Analysis
-
max time kernel
149s -
max time network
187s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-07-2021 06:47
Static task
static1
Behavioral task
behavioral1
Sample
RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe
Resource
win7v20210410
General
-
Target
RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe
-
Size
1.1MB
-
MD5
32a7f5eccb743dc2645f642cf109690a
-
SHA1
d73a4e4f6b5560cd1f21978a40265d480ef24259
-
SHA256
4cb3b507b091eafd3faf47a7ebb23e597d92b1cd4ad1655f6a0a9330768a60e5
-
SHA512
f590c392efe24e998aa5604bc8e03de3aafd69173e5b378612b561311c5c38620c0895811aff71320f98cc543cfe6d8643e67920822838b4fabed2c9b404f546
Malware Config
Extracted
formbook
4.1
http://www.sunderstudios.com/blo/
introducingsadieann.com
batterrydaddy.com
restaurantechoytac.digital
toriox.tech
cursosonline.pro
onegreenmother.com
canyonpark-home.com
charleserick9.com
coldavis-81720-1634.com
deliandgyros.com
darrenjmajor.com
chekax.com
twinsepower.com
welinkautollc.com
kimlmontgomery.com
ligature.net
bllbirdcrk.com
happilyeverfi.com
hahdigitalmarketinghelp.com
onecomcall.com
createanewyoucoaching.com
nocoky.com
saibamaisweboficial.com
ashtondrakr.com
fronteracater.com
outridermtb.com
wahinehealth.net
viksfitflow.com
redakgroup.com
tpabgd.com
chtc100.com
homeedgestore.com
proxyshops.com
nasakefashions.com
adindia.online
ryanleek.com
thecantonmentcookhouse.com
staszic.xyz
hondaandacuracollision.com
flzyzh.com
lakewoodluxury.com
lisetteperez.media
ronandmarie.com
karlhagan.com
peterrobinson.online
swfjobs.net
stylediaryavenue.com
gallayo.com
mon-test-qi.com
dominandoseuinstrumento.com
translationserviceguide.com
studiosettanta.com
view-millc.com
tadzkirah.com
virtual3devents.com
babehou.com
bbwsboutique.com
resurrectiondesignco.net
kitsmake.com
curiousparty.com
yugen-us.menu
melaninmagicthings.com
nudemburadatatlim.com
browntravelingnotary.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/656-64-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/656-65-0x000000000041EB40-mapping.dmp formbook behavioral1/memory/620-75-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1500 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exeRFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exeraserver.exedescription pid process target process PID 1208 set thread context of 656 1208 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe PID 656 set thread context of 1244 656 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe Explorer.EXE PID 656 set thread context of 1244 656 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe Explorer.EXE PID 620 set thread context of 1244 620 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exeraserver.exepid process 656 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe 656 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe 656 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe 620 raserver.exe 620 raserver.exe 620 raserver.exe 620 raserver.exe 620 raserver.exe 620 raserver.exe 620 raserver.exe 620 raserver.exe 620 raserver.exe 620 raserver.exe 620 raserver.exe 620 raserver.exe 620 raserver.exe 620 raserver.exe 620 raserver.exe 620 raserver.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exeraserver.exepid process 656 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe 656 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe 656 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe 656 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe 620 raserver.exe 620 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exeraserver.exedescription pid process Token: SeDebugPrivilege 656 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe Token: SeDebugPrivilege 620 raserver.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exeExplorer.EXEraserver.exedescription pid process target process PID 1208 wrote to memory of 656 1208 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe PID 1208 wrote to memory of 656 1208 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe PID 1208 wrote to memory of 656 1208 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe PID 1208 wrote to memory of 656 1208 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe PID 1208 wrote to memory of 656 1208 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe PID 1208 wrote to memory of 656 1208 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe PID 1208 wrote to memory of 656 1208 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe PID 1244 wrote to memory of 620 1244 Explorer.EXE raserver.exe PID 1244 wrote to memory of 620 1244 Explorer.EXE raserver.exe PID 1244 wrote to memory of 620 1244 Explorer.EXE raserver.exe PID 1244 wrote to memory of 620 1244 Explorer.EXE raserver.exe PID 620 wrote to memory of 1500 620 raserver.exe cmd.exe PID 620 wrote to memory of 1500 620 raserver.exe cmd.exe PID 620 wrote to memory of 1500 620 raserver.exe cmd.exe PID 620 wrote to memory of 1500 620 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe"C:\Users\Admin\AppData\Local\Temp\RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe"C:\Users\Admin\AppData\Local\Temp\RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/620-71-0x0000000000000000-mapping.dmp
-
memory/620-77-0x0000000001EA0000-0x0000000001F33000-memory.dmpFilesize
588KB
-
memory/620-76-0x0000000002050000-0x0000000002353000-memory.dmpFilesize
3.0MB
-
memory/620-75-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/620-74-0x0000000000960000-0x000000000097C000-memory.dmpFilesize
112KB
-
memory/620-72-0x0000000076661000-0x0000000076663000-memory.dmpFilesize
8KB
-
memory/656-64-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/656-66-0x0000000000D30000-0x0000000001033000-memory.dmpFilesize
3.0MB
-
memory/656-69-0x00000000001F0000-0x0000000000204000-memory.dmpFilesize
80KB
-
memory/656-67-0x0000000000180000-0x0000000000194000-memory.dmpFilesize
80KB
-
memory/656-65-0x000000000041EB40-mapping.dmp
-
memory/1208-59-0x0000000000C10000-0x0000000000C11000-memory.dmpFilesize
4KB
-
memory/1208-63-0x0000000005030000-0x000000000508C000-memory.dmpFilesize
368KB
-
memory/1208-62-0x0000000004A30000-0x0000000004A31000-memory.dmpFilesize
4KB
-
memory/1208-61-0x0000000000450000-0x0000000000454000-memory.dmpFilesize
16KB
-
memory/1244-68-0x0000000006CC0000-0x0000000006E09000-memory.dmpFilesize
1.3MB
-
memory/1244-70-0x0000000006F80000-0x00000000070F1000-memory.dmpFilesize
1.4MB
-
memory/1244-78-0x0000000004AE0000-0x0000000004BC3000-memory.dmpFilesize
908KB
-
memory/1500-73-0x0000000000000000-mapping.dmp