Analysis
-
max time kernel
150s -
max time network
183s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-07-2021 18:42
Static task
static1
Behavioral task
behavioral1
Sample
Payment advice.exe
Resource
win7v20210408
General
-
Target
Payment advice.exe
-
Size
1.6MB
-
MD5
82816953c8ab81cab088fe61e1d64789
-
SHA1
36191f22e133db1ee5bb747e47098d039366e0a4
-
SHA256
955a1caeb560cf3f1db7d818eb00b8dd0a661c53b499460a55454d686f7481d1
-
SHA512
a13a11ee08c715fab51897bd2410b83bf25d4fa8e7546c179c1b8bd00fd211eb423dcd2092a3d56224a8bdc0c50c610a95f0328341fbead1f6ca18ada2d3b8d8
Malware Config
Extracted
formbook
4.1
http://www.yjhlgg.com/grve/
jrvinganimalexterminator.com
smallsyalls.com
po1c3.com
mencg.com
aussieenjoyment.today
espace22.com
aanmelding-desk.info
gallopshoes.com
nftsexy.com
ricosdulcesmexicanos.com
riseswift.com
thechicthirty.com
matdcg.com
alternet.today
creativehuesdesigns.com
rjkcrafts.com
lowdosemortgage.com
adoptahamster.com
wellness-sense.com
jacardcapital.com
pastiindonesia.com
lindsaynathan2021.com
brisbanemagicians.com
tvglanz.com
388384.com
mitgrim.com
endonelatrading.com
political.singles
ganjegirls.com
democratscancelled.com
ytzhubao.com
roiskylands.com
zamlgroup.com
winstonsalemathleticclub.com
62qtz2.com
caddyys.com
ecorarte.com
coonier.com
cbgmanhattan-hub.com
givanon.com
tioniis11.com
variceselite.com
tasaciona.com
hiphopeconomicdevelopment.com
citrixfile.com
piebuilder.com
drmetalpublishing.com
themesthatyoulike.com
vinhomes-phamhung.info
ardecentro.com
gameshowsatwork.com
go-rillathebrand.com
virtualppo.com
nogodbeforeme.net
fabrezeairpurifiers.com
roorisor.com
elaraberentcar.com
rugpat.com
renewalbyheather.com
innocox.com
ztsj10086.com
channelarmor.info
thecarbonbox.store
edicionesvita.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/628-65-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/628-66-0x000000000041EAF0-mapping.dmp formbook behavioral1/memory/1968-73-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1208 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Payment advice.exePayment advice.execolorcpl.exedescription pid process target process PID 1092 set thread context of 628 1092 Payment advice.exe Payment advice.exe PID 628 set thread context of 1268 628 Payment advice.exe Explorer.EXE PID 1968 set thread context of 1268 1968 colorcpl.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
Payment advice.execolorcpl.exepid process 628 Payment advice.exe 628 Payment advice.exe 1968 colorcpl.exe 1968 colorcpl.exe 1968 colorcpl.exe 1968 colorcpl.exe 1968 colorcpl.exe 1968 colorcpl.exe 1968 colorcpl.exe 1968 colorcpl.exe 1968 colorcpl.exe 1968 colorcpl.exe 1968 colorcpl.exe 1968 colorcpl.exe 1968 colorcpl.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Payment advice.execolorcpl.exepid process 628 Payment advice.exe 628 Payment advice.exe 628 Payment advice.exe 1968 colorcpl.exe 1968 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Payment advice.exePayment advice.execolorcpl.exedescription pid process Token: SeDebugPrivilege 1092 Payment advice.exe Token: SeDebugPrivilege 628 Payment advice.exe Token: SeDebugPrivilege 1968 colorcpl.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Payment advice.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 1092 wrote to memory of 628 1092 Payment advice.exe Payment advice.exe PID 1092 wrote to memory of 628 1092 Payment advice.exe Payment advice.exe PID 1092 wrote to memory of 628 1092 Payment advice.exe Payment advice.exe PID 1092 wrote to memory of 628 1092 Payment advice.exe Payment advice.exe PID 1092 wrote to memory of 628 1092 Payment advice.exe Payment advice.exe PID 1092 wrote to memory of 628 1092 Payment advice.exe Payment advice.exe PID 1092 wrote to memory of 628 1092 Payment advice.exe Payment advice.exe PID 1268 wrote to memory of 1968 1268 Explorer.EXE colorcpl.exe PID 1268 wrote to memory of 1968 1268 Explorer.EXE colorcpl.exe PID 1268 wrote to memory of 1968 1268 Explorer.EXE colorcpl.exe PID 1268 wrote to memory of 1968 1268 Explorer.EXE colorcpl.exe PID 1968 wrote to memory of 1208 1968 colorcpl.exe cmd.exe PID 1968 wrote to memory of 1208 1968 colorcpl.exe cmd.exe PID 1968 wrote to memory of 1208 1968 colorcpl.exe cmd.exe PID 1968 wrote to memory of 1208 1968 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment advice.exe"C:\Users\Admin\AppData\Local\Temp\Payment advice.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment advice.exe"C:\Users\Admin\AppData\Local\Temp\Payment advice.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Payment advice.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/628-65-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/628-67-0x00000000008B0000-0x0000000000BB3000-memory.dmpFilesize
3.0MB
-
memory/628-68-0x0000000000180000-0x0000000000194000-memory.dmpFilesize
80KB
-
memory/628-66-0x000000000041EAF0-mapping.dmp
-
memory/1092-64-0x0000000000490000-0x00000000004C0000-memory.dmpFilesize
192KB
-
memory/1092-63-0x0000000004B40000-0x0000000004BB5000-memory.dmpFilesize
468KB
-
memory/1092-62-0x0000000000210000-0x000000000023D000-memory.dmpFilesize
180KB
-
memory/1092-61-0x0000000000B90000-0x0000000000B91000-memory.dmpFilesize
4KB
-
memory/1092-59-0x0000000001300000-0x0000000001301000-memory.dmpFilesize
4KB
-
memory/1208-75-0x0000000000000000-mapping.dmp
-
memory/1268-69-0x00000000060D0000-0x00000000061C4000-memory.dmpFilesize
976KB
-
memory/1268-77-0x00000000061D0000-0x00000000062C1000-memory.dmpFilesize
964KB
-
memory/1968-71-0x0000000075AA1000-0x0000000075AA3000-memory.dmpFilesize
8KB
-
memory/1968-73-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/1968-74-0x0000000002030000-0x0000000002333000-memory.dmpFilesize
3.0MB
-
memory/1968-72-0x0000000000C10000-0x0000000000C28000-memory.dmpFilesize
96KB
-
memory/1968-70-0x0000000000000000-mapping.dmp
-
memory/1968-76-0x0000000000AA0000-0x0000000000B33000-memory.dmpFilesize
588KB