Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-07-2021 04:25
Static task
static1
Behavioral task
behavioral1
Sample
excel.DLLW32.dll
Resource
win7v20210410
General
-
Target
excel.DLLW32.dll
-
Size
24KB
-
MD5
c79d67e385569c8e4f090f0dc188cfff
-
SHA1
68ee64c9f281aa0dd0479c8e89289b2af0bf72e8
-
SHA256
7a7a4887dcc86e8b6a576ae2acf805881586ee672be261a2a91a8d7a6e78c5bd
-
SHA512
4b4b906e5089816e7c7fb09c594e72bdf751ddd0cc2276b1a01a4915233983814a2463ac7648300362505128c5198882248f05fb5a3483b4702daedbed92b918
Malware Config
Extracted
formbook
4.1
http://www.happylittlexplorers.com/glgd/
cdcbullies.com
qidajixie.com
bgimlv.com
sunflowerhybrid.com
kemal.cloud
canadadirect.net
mickey2nd.com
fastjobssearcher.com
tiny-tobi.com
inmedixequus.com
coollifeideas.com
triadelectronicsupply.com
lambyo.com
zxyoo.com
spokanemusicmag.com
sortporn.com
deadroomnyc.com
313mail.com
hexiptv.net
stanbiccargo-express.com
hggt.net
theheilene.com
imbibetheculture.com
magnifiscentsbydarien.com
mcfarlanenterprises.com
chapsgrilletogo.com
startfortoday.com
sincamareros.com
bleacheater.com
elnurtic.com
finefoodandcooking.com
1931jones.com
buybetadeal.com
yourfavoredhairextensions.com
piaenglish.com
blockifysystems.com
atlerz.com
southernedgewaterdesigns.com
jamsole.net
wedyounow.com
gasesysoldaduras.com
st894.com
raquelbeckford.com
momdoduk.com
homeworkoutnow.com
maskintelligence.com
dahiyaa.com
dcsublease.com
fearlesslymiddleaged.com
thelittlereclaimedworkshop.com
johanarivero.com
differentlypun.life
frederickseyecare.com
sabortradicion.com
odptqfqxl.icu
socalseamlessgutters.com
rbhealthy.com
danielsdonuteria.com
cotswoldvehiclehire.com
ujenzihypermarket.com
farendofthebench.com
uniquelypotted.com
moddy.pro
soilhelp.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3748-134-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3748-135-0x000000000041EBD0-mapping.dmp formbook behavioral2/memory/3832-143-0x00000000005B0000-0x00000000005DE000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 10 368 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
hfgjfhfdgre546.exehfgjfhfdgre546.exepid process 2884 hfgjfhfdgre546.exe 3748 hfgjfhfdgre546.exe -
Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/2884-128-0x0000000006300000-0x0000000006321000-memory.dmp agile_net behavioral2/memory/2884-131-0x0000000004B20000-0x000000000501E000-memory.dmp agile_net -
Suspicious use of SetThreadContext 3 IoCs
Processes:
hfgjfhfdgre546.exehfgjfhfdgre546.execmd.exedescription pid process target process PID 2884 set thread context of 3748 2884 hfgjfhfdgre546.exe hfgjfhfdgre546.exe PID 3748 set thread context of 3000 3748 hfgjfhfdgre546.exe Explorer.EXE PID 3832 set thread context of 3000 3832 cmd.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 54 IoCs
Processes:
hfgjfhfdgre546.exehfgjfhfdgre546.execmd.exepid process 2884 hfgjfhfdgre546.exe 2884 hfgjfhfdgre546.exe 3748 hfgjfhfdgre546.exe 3748 hfgjfhfdgre546.exe 3748 hfgjfhfdgre546.exe 3748 hfgjfhfdgre546.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe 3832 cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3000 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
hfgjfhfdgre546.execmd.exepid process 3748 hfgjfhfdgre546.exe 3748 hfgjfhfdgre546.exe 3748 hfgjfhfdgre546.exe 3832 cmd.exe 3832 cmd.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
hfgjfhfdgre546.exehfgjfhfdgre546.execmd.exedescription pid process Token: SeDebugPrivilege 2884 hfgjfhfdgre546.exe Token: SeDebugPrivilege 3748 hfgjfhfdgre546.exe Token: SeDebugPrivilege 3832 cmd.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3000 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
