Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-en-20210916 -
submitted
20-09-2021 11:40
Static task
static1
Behavioral task
behavioral1
Sample
vbc.bin.exe
Resource
win7-en-20210916
General
-
Target
vbc.bin.exe
-
Size
839KB
-
MD5
3dc59de9ed011154938af9c5e29a3e1f
-
SHA1
745034c7572595000bacdb8d71fcb29ffab16b2c
-
SHA256
8fe7837653de9e01919ef2ea22f0b777fc6ee5c4898c33d0ce68b2602b8d4b65
-
SHA512
1852090e7c5f82c5ec4a8c63a0980d70843a770c9cc03e4a598d13c0002d444246d295f9bbaa97ee22ef13213e86243842019efa63b55d95139fc4350d66b142
Malware Config
Extracted
formbook
4.1
m8g0
http://www.psicologarenatacruz.com/m8g0/
trypapaya.pro
instructorcornernet.com
techadvisorsfl.com
raunnan.com
filestune.com
learnitanywhereskills.com
beaullife.com
getcovidwear.com
tkrbeautyinstitut.com
lisaphamkhai.com
iconicdds.com
ksoopawlas.com
testosteron.store
jctaketwo.com
awexz.online
onlinening.com
steelwerkschicago.com
lukakordic.com
expertsofcoaching.com
dashcca.com
xn--demiatdirecto-1ib.com
yuhongicm.com
portlandsiege.com
academysta.com
blackwiremedia.com
kent-ro-service.com
awmarkets.com
speleatherware.com
rehabcenters.space
jioscircle.com
sinijitu.com
analyticsyoda.com
shlqjt.com
bikramyogamarietta.com
crowncasino9.com
smokin-balls.com
shirasu-clinic.com
856379912.xyz
ckatesting.club
dideqsa.com
goodreporters.com
bromosyon.com
ilkonceyayincilik.com
domennyarendi32.net
thegrowthinn.com
qsgasia.com
venolbolivia.com
myhalloweengift.com
deeparchivesport.com
stiltedstories.com
btcdonation.info
little-darling.com
maximumpotentialfitness.net
iading.com
datingwithgusto.com
abncustompainting.com
cropadvisorjobs.com
nanoring.info
best-practice-gastro.com
sellitech.net
mixonsolutions.com
throughthelineagency.com
gtat.pro
relicstudios.net
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1812-59-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1812-60-0x000000000041F1B0-mapping.dmp formbook behavioral1/memory/1784-67-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1556 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.bin.exevbc.bin.exemstsc.exedescription pid process target process PID 1244 set thread context of 1812 1244 vbc.bin.exe vbc.bin.exe PID 1812 set thread context of 1204 1812 vbc.bin.exe Explorer.EXE PID 1784 set thread context of 1204 1784 mstsc.exe Explorer.EXE -
Modifies registry class 9 IoCs
Processes:
vbc.bin.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000_CLASSES\.gmkasm\ = "GMKAssembler.Project" vbc.bin.exe Key created \REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000_CLASSES\GMKAssembler.Project\Shell\open\command vbc.bin.exe Key created \REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000_CLASSES\GMKAssembler.Project\Shell vbc.bin.exe Key created \REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000_CLASSES\GMKAssembler.Project\Shell\open vbc.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000_CLASSES\GMKAssembler.Project\Shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\vbc.bin.exe\" \"%1\"" vbc.bin.exe Key created \REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000_CLASSES\GMKAssembler.Project\DefaultIcon vbc.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000_CLASSES\GMKAssembler.Project\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vbc.bin.exe" vbc.bin.exe Key created \REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000_CLASSES\.gmkasm vbc.bin.exe Key created \REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000_CLASSES\GMKAssembler.Project vbc.bin.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
