
Size
24KB
-
MD5
c79d67e385569c8e4f090f0dc188cfff
-
SHA1
68ee64c9f281aa0dd0479c8e89289b2af0bf72e8
-
SHA256
7a7a4887dcc86e8b6a576ae2acf805881586ee672be261a2a91a8d7a6e78c5bd
-
SHA512
4b4b906e5089816e7c7fb09c594e72bdf751ddd0cc2276b1a01a4915233983814a2463ac7648300362505128c5198882248f05fb5a3483b4702daedbed92b918
Malware Config
Extracted
formbook
4.1
http://www.happylittlexplorers.com/glgd/
cdcbullies.com
qidajixie.com
bgimlv.com
sunflowerhybrid.com
kemal.cloud
canadadirect.net
mickey2nd.com
fastjobssearcher.com
tiny-tobi.com
inmedixequus.com
coollifeideas.com
triadelectronicsupply.com
lambyo.com
zxyoo.com
spokanemusicmag.com
sortporn.com
deadroomnyc.com
313mail.com
hexiptv.net
stanbiccargo-express.com
hggt.net
theheilene.com
imbibetheculture.com
magnifiscentsbydarien.com
mcfarlanenterprises.com
chapsgrilletogo.com
startfortoday.com
sincamareros.com
bleacheater.com
elnurtic.com
finefoodandcooking.com
1931jones.com
buybetadeal.com
yourfavoredhairextensions.com
piaenglish.com
blockifysystems.com
atlerz.com
southernedgewaterdesigns.com
jamsole.net
wedyounow.com
gasesysoldaduras.com
st894.com
raquelbeckford.com
momdoduk.com
homeworkoutnow.com
maskintelligence.com
dahiyaa.com
dcsublease.com
fearlesslymiddleaged.com
thelittlereclaimedworkshop.com
johanarivero.com
differentlypun.life
frederickseyecare.com
sabortradicion.com
odptqfqxl.icu
socalseamlessgutters.com
rbhealthy.com
danielsdonuteria.com
cotswoldvehiclehire.com
ujenzihypermarket.com
farendofthebench.com
uniquelypotted.com
moddy.pro
soilhelp.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/792-77-0x000000000041EBD0-mapping.dmp formbook behavioral1/memory/792-79-0x0000000000080000-0x00000000000AE000-memory.dmp formbook behavioral1/memory/988-86-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 6 1984 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
hfgjfhfdgre546.exehfgjfhfdgre546.exepid process 624 hfgjfhfdgre546.exe 792 hfgjfhfdgre546.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exehfgjfhfdgre546.exepid process 1984 rundll32.exe 624 hfgjfhfdgre546.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/624-71-0x0000000004D40000-0x0000000004D61000-memory.dmp agile_net -
Suspicious use of SetThreadContext 3 IoCs
Processes:
hfgjfhfdgre546.exehfgjfhfdgre546.execontrol.exedescription pid process target process PID 624 set thread context of 792 624 hfgjfhfdgre546.exe hfgjfhfdgre546.exe PID 792 set thread context of 1200 792 hfgjfhfdgre546.exe Explorer.EXE PID 988 set thread context of 1200 988 control.exe Explorer.EXE -
Processes:
hfgjfhfdgre546.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C hfgjfhfdgre546.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 hfgjfhfdgre546.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 hfgjfhfdgre546.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
hfgjfhfdgre546.exehfgjfhfdgre546.execontrol.exepid process 624 hfgjfhfdgre546.exe 624 hfgjfhfdgre546.exe 792 hfgjfhfdgre546.exe 792 hfgjfhfdgre546.exe 988 control.exe 988 control.exe 988 control.exe 988 control.exe 988 control.exe 988 control.exe 988 control.exe 988 control.exe 988 control.exe 988 control.exe 988 control.exe 988 control.exe 988 control.exe 988 control.exe 988 control.exe 988 control.exe 988 control.exe 988 control.exe 988 control.exe 988 control.exe 988 control.exe 988 control.exe 988 control.exe 988 control.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
