Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
15-10-2021 06:43
Behavioral task
behavioral1
Sample
2.exe
Resource
win7-en-20210920
General
-
Target
2.exe
-
Size
184KB
-
MD5
57fc9c24357ac2cde150537ae8a42884
-
SHA1
70fdc837d404f465f4af739d7415c24023f437ed
-
SHA256
eab2de096cfe890da97a654fb7c14097b1c15242cca986d90811c5722c95b416
-
SHA512
52e6f1d1a6aa7862de48add0b1f1a06d83b72efa5c8856256e3caf2110a457f42c45f54ba8a85776779e201bd12fc8176cd31c1bd8ab500b076096da89adee27
Malware Config
Extracted
formbook
4.1
bc3s
http://www.topei-products.com/bc3s/
anna-ng.com
mariangelamata.com
szqnbl.com
nesherguitars.com
mysekrit.com
againbeautyviensui.xyz
appf.life
bilalsolution.com
technoratii.com
11restoran.com
birthingly.com
crystalcarrillo.com
cohenasset.info
bunchofdesign.com
highstreetmag.com
talentkerning.com
outdoor-glassesadvice.com
aliceeety.com
habbuhot.info
pao91.com
resgatarpontosparavoce.com
tuancai.net
cnynckcrw.com
visaza.com
paulettecallen.com
kandmfinancialgroup.com
malibuclassix.com
thespoonteller.com
vidyaxyp.com
xn--gmsepetim-q9ab20j.com
saudesexualdoshomens.com
safehandmarketing.com
yebimhieu.site
alimitchellmedia.com
andrewpatrickpiette.com
astro-paradise.com
domainechoquet.com
navihealthpartners.com
detroitveganseafood.com
spankingandpunishment.com
magalu-queromais.com
mallsinup.com
rmsnidlogini.cloud
lifeisveryessential.com
stolzfus.com
iniciala.com
designslayers.com
clinivahq.com
ubersms.com
welenb.com
skyegroupllc.com
happyburger.net
moredate-s.com
alon-mail.com
voceprofessor.com
dokadveri.com
lafabricadisseny.com
westwooddesign.net
blossoms-boutique.com
jumtix.xyz
dietgulfport.com
soccerstreamer.com
lapurtcedd.com
secret-mall.com
Signatures
-
Formbook Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1936-58-0x00000000000D0000-0x00000000000FE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 876 cmd.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
2.exewlanext.exedescription pid process target process PID 1516 set thread context of 1364 1516 2.exe Explorer.EXE PID 1936 set thread context of 1364 1936 wlanext.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
2.exewlanext.exepid process 1516 2.exe 1516 2.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe 1936 wlanext.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1364 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
2.exewlanext.exepid process 1516 2.exe 1516 2.exe 1516 2.exe 1936 wlanext.exe 1936 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2.exewlanext.exedescription pid process Token: SeDebugPrivilege 1516 2.exe Token: SeDebugPrivilege 1936 wlanext.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1364 Explorer.EXE 1364 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1364 Explorer.EXE 1364 Explorer.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Explorer.EXEwlanext.exedescription pid process target process PID 1364 wrote to memory of 1936 1364 Explorer.EXE wlanext.exe PID 1364 wrote to memory of 1936 1364 Explorer.EXE wlanext.exe PID 1364 wrote to memory of 1936 1364 Explorer.EXE wlanext.exe PID 1364 wrote to memory of 1936 1364 Explorer.EXE wlanext.exe PID 1936 wrote to memory of 876 1936 wlanext.exe cmd.exe PID 1936 wrote to memory of 876 1936 wlanext.exe cmd.exe PID 1936 wrote to memory of 876 1936 wlanext.exe cmd.exe PID 1936 wrote to memory of 876 1936 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\2.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/876-60-0x0000000000000000-mapping.dmp
-
memory/1364-55-0x0000000006FE0000-0x00000000070E1000-memory.dmpFilesize
1.0MB
-
memory/1364-62-0x0000000007C20000-0x0000000007D64000-memory.dmpFilesize
1.3MB
-
memory/1516-54-0x00000000001A0000-0x00000000001B4000-memory.dmpFilesize
80KB
-
memory/1516-53-0x00000000007D0000-0x0000000000AD3000-memory.dmpFilesize
3.0MB
-
memory/1936-56-0x0000000000000000-mapping.dmp
-
memory/1936-58-0x00000000000D0000-0x00000000000FE000-memory.dmpFilesize
184KB
-
memory/1936-59-0x0000000000AA0000-0x0000000000DA3000-memory.dmpFilesize
3.0MB
-
memory/1936-57-0x0000000000FD0000-0x0000000000FE6000-memory.dmpFilesize
88KB
-
memory/1936-61-0x00000000008D0000-0x0000000000963000-memory.dmpFilesize
588KB