vbc.bin.exemstsc.exepid process 1812 vbc.bin.exe 1812 vbc.bin.exe 1784 mstsc.exe 1784 mstsc.exe 1784 mstsc.exe 1784 mstsc.exe 1784 mstsc.exe 1784 mstsc.exe 1784 mstsc.exe 1784 mstsc.exe 1784 mstsc.exe 1784 mstsc.exe 1784 mstsc.exe 1784 mstsc.exe 1784 mstsc.exe 1784 mstsc.exe 1784 mstsc.exe 1784 mstsc.exe 1784 mstsc.exe 1784 mstsc.exe 1784 mstsc.exe 1784 mstsc.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.bin.exemstsc.exepid process 1812 vbc.bin.exe 1812 vbc.bin.exe 1812 vbc.bin.exe 1784 mstsc.exe 1784 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vbc.bin.exemstsc.exedescription pid process Token: SeDebugPrivilege 1812 vbc.bin.exe Token: SeDebugPrivilege 1784 mstsc.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
vbc.bin.exeExplorer.EXEmstsc.exedescription pid process target process PID 1244 wrote to memory of 1812 1244 vbc.bin.exe vbc.bin.exe PID 1244 wrote to memory of 1812 1244 vbc.bin.exe vbc.bin.exe PID 1244 wrote to memory of 1812 1244 vbc.bin.exe vbc.bin.exe PID 1244 wrote to memory of 1812 1244 vbc.bin.exe vbc.bin.exe PID 1244 wrote to memory of 1812 1244 vbc.bin.exe vbc.bin.exe PID 1244 wrote to memory of 1812 1244 vbc.bin.exe vbc.bin.exe PID 1244 wrote to memory of 1812 1244 vbc.bin.exe vbc.bin.exe PID 1204 wrote to memory of 1784 1204 Explorer.EXE mstsc.exe PID 1204 wrote to memory of 1784 1204 Explorer.EXE mstsc.exe PID 1204 wrote to memory of 1784 1204 Explorer.EXE mstsc.exe PID 1204 wrote to memory of 1784 1204 Explorer.EXE mstsc.exe PID 1784 wrote to memory of 1556 1784 mstsc.exe cmd.exe PID 1784 wrote to memory of 1556 1784 mstsc.exe cmd.exe PID 1784 wrote to memory of 1556 1784 mstsc.exe cmd.exe PID 1784 wrote to memory of 1556 1784 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.bin.exe"C:\Users\Admin\AppData\Local\Temp\vbc.bin.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.bin.exe"C:\Users\Admin\AppData\Local\Temp\vbc.bin.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\vbc.bin.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1204-63-0x0000000006DC0000-0x0000000007080000-memory.dmpFilesize
2.8MB
-
memory/1204-71-0x0000000007350000-0x00000000074D2000-memory.dmpFilesize
1.5MB
-
memory/1244-55-0x0000000000DB0000-0x0000000000DB1000-memory.dmpFilesize
4KB
-
memory/1244-56-0x00000000004B0000-0x00000000004CD000-memory.dmpFilesize
116KB
-
memory/1244-57-0x00000000055D0000-0x000000000563B000-memory.dmpFilesize
428KB
-
memory/1244-58-0x0000000000AD0000-0x0000000000B0B000-memory.dmpFilesize
236KB
-
memory/1244-53-0x0000000000EA0000-0x0000000000EA1000-memory.dmpFilesize
4KB
-
memory/1556-69-0x0000000000000000-mapping.dmp
-
memory/1784-66-0x0000000000EF0000-0x0000000000FF4000-memory.dmpFilesize
1.0MB
-
memory/1784-64-0x0000000000000000-mapping.dmp
-
memory/1784-65-0x0000000076921000-0x0000000076923000-memory.dmpFilesize
8KB
-
memory/1784-68-0x0000000000AF0000-0x0000000000DF3000-memory.dmpFilesize
3.0MB
-
memory/1784-67-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB
-
memory/1784-70-0x0000000000E00000-0x0000000000E94000-memory.dmpFilesize
592KB
-
memory/1812-61-0x0000000000930000-0x0000000000C33000-memory.dmpFilesize
3.0MB
-
memory/1812-62-0x0000000000280000-0x0000000000295000-memory.dmpFilesize
84KB
-
memory/1812-60-0x000000000041F1B0-mapping.dmp
-
memory/1812-59-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB