Analysis
-
max time kernel
147s -
max time network
139s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
20-10-2021 16:41
Static task
static1
Behavioral task
behavioral1
Sample
obizx.exe
Resource
win7-en-20211014
General
-
Target
obizx.exe
-
Size
407KB
-
MD5
49d580ed801dcd3c12a2bf56e82a3baa
-
SHA1
ee97619d2e4a2dcec42a9a184fdead03b3016690
-
SHA256
2776237004407d8c72906ce72050cda1b0d9abeb20e313abf7a98e6fea03ce8d
-
SHA512
fbf3c5c087a96b70c9e1f95f17084fbb671f3f1fbaf5050ed4617ee869eef0c4b0365b48a07ca7a480f14ba682b3b89e246c2b15c4bea562e2099b8fbf4f6485
Malware Config
Extracted
formbook
4.1
fkt8
http://www.grampianscottages.com/fkt8/
chosenvoicesrising.com
sinanbodur.com
ajayforchange.com
ucp.coffee
voteyatooma.com
budgetsignsco.com
greenscheme.xyz
bscvbuye.xyz
onlineslot.website
posta-sk-online.com
lawrencesmithart.com
clubbiohack.com
rancrypto.net
ankitanandroy.com
mdexam.info
rochx7.com
experiencegreatness.site
rooferseeker.com
xy-marine.com
tecnograss.com
jziozizuzu.com
rtp96.com
restaurant-folie.com
erwoodrefinishing.com
1colibri.net
orurasam.com
carcof.com
rubarte.com
cosasycosas.club
ahmadsabbir.com
inooni.info
cataclysm-guild.com
fuccovid.com
evcopic.xyz
yxinst.com
ablo-chat.com
lostinmaking.com
motiandcompany.com
xcpebxon10.club
tadanootakudesu.com
vinto.link
elsoltaqueria.com
4008801923.com
veeboruto.com
utahguardianlaw.com
onzigo.net
beyondthedebt.com
fuckingme.xyz
novemberpro.com
deepakcardoza.com
forexlicai.net
lac0stevip.com
letrianviet.com
marginalizedproductions.net
oceanickapyrc.xyz
sangaltd.com
goosecheap.com
nobsmcs.com
int1-paypa1.com
stayhome.company
charmlnd.com
nosecretszone.com
comprizing.com
avaarchitect.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/532-63-0x000000000041F0C0-mapping.dmp formbook behavioral1/memory/532-62-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1520-71-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 600 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
obizx.exeobizx.exemsiexec.exedescription pid process target process PID 1620 set thread context of 532 1620 obizx.exe obizx.exe PID 532 set thread context of 1268 532 obizx.exe Explorer.EXE PID 1520 set thread context of 1268 1520 msiexec.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
obizx.exemsiexec.exepid process 532 obizx.exe 532 obizx.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
obizx.exemsiexec.exepid process 532 obizx.exe 532 obizx.exe 532 obizx.exe 1520 msiexec.exe 1520 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
obizx.exemsiexec.exedescription pid process Token: SeDebugPrivilege 532 obizx.exe Token: SeDebugPrivilege 1520 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
obizx.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1620 wrote to memory of 532 1620 obizx.exe obizx.exe PID 1620 wrote to memory of 532 1620 obizx.exe obizx.exe PID 1620 wrote to memory of 532 1620 obizx.exe obizx.exe PID 1620 wrote to memory of 532 1620 obizx.exe obizx.exe PID 1620 wrote to memory of 532 1620 obizx.exe obizx.exe PID 1620 wrote to memory of 532 1620 obizx.exe obizx.exe PID 1620 wrote to memory of 532 1620 obizx.exe obizx.exe PID 1268 wrote to memory of 1520 1268 Explorer.EXE msiexec.exe PID 1268 wrote to memory of 1520 1268 Explorer.EXE msiexec.exe PID 1268 wrote to memory of 1520 1268 Explorer.EXE msiexec.exe PID 1268 wrote to memory of 1520 1268 Explorer.EXE msiexec.exe PID 1268 wrote to memory of 1520 1268 Explorer.EXE msiexec.exe PID 1268 wrote to memory of 1520 1268 Explorer.EXE msiexec.exe PID 1268 wrote to memory of 1520 1268 Explorer.EXE msiexec.exe PID 1520 wrote to memory of 600 1520 msiexec.exe cmd.exe PID 1520 wrote to memory of 600 1520 msiexec.exe cmd.exe PID 1520 wrote to memory of 600 1520 msiexec.exe cmd.exe PID 1520 wrote to memory of 600 1520 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\obizx.exe"C:\Users\Admin\AppData\Local\Temp\obizx.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\obizx.exe"C:\Users\Admin\AppData\Local\Temp\obizx.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\obizx.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/532-65-0x00000000009D0000-0x0000000000CD3000-memory.dmpFilesize
3.0MB
-
memory/532-66-0x0000000000190000-0x00000000001A4000-memory.dmpFilesize
80KB
-
memory/532-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/532-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/532-63-0x000000000041F0C0-mapping.dmp
-
memory/532-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/600-73-0x0000000000000000-mapping.dmp
-
memory/1268-75-0x0000000007C90000-0x0000000007D82000-memory.dmpFilesize
968KB
-
memory/1268-67-0x0000000006930000-0x0000000006A0D000-memory.dmpFilesize
884KB
-
memory/1520-68-0x0000000000000000-mapping.dmp
-
memory/1520-71-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB
-
memory/1520-72-0x0000000002260000-0x0000000002563000-memory.dmpFilesize
3.0MB
-
memory/1520-70-0x00000000005B0000-0x00000000005C4000-memory.dmpFilesize
80KB
-
memory/1520-74-0x0000000001F90000-0x0000000002023000-memory.dmpFilesize
588KB
-
memory/1620-59-0x0000000004F40000-0x0000000004F90000-memory.dmpFilesize
320KB
-
memory/1620-58-0x0000000000570000-0x0000000000577000-memory.dmpFilesize
28KB
-
memory/1620-54-0x0000000000340000-0x0000000000341000-memory.dmpFilesize
4KB
-
memory/1620-57-0x0000000004B10000-0x0000000004B11000-memory.dmpFilesize
4KB
-
memory/1620-56-0x0000000074A41000-0x0000000074A43000-memory.dmpFilesize
8KB