hfgjfhfdgre546.execontrol.exepid process 792 hfgjfhfdgre546.exe 792 hfgjfhfdgre546.exe 792 hfgjfhfdgre546.exe 988 control.exe 988 control.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
hfgjfhfdgre546.exehfgjfhfdgre546.execontrol.exedescription pid process Token: SeDebugPrivilege 624 hfgjfhfdgre546.exe Token: SeDebugPrivilege 792 hfgjfhfdgre546.exe Token: SeDebugPrivilege 988 control.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
rundll32.exerundll32.exehfgjfhfdgre546.exeExplorer.EXEcontrol.exedescription pid process target process PID 1636 wrote to memory of 1984 1636 rundll32.exe rundll32.exe PID 1636 wrote to memory of 1984 1636 rundll32.exe rundll32.exe PID 1636 wrote to memory of 1984 1636 rundll32.exe rundll32.exe PID 1636 wrote to memory of 1984 1636 rundll32.exe rundll32.exe PID 1636 wrote to memory of 1984 1636 rundll32.exe rundll32.exe PID 1636 wrote to memory of 1984 1636 rundll32.exe rundll32.exe PID 1636 wrote to memory of 1984 1636 rundll32.exe rundll32.exe PID 1984 wrote to memory of 624 1984 rundll32.exe hfgjfhfdgre546.exe PID 1984 wrote to memory of 624 1984 rundll32.exe hfgjfhfdgre546.exe PID 1984 wrote to memory of 624 1984 rundll32.exe hfgjfhfdgre546.exe PID 1984 wrote to memory of 624 1984 rundll32.exe hfgjfhfdgre546.exe PID 624 wrote to memory of 792 624 hfgjfhfdgre546.exe hfgjfhfdgre546.exe PID 624 wrote to memory of 792 624 hfgjfhfdgre546.exe hfgjfhfdgre546.exe PID 624 wrote to memory of 792 624 hfgjfhfdgre546.exe hfgjfhfdgre546.exe PID 624 wrote to memory of 792 624 hfgjfhfdgre546.exe hfgjfhfdgre546.exe PID 624 wrote to memory of 792 624 hfgjfhfdgre546.exe hfgjfhfdgre546.exe PID 624 wrote to memory of 792 624 hfgjfhfdgre546.exe hfgjfhfdgre546.exe PID 624 wrote to memory of 792 624 hfgjfhfdgre546.exe hfgjfhfdgre546.exe PID 1200 wrote to memory of 988 1200 Explorer.EXE control.exe PID 1200 wrote to memory of 988 1200 Explorer.EXE control.exe PID 1200 wrote to memory of 988 1200 Explorer.EXE control.exe PID 1200 wrote to memory of 988 1200 Explorer.EXE control.exe PID 988 wrote to memory of 916 988 control.exe cmd.exe PID 988 wrote to memory of 916 988 control.exe cmd.exe PID 988 wrote to memory of 916 988 control.exe cmd.exe PID 988 wrote to memory of 916 988 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\excel.DLLW32.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\excel.DLLW32.dll,#13⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hfgjfhfdgre546.exe"C:\Users\Admin\AppData\Local\Temp\hfgjfhfdgre546.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hfgjfhfdgre546.exe"C:\Users\Admin\AppData\Local\Temp\hfgjfhfdgre546.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\hfgjfhfdgre546.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\hfgjfhfdgre546.exeMD5
ebee31991b156db114ab560139198d8f
SHA159326bdcd208d288adbe67690e1dbeec0da26722
SHA2563334766a549149bb18921ea6d05343412c99d36b57e3993b7610dfe689f5f194
SHA512c2cb8649d644b394437a76fc34ef6fbda2a020fb565a0f457e2df41d5dec1c6bba26eaefd25d78c82964d43320a393b40728037672d14bd236893043b180744d
-
C:\Users\Admin\AppData\Local\Temp\hfgjfhfdgre546.exeMD5
ebee31991b156db114ab560139198d8f
SHA159326bdcd208d288adbe67690e1dbeec0da26722
SHA2563334766a549149bb18921ea6d05343412c99d36b57e3993b7610dfe689f5f194
SHA512c2cb8649d644b394437a76fc34ef6fbda2a020fb565a0f457e2df41d5dec1c6bba26eaefd25d78c82964d43320a393b40728037672d14bd236893043b180744d
-
C:\Users\Admin\AppData\Local\Temp\hfgjfhfdgre546.exeMD5
ebee31991b156db114ab560139198d8f
SHA159326bdcd208d288adbe67690e1dbeec0da26722
SHA2563334766a549149bb18921ea6d05343412c99d36b57e3993b7610dfe689f5f194
SHA512c2cb8649d644b394437a76fc34ef6fbda2a020fb565a0f457e2df41d5dec1c6bba26eaefd25d78c82964d43320a393b40728037672d14bd236893043b180744d
-
\Users\Admin\AppData\Local\Temp\hfgjfhfdgre546.exeMD5
ebee31991b156db114ab560139198d8f
SHA159326bdcd208d288adbe67690e1dbeec0da26722
SHA2563334766a549149bb18921ea6d05343412c99d36b57e3993b7610dfe689f5f194
SHA512c2cb8649d644b394437a76fc34ef6fbda2a020fb565a0f457e2df41d5dec1c6bba26eaefd25d78c82964d43320a393b40728037672d14bd236893043b180744d
-
\Users\Admin\AppData\Local\Temp\hfgjfhfdgre546.exeMD5
ebee31991b156db114ab560139198d8f
SHA159326bdcd208d288adbe67690e1dbeec0da26722
SHA2563334766a549149bb18921ea6d05343412c99d36b57e3993b7610dfe689f5f194
SHA512c2cb8649d644b394437a76fc34ef6fbda2a020fb565a0f457e2df41d5dec1c6bba26eaefd25d78c82964d43320a393b40728037672d14bd236893043b180744d
-
memory/624-73-0x0000000004300000-0x000000000430B000-memory.dmpFilesize
44KB
-
memory/624-64-0x0000000000000000-mapping.dmp
-
memory/624-74-0x0000000004360000-0x0000000004361000-memory.dmpFilesize
4KB
-
memory/624-67-0x0000000000350000-0x0000000000351000-memory.dmpFilesize
4KB
-
memory/624-69-0x00000000004F0000-0x00000000004F1000-memory.dmpFilesize
4KB
-
memory/624-71-0x0000000004D40000-0x0000000004D61000-memory.dmpFilesize
132KB
-
memory/624-72-0x00000000004F1000-0x00000000004F2000-memory.dmpFilesize
4KB
-
memory/792-77-0x000000000041EBD0-mapping.dmp
-
memory/792-80-0x00000000008C0000-0x0000000000BC3000-memory.dmpFilesize
3.0MB
-
memory/792-81-0x00000000001D0000-0x00000000001E4000-memory.dmpFilesize
80KB
-
memory/792-79-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/916-88-0x0000000000000000-mapping.dmp
-
memory/988-83-0x0000000000000000-mapping.dmp
-
memory/988-85-0x00000000002D0000-0x00000000002EF000-memory.dmpFilesize
124KB
-
memory/988-87-0x00000000020F0000-0x00000000023F3000-memory.dmpFilesize
3.0MB
-
memory/988-86-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/988-89-0x0000000000370000-0x0000000000403000-memory.dmpFilesize
588KB
-
memory/1200-82-0x00000000074C0000-0x000000000763B000-memory.dmpFilesize
1.5MB
-
memory/1200-90-0x0000000008010000-0x000000000816E000-memory.dmpFilesize
1.4MB
-
memory/1984-61-0x0000000074F30000-0x0000000074F3A000-memory.dmpFilesize
40KB
-
memory/1984-60-0x00000000766D1000-0x00000000766D3000-memory.dmpFilesize
8KB
-
memory/1984-59-0x0000000000000000-mapping.dmp
-
memory/1984-62-0x0000000074F31000-0x0000000074F37000-memory.dmpFilesize
24KB