Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-07-2021 18:42
Static task
static1
Behavioral task
behavioral1
Sample
Payment advice.exe
Resource
win7v20210408
General
-
Target
Payment advice.exe
-
Size
1.6MB
-
MD5
82816953c8ab81cab088fe61e1d64789
-
SHA1
36191f22e133db1ee5bb747e47098d039366e0a4
-
SHA256
955a1caeb560cf3f1db7d818eb00b8dd0a661c53b499460a55454d686f7481d1
-
SHA512
a13a11ee08c715fab51897bd2410b83bf25d4fa8e7546c179c1b8bd00fd211eb423dcd2092a3d56224a8bdc0c50c610a95f0328341fbead1f6ca18ada2d3b8d8
Malware Config
Extracted
formbook
4.1
http://www.yjhlgg.com/grve/
jrvinganimalexterminator.com
smallsyalls.com
po1c3.com
mencg.com
aussieenjoyment.today
espace22.com
aanmelding-desk.info
gallopshoes.com
nftsexy.com
ricosdulcesmexicanos.com
riseswift.com
thechicthirty.com
matdcg.com
alternet.today
creativehuesdesigns.com
rjkcrafts.com
lowdosemortgage.com
adoptahamster.com
wellness-sense.com
jacardcapital.com
pastiindonesia.com
lindsaynathan2021.com
brisbanemagicians.com
tvglanz.com
388384.com
mitgrim.com
endonelatrading.com
political.singles
ganjegirls.com
democratscancelled.com
ytzhubao.com
roiskylands.com
zamlgroup.com
winstonsalemathleticclub.com
62qtz2.com
caddyys.com
ecorarte.com
coonier.com
cbgmanhattan-hub.com
givanon.com
tioniis11.com
variceselite.com
tasaciona.com
hiphopeconomicdevelopment.com
citrixfile.com
piebuilder.com
drmetalpublishing.com
themesthatyoulike.com
vinhomes-phamhung.info
ardecentro.com
gameshowsatwork.com
go-rillathebrand.com
virtualppo.com
nogodbeforeme.net
fabrezeairpurifiers.com
roorisor.com
elaraberentcar.com
rugpat.com
renewalbyheather.com
innocox.com
ztsj10086.com
channelarmor.info
thecarbonbox.store
edicionesvita.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3152-125-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3152-126-0x000000000041EAF0-mapping.dmp formbook behavioral2/memory/3940-134-0x0000000002CC0000-0x0000000002CEE000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Payment advice.exePayment advice.exewlanext.exedescription pid process target process PID 3172 set thread context of 3152 3172 Payment advice.exe Payment advice.exe PID 3152 set thread context of 3052 3152 Payment advice.exe Explorer.EXE PID 3152 set thread context of 3052 3152 Payment advice.exe Explorer.EXE PID 3940 set thread context of 3052 3940 wlanext.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
Payment advice.exewlanext.exepid process 3152 Payment advice.exe 3152 Payment advice.exe 3152 Payment advice.exe 3152 Payment advice.exe 3152 Payment advice.exe 3152 Payment advice.exe 3940 wlanext.exe 3940 wlanext.exe 3940 wlanext.exe 3940 wlanext.exe 3940 wlanext.exe 3940 wlanext.exe 3940 wlanext.exe 3940 wlanext.exe 3940 wlanext.exe 3940 wlanext.exe 3940 wlanext.exe 3940 wlanext.exe 3940 wlanext.exe 3940 wlanext.exe 3940 wlanext.exe 3940 wlanext.exe 3940 wlanext.exe 3940 wlanext.exe 3940 wlanext.exe 3940 wlanext.exe 3940 wlanext.exe 3940 wlanext.exe 3940 wlanext.exe 3940 wlanext.exe 3940 wlanext.exe 3940 wlanext.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3052 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Payment advice.exewlanext.exepid process 3152 Payment advice.exe 3152 Payment advice.exe 3152 Payment advice.exe 3152 Payment advice.exe 3940 wlanext.exe 3940 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Payment advice.exePayment advice.exewlanext.exedescription pid process Token: SeDebugPrivilege 3172 Payment advice.exe Token: SeDebugPrivilege 3152 Payment advice.exe Token: SeDebugPrivilege 3940 wlanext.