rundll32.exerundll32.exehfgjfhfdgre546.exeExplorer.EXEcmd.exedescription pid process target process PID 3716 wrote to memory of 368 3716 rundll32.exe rundll32.exe PID 3716 wrote to memory of 368 3716 rundll32.exe rundll32.exe PID 3716 wrote to memory of 368 3716 rundll32.exe rundll32.exe PID 368 wrote to memory of 2884 368 rundll32.exe hfgjfhfdgre546.exe PID 368 wrote to memory of 2884 368 rundll32.exe hfgjfhfdgre546.exe PID 368 wrote to memory of 2884 368 rundll32.exe hfgjfhfdgre546.exe PID 2884 wrote to memory of 3748 2884 hfgjfhfdgre546.exe hfgjfhfdgre546.exe PID 2884 wrote to memory of 3748 2884 hfgjfhfdgre546.exe hfgjfhfdgre546.exe PID 2884 wrote to memory of 3748 2884 hfgjfhfdgre546.exe hfgjfhfdgre546.exe PID 2884 wrote to memory of 3748 2884 hfgjfhfdgre546.exe hfgjfhfdgre546.exe PID 2884 wrote to memory of 3748 2884 hfgjfhfdgre546.exe hfgjfhfdgre546.exe PID 2884 wrote to memory of 3748 2884 hfgjfhfdgre546.exe hfgjfhfdgre546.exe PID 3000 wrote to memory of 3832 3000 Explorer.EXE cmd.exe PID 3000 wrote to memory of 3832 3000 Explorer.EXE cmd.exe PID 3000 wrote to memory of 3832 3000 Explorer.EXE cmd.exe PID 3832 wrote to memory of 2308 3832 cmd.exe cmd.exe PID 3832 wrote to memory of 2308 3832 cmd.exe cmd.exe PID 3832 wrote to memory of 2308 3832 cmd.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\excel.DLLW32.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\excel.DLLW32.dll,#13⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hfgjfhfdgre546.exe"C:\Users\Admin\AppData\Local\Temp\hfgjfhfdgre546.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hfgjfhfdgre546.exe"C:\Users\Admin\AppData\Local\Temp\hfgjfhfdgre546.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\hfgjfhfdgre546.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\hfgjfhfdgre546.exeMD5
ebee31991b156db114ab560139198d8f
SHA159326bdcd208d288adbe67690e1dbeec0da26722
SHA2563334766a549149bb18921ea6d05343412c99d36b57e3993b7610dfe689f5f194
SHA512c2cb8649d644b394437a76fc34ef6fbda2a020fb565a0f457e2df41d5dec1c6bba26eaefd25d78c82964d43320a393b40728037672d14bd236893043b180744d
-
C:\Users\Admin\AppData\Local\Temp\hfgjfhfdgre546.exeMD5
ebee31991b156db114ab560139198d8f
SHA159326bdcd208d288adbe67690e1dbeec0da26722
SHA2563334766a549149bb18921ea6d05343412c99d36b57e3993b7610dfe689f5f194
SHA512c2cb8649d644b394437a76fc34ef6fbda2a020fb565a0f457e2df41d5dec1c6bba26eaefd25d78c82964d43320a393b40728037672d14bd236893043b180744d
-
C:\Users\Admin\AppData\Local\Temp\hfgjfhfdgre546.exeMD5
ebee31991b156db114ab560139198d8f
SHA159326bdcd208d288adbe67690e1dbeec0da26722
SHA2563334766a549149bb18921ea6d05343412c99d36b57e3993b7610dfe689f5f194
SHA512c2cb8649d644b394437a76fc34ef6fbda2a020fb565a0f457e2df41d5dec1c6bba26eaefd25d78c82964d43320a393b40728037672d14bd236893043b180744d
-
memory/368-114-0x0000000000000000-mapping.dmp
-
memory/368-115-0x0000000073580000-0x000000007358A000-memory.dmpFilesize
40KB
-
memory/368-116-0x0000000073581000-0x0000000073587000-memory.dmpFilesize
24KB
-
memory/2308-141-0x0000000000000000-mapping.dmp
-
memory/2884-130-0x0000000006380000-0x0000000006381000-memory.dmpFilesize
4KB
-
memory/2884-120-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/2884-124-0x0000000004BC0000-0x0000000004BC1000-memory.dmpFilesize
4KB
-
memory/2884-125-0x00000000055C0000-0x00000000055C1000-memory.dmpFilesize
4KB
-
memory/2884-126-0x0000000004B20000-0x000000000501E000-memory.dmpFilesize
5.0MB
-
memory/2884-128-0x0000000006300000-0x0000000006321000-memory.dmpFilesize
132KB
-
memory/2884-129-0x00000000063C0000-0x00000000063C1000-memory.dmpFilesize
4KB
-
memory/2884-122-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/2884-131-0x0000000004B20000-0x000000000501E000-memory.dmpFilesize
5.0MB
-
memory/2884-132-0x0000000006C30000-0x0000000006C3B000-memory.dmpFilesize
44KB
-
memory/2884-133-0x0000000009250000-0x0000000009251000-memory.dmpFilesize
4KB
-
memory/2884-117-0x0000000000000000-mapping.dmp
-
memory/2884-123-0x0000000004B20000-0x0000000004B21000-memory.dmpFilesize
4KB
-
memory/3000-139-0x00000000066E0000-0x000000000681A000-memory.dmpFilesize
1.2MB
-
memory/3000-146-0x0000000006820000-0x00000000068C2000-memory.dmpFilesize
648KB
-
memory/3748-138-0x00000000016A0000-0x00000000016B4000-memory.dmpFilesize
80KB
-
memory/3748-137-0x0000000001960000-0x0000000001C80000-memory.dmpFilesize
3.1MB
-
memory/3748-135-0x000000000041EBD0-mapping.dmp
-
memory/3748-134-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3832-140-0x0000000000000000-mapping.dmp
-
memory/3832-142-0x0000000000FA0000-0x0000000000FF9000-memory.dmpFilesize
356KB
-
memory/3832-143-0x00000000005B0000-0x00000000005DE000-memory.dmpFilesize
184KB
-
memory/3832-144-0x00000000031A0000-0x00000000034C0000-memory.dmpFilesize
3.1MB
-
memory/3832-145-0x00000000034C0000-0x0000000003553000-memory.dmpFilesize
588KB