Analysis
-
max time kernel
151s -
max time network
139s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
24-09-2021 07:52
Static task
static1
Behavioral task
behavioral1
Sample
doc0490192021092110294.exe
Resource
win7v20210408
General
-
Target
doc0490192021092110294.exe
-
Size
478KB
-
MD5
f22b3511efd4b6bb233ac4e30170b997
-
SHA1
98060cb83afb98719af740abd07b0f413dc75530
-
SHA256
6fd5dbec01eb7f767fc3b4046d9aa50f80e50f5ab9439480efb87620faef473c
-
SHA512
f86eed36dc05d7f49d744461f73ce03b6906ae6e3571cfb624d0a9d7a91062f0dcdc13201b6c6ebc1116f4853a868308082a5dd8dcccec8b2fdeeb37a9962329
Malware Config
Extracted
formbook
4.1
ergs
http://www.iselotech.com/ergs/
oceanprimesanfrancisco.com
dk-tnc.com
sodangwang.com
abrat-ed.com
dusubiqiqijem.xyz
getsup.online
homeneto.com
shose8.com
tronlane.com
nidowicosasod.xyz
independienteatleticclub.com
pca-winschool.com
realbadnastystories.site
bluevioletfloral.com
simplifiedpeacepodcast.com
abcfreediving.com
theyardbunny.com
holoique.com
ibkr1325.com
tjnfioou.xyz
bumbleapi.com
universityofnorthdakota.com
kisoriyan.com
scienceiva.com
permislbzd.store
mysoiree-lyon.com
philippinenow.com
officialjoyslots.com
casualdatingsites.online
delia-flores.com
eroerofuck.com
myesu.net
tryhard-production.com
3beadsbytj.com
congtycoessentials.net
3doutfits.com
spencersigmon.xyz
mewydyrqd.xyz
manigua.store
teescuchooffee.com
websitetudong.com
shiere.com
rummypepper.com
universeinteriors.com
royaledutyfree.com
evolutionarycurandera.com
seulookexpress.com
seajetguard.com
monikamosur.com
columbiaathleticboosters.com
sem4seo.com
businesstechblueprint.com
kreativemarketingconcepts.com
maisons-france-confort-mp.com
lixinjishaiwang.com
mybrabdmall.com
mrdreamhouse.com
graysrbm.online
theboathub.com
50039219.com
rincondelvinologo.com
coreatechnologyonline.com
artuta.com
teaneckvegan.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1424-66-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1424-67-0x000000000041F1C0-mapping.dmp formbook behavioral1/memory/1964-73-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1708 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
doc0490192021092110294.exedoc0490192021092110294.exewuapp.exedescription pid process target process PID 1988 set thread context of 1424 1988 doc0490192021092110294.exe doc0490192021092110294.exe PID 1424 set thread context of 1196 1424 doc0490192021092110294.exe Explorer.EXE PID 1964 set thread context of 1196 1964 wuapp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
doc0490192021092110294.exewuapp.exepid process 1424 doc0490192021092110294.exe 1424 doc0490192021092110294.exe 1964 wuapp.exe 1964 wuapp.exe 1964 wuapp.exe 1964 wuapp.exe 1964 wuapp.exe 1964 wuapp.exe 1964 wuapp.exe 1964 wuapp.exe 1964 wuapp.exe 1964 wuapp.exe 1964 wuapp.exe 1964 wuapp.exe 1964 wuapp.exe 1964 wuapp.exe 1964 wuapp.exe 1964 wuapp.exe 1964 wuapp.exe 1964 wuapp.exe 1964 wuapp.exe 1964 wuapp.exe 1964 wuapp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
doc0490192021092110294.exewuapp.exepid process 1424 doc0490192021092110294.exe 1424 doc0490192021092110294.exe 1424 doc0490192021092110294.exe 1964 wuapp.exe 1964 wuapp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