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Payment advice.exeExplorer.EXEwlanext.exedescription pid process target process PID 3172 wrote to memory of 3152 3172 Payment advice.exe Payment advice.exe PID 3172 wrote to memory of 3152 3172 Payment advice.exe Payment advice.exe PID 3172 wrote to memory of 3152 3172 Payment advice.exe Payment advice.exe PID 3172 wrote to memory of 3152 3172 Payment advice.exe Payment advice.exe PID 3172 wrote to memory of 3152 3172 Payment advice.exe Payment advice.exe PID 3172 wrote to memory of 3152 3172 Payment advice.exe Payment advice.exe PID 3052 wrote to memory of 3940 3052 Explorer.EXE wlanext.exe PID 3052 wrote to memory of 3940 3052 Explorer.EXE wlanext.exe PID 3052 wrote to memory of 3940 3052 Explorer.EXE wlanext.exe PID 3940 wrote to memory of 1516 3940 wlanext.exe cmd.exe PID 3940 wrote to memory of 1516 3940 wlanext.exe cmd.exe PID 3940 wrote to memory of 1516 3940 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment advice.exe"C:\Users\Admin\AppData\Local\Temp\Payment advice.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment advice.exe"C:\Users\Admin\AppData\Local\Temp\Payment advice.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Payment advice.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1516-135-0x0000000000000000-mapping.dmp
-
memory/3052-138-0x0000000005E30000-0x0000000005ED7000-memory.dmpFilesize
668KB
-
memory/3052-131-0x0000000002AE0000-0x0000000002BA7000-memory.dmpFilesize
796KB
-
memory/3052-128-0x0000000005F50000-0x00000000060BD000-memory.dmpFilesize
1.4MB
-
memory/3152-125-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3152-130-0x00000000012F0000-0x0000000001304000-memory.dmpFilesize
80KB
-
memory/3152-129-0x00000000012B0000-0x00000000012C4000-memory.dmpFilesize
80KB
-
memory/3152-127-0x0000000001330000-0x0000000001650000-memory.dmpFilesize
3.1MB
-
memory/3152-126-0x000000000041EAF0-mapping.dmp
-
memory/3172-121-0x00000000054E0000-0x000000000557C000-memory.dmpFilesize
624KB
-
memory/3172-118-0x0000000005620000-0x0000000005621000-memory.dmpFilesize
4KB
-
memory/3172-123-0x0000000001490000-0x0000000001505000-memory.dmpFilesize
468KB
-
memory/3172-122-0x0000000005010000-0x000000000503D000-memory.dmpFilesize
180KB
-
memory/3172-114-0x0000000000BA0000-0x0000000000BA1000-memory.dmpFilesize
4KB
-
memory/3172-120-0x0000000005810000-0x0000000005811000-memory.dmpFilesize
4KB
-
memory/3172-119-0x0000000005560000-0x0000000005561000-memory.dmpFilesize
4KB
-
memory/3172-124-0x0000000001510000-0x0000000001540000-memory.dmpFilesize
192KB
-
memory/3172-116-0x0000000005580000-0x0000000005581000-memory.dmpFilesize
4KB
-
memory/3172-117-0x0000000005BD0000-0x0000000005BD1000-memory.dmpFilesize
4KB
-
memory/3940-134-0x0000000002CC0000-0x0000000002CEE000-memory.dmpFilesize
184KB
-
memory/3940-133-0x0000000000C10000-0x0000000000C27000-memory.dmpFilesize
92KB
-
memory/3940-136-0x0000000003000000-0x000000000314A000-memory.dmpFilesize
1.3MB
-
memory/3940-137-0x0000000003400000-0x0000000003493000-memory.dmpFilesize
588KB
-
memory/3940-132-0x0000000000000000-mapping.dmp