Analysis
- max time kernel
150s - max time network
138s - platform
windows10_x64 - resource
win10v20210410 - submitted
27/07/2021, 17:53
Static task
static1
Behavioral task
behavioral1
Sample
bobb4567.exe
Resource
win7v20210408
windows7_x64
General
- Target bobb4567.exe
- Size 245KB
- Sample210727-cqk4wtch3e
- SHA256 9598f7ebeef58e063e6e5de7da5ea2775991628d11c4fae3e3e2854fa22065eb
- MD5 90825728992d0ef937e2523370e34b31
- SHA1 7b9a3d06e10d3ccb32a8be5a98ec253bbc0bdebf
- SHA512 dc180827a8ba8f24dbf20f38091e1bee6c96776399733bf6519e567c0072ae5907abeaeea5873630a4a9057ec34370bbee47042c7b7e5d4e143ac6cac105f370
- MD5 SHA1 SHA512
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.bulverderoofing.com/lt0h/
-
originalindigofurniture.co.uk
-
fl6588.com
-
acecademy.com
-
yaerofinerindalnalising.com
-
mendilovic.online
-
rishenght.com
-
famlees.com
-
myhomeofficemarket.com
-
bouquetarabia.com
-
chrisbani.com
-
freebandslegally.com
-
hernandezinsurancegroup.net
-
slicedandfresh.com
-
apnathikanas.com
-
chadhatesyou.com
-
ansilsas.com
-
in3development.com
-
nitiren.net
-
peespn.com
-
valengz.com
-
theseakelpcompany.com
-
tlcrentny.com
-
sancakcraft.com
-
kamenb.com
-
samanthajobenson.com
-
alphagearz.com
-
sprins.net
-
adestramentos.com
-
civoconstruction.com
-
masrmasr.com
-
jagrit.codes
-
zusammenurlaub.com
-
mssjqs.com
-
ic695niu001.com
-
anelimplus.com
-
mutlob.com
-
beyondmickey.net
-
sliever.club
-
perfumefashion.icu
-
massimilianogiannocco.com
-
dentoncountyattorneys.media
-
filigreefilly.com
-
mooremgmtandcompany.com
-
smpdj.com
-
stainlesspropmgmt.com
-
creativecollectivecommunity.com
-
dmdrogist.com
-
spokenandheardpodcast.com
-
garenbid.com
-
bestcomandcalls.space
-
tairunshihua.com
-
nemski-projekt.com
-
6mum.com
-
portlandhemorrhoidcenter.com
-
platinumforsale.net
-
driven.plus
-
ontheedgeoutdoorshunting.com
-
manatapmasalalu.com
-
idscustomprinting.com
-
safepassagereform.com
-
fairop.xyz
-
natetacticz.com
-
etoys-sucks.com
-
rhinolabs.net
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 2 IoCs
resource yara_rule behavioral2/memory/1652-116-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2752-122-0x0000000003080000-0x00000000030AE000-memory.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3988 set thread context of 1652 3988 bobb4567.exe 74 PID 1652 set thread context of 2832 1652 bobb4567.exe 16 PID 2752 set thread context of 2832 2752 cmstp.exe 16 - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1652 bobb4567.exe 1652 bobb4567.exe 1652 bobb4567.exe 1652 bobb4567.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe 2752 cmstp.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2832 Explorer.EXE - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 3988 bobb4567.exe 1652 bobb4567.exe 1652 bobb4567.exe 1652 bobb4567.exe 2752 cmstp.exe 2752 cmstp.exe - Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeDebugPrivilege 1652 bobb4567.exe Token: SeShutdownPrivilege 2832 Explorer.EXE Token: SeCreatePagefilePrivilege 2832 Explorer.EXE Token: SeShutdownPrivilege 2832 Explorer.EXE Token: SeCreatePagefilePrivilege 2832 Explorer.EXE Token: SeShutdownPrivilege 2832 Explorer.EXE Token: SeCreatePagefilePrivilege 2832 Explorer.EXE Token: SeShutdownPrivilege 2832 Explorer.EXE Token: SeCreatePagefilePrivilege 2832 Explorer.EXE Token: SeShutdownPrivilege 2832 Explorer.EXE Token: SeCreatePagefilePrivilege 2832 Explorer.EXE Token: SeShutdownPrivilege 2832 Explorer.EXE Token: SeCreatePagefilePrivilege 2832 Explorer.EXE Token: SeDebugPrivilege 2752 cmstp.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2832 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3988 wrote to memory of 1652 3988 bobb4567.exe 74 PID 3988 wrote to memory of 1652 3988 bobb4567.exe 74 PID 3988 wrote to memory of 1652 3988 bobb4567.exe 74 PID 3988 wrote to memory of 1652 3988 bobb4567.exe 74 PID 2832 wrote to memory of 2752 2832 Explorer.EXE 77 PID 2832 wrote to memory of 2752 2832 Explorer.EXE 77 PID 2832 wrote to memory of 2752 2832 Explorer.EXE 77 PID 2752 wrote to memory of 4076 2752 cmstp.exe 79 PID 2752 wrote to memory of 4076 2752 cmstp.exe 79 PID 2752 wrote to memory of 4076 2752 cmstp.exe 79
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\bobb4567.exe"C:\Users\Admin\AppData\Local\Temp\bobb4567.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\bobb4567.exe"C:\Users\Admin\AppData\Local\Temp\bobb4567.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1652
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\bobb4567.exe"3⤵PID:4076
-
-