doc0490192021092110294.exewuapp.exedescription pid process Token: SeDebugPrivilege 1424 doc0490192021092110294.exe Token: SeDebugPrivilege 1964 wuapp.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Explorer.EXEpid process 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
doc0490192021092110294.exeExplorer.EXEwuapp.exedescription pid process target process PID 1988 wrote to memory of 1424 1988 doc0490192021092110294.exe doc0490192021092110294.exe PID 1988 wrote to memory of 1424 1988 doc0490192021092110294.exe doc0490192021092110294.exe PID 1988 wrote to memory of 1424 1988 doc0490192021092110294.exe doc0490192021092110294.exe PID 1988 wrote to memory of 1424 1988 doc0490192021092110294.exe doc0490192021092110294.exe PID 1988 wrote to memory of 1424 1988 doc0490192021092110294.exe doc0490192021092110294.exe PID 1988 wrote to memory of 1424 1988 doc0490192021092110294.exe doc0490192021092110294.exe PID 1988 wrote to memory of 1424 1988 doc0490192021092110294.exe doc0490192021092110294.exe PID 1196 wrote to memory of 1964 1196 Explorer.EXE wuapp.exe PID 1196 wrote to memory of 1964 1196 Explorer.EXE wuapp.exe PID 1196 wrote to memory of 1964 1196 Explorer.EXE wuapp.exe PID 1196 wrote to memory of 1964 1196 Explorer.EXE wuapp.exe PID 1196 wrote to memory of 1964 1196 Explorer.EXE wuapp.exe PID 1196 wrote to memory of 1964 1196 Explorer.EXE wuapp.exe PID 1196 wrote to memory of 1964 1196 Explorer.EXE wuapp.exe PID 1964 wrote to memory of 1708 1964 wuapp.exe cmd.exe PID 1964 wrote to memory of 1708 1964 wuapp.exe cmd.exe PID 1964 wrote to memory of 1708 1964 wuapp.exe cmd.exe PID 1964 wrote to memory of 1708 1964 wuapp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\doc0490192021092110294.exe"C:\Users\Admin\AppData\Local\Temp\doc0490192021092110294.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\doc0490192021092110294.exe"C:\Users\Admin\AppData\Local\Temp\doc0490192021092110294.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\doc0490192021092110294.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1196-78-0x0000000002740000-0x0000000002750000-memory.dmpFilesize
64KB
-
memory/1196-77-0x0000000006480000-0x00000000065E0000-memory.dmpFilesize
1.4MB
-
memory/1196-70-0x0000000006350000-0x000000000647A000-memory.dmpFilesize
1.2MB
-
memory/1424-68-0x0000000000870000-0x0000000000B73000-memory.dmpFilesize
3.0MB
-
memory/1424-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1424-67-0x000000000041F1C0-mapping.dmp
-
memory/1424-69-0x0000000000300000-0x0000000000315000-memory.dmpFilesize
84KB
-
memory/1708-75-0x0000000000000000-mapping.dmp
-
memory/1964-73-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB
-
memory/1964-71-0x0000000000000000-mapping.dmp
-
memory/1964-72-0x00000000011D0000-0x00000000011DB000-memory.dmpFilesize
44KB
-
memory/1964-74-0x0000000000A60000-0x0000000000D63000-memory.dmpFilesize
3.0MB
-
memory/1964-76-0x00000000007F0000-0x0000000000884000-memory.dmpFilesize
592KB
-
memory/1988-65-0x0000000000530000-0x000000000056C000-memory.dmpFilesize
240KB
-
memory/1988-60-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/1988-64-0x0000000004EE0000-0x0000000004F4C000-memory.dmpFilesize
432KB
-
memory/1988-63-0x0000000000390000-0x0000000000394000-memory.dmpFilesize
16KB
-
memory/1988-62-0x0000000004EA0000-0x0000000004EA1000-memory.dmpFilesize
4KB