Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
20-10-2021 16:41
Static task
static1
Behavioral task
behavioral1
Sample
obizx.exe
Resource
win7-en-20210920
General
-
Target
obizx.exe
-
Size
407KB
-
MD5
49d580ed801dcd3c12a2bf56e82a3baa
-
SHA1
ee97619d2e4a2dcec42a9a184fdead03b3016690
-
SHA256
2776237004407d8c72906ce72050cda1b0d9abeb20e313abf7a98e6fea03ce8d
-
SHA512
fbf3c5c087a96b70c9e1f95f17084fbb671f3f1fbaf5050ed4617ee869eef0c4b0365b48a07ca7a480f14ba682b3b89e246c2b15c4bea562e2099b8fbf4f6485
Malware Config
Extracted
formbook
4.1
fkt8
http://www.grampianscottages.com/fkt8/
chosenvoicesrising.com
sinanbodur.com
ajayforchange.com
ucp.coffee
voteyatooma.com
budgetsignsco.com
greenscheme.xyz
bscvbuye.xyz
onlineslot.website
posta-sk-online.com
lawrencesmithart.com
clubbiohack.com
rancrypto.net
ankitanandroy.com
mdexam.info
rochx7.com
experiencegreatness.site
rooferseeker.com
xy-marine.com
tecnograss.com
jziozizuzu.com
rtp96.com
restaurant-folie.com
erwoodrefinishing.com
1colibri.net
orurasam.com
carcof.com
rubarte.com
cosasycosas.club
ahmadsabbir.com
inooni.info
cataclysm-guild.com
fuccovid.com
evcopic.xyz
yxinst.com
ablo-chat.com
lostinmaking.com
motiandcompany.com
xcpebxon10.club
tadanootakudesu.com
vinto.link
elsoltaqueria.com
4008801923.com
veeboruto.com
utahguardianlaw.com
onzigo.net
beyondthedebt.com
fuckingme.xyz
novemberpro.com
deepakcardoza.com
forexlicai.net
lac0stevip.com
letrianviet.com
marginalizedproductions.net
oceanickapyrc.xyz
sangaltd.com
goosecheap.com
nobsmcs.com
int1-paypa1.com
stayhome.company
charmlnd.com
nosecretszone.com
comprizing.com
avaarchitect.com
Signatures
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/536-61-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/536-62-0x000000000041F0C0-mapping.dmp formbook behavioral1/memory/536-67-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/552-73-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1672 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
obizx.exeobizx.exesvchost.exedescription pid process target process PID 1544 set thread context of 536 1544 obizx.exe obizx.exe PID 536 set thread context of 1376 536 obizx.exe Explorer.EXE PID 536 set thread context of 1376 536 obizx.exe Explorer.EXE PID 552 set thread context of 1376 552 svchost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
obizx.exeobizx.exesvchost.exepid process 1544 obizx.exe 536 obizx.exe 536 obizx.exe 536 obizx.exe 552 svchost.exe 552 svchost.exe 552 svchost.exe 552 svchost.exe 552 svchost.exe 552 svchost.exe 552 svchost.exe 552 svchost.exe 552 svchost.exe 552 svchost.exe 552 svchost.exe 552 svchost.exe 552 svchost.exe 552 svchost.exe 552 svchost.exe 552 svchost.exe 552 svchost.exe 552 svchost.exe 552 svchost.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
obizx.exesvchost.exepid process 536 obizx.exe 536 obizx.exe 536 obizx.exe 536 obizx.exe 552 svchost.exe 552 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
obizx.exeobizx.exesvchost.exedescription pid process Token: SeDebugPrivilege 1544 obizx.exe Token: SeDebugPrivilege 536 obizx.exe Token: SeDebugPrivilege 552 svchost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1376 Explorer.EXE 1376 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1376 Explorer.EXE 1376 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
obizx.exeExplorer.EXEsvchost.exedescription pid process target process PID 1544 wrote to memory of 472 1544 obizx.exe obizx.exe PID 1544 wrote to memory of 472 1544 obizx.exe obizx.exe PID 1544 wrote to memory of 472 1544 obizx.exe obizx.exe PID 1544 wrote to memory of 472 1544 obizx.exe obizx.exe PID 1544 wrote to memory of 536 1544 obizx.exe obizx.exe PID 1544 wrote to memory of 536 1544 obizx.exe obizx.exe PID 1544 wrote to memory of 536 1544 obizx.exe obizx.exe PID 1544 wrote to memory of 536 1544 obizx.exe obizx.exe PID 1544 wrote to memory of 536 1544 obizx.exe obizx.exe PID 1544 wrote to memory of 536 1544 obizx.exe obizx.exe PID 1544 wrote to memory of 536 1544 obizx.exe obizx.exe PID 1376 wrote to memory of 552 1376 Explorer.EXE svchost.exe PID 1376 wrote to memory of 552 1376 Explorer.EXE svchost.exe PID 1376 wrote to memory of 552 1376 Explorer.EXE svchost.exe PID 1376 wrote to memory of 552 1376 Explorer.EXE svchost.exe PID 552 wrote to memory of 1672 552 svchost.exe cmd.exe PID 552 wrote to memory of 1672 552 svchost.exe cmd.exe PID 552 wrote to memory of 1672 552 svchost.exe cmd.exe PID 552 wrote to memory of 1672 552 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\obizx.exe"C:\Users\Admin\AppData\Local\Temp\obizx.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\obizx.exe"C:\Users\Admin\AppData\Local\Temp\obizx.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\obizx.exe"C:\Users\Admin\AppData\Local\Temp\obizx.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\obizx.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/536-65-0x0000000000320000-0x0000000000334000-memory.dmpFilesize
80KB
-
memory/536-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/536-68-0x0000000000360000-0x0000000000374000-memory.dmpFilesize
80KB
-
memory/536-62-0x000000000041F0C0-mapping.dmp
-
memory/536-64-0x00000000008C0000-0x0000000000BC3000-memory.dmpFilesize
3.0MB
-
memory/536-59-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/536-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/536-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/552-73-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB
-
memory/552-72-0x0000000000A60000-0x0000000000A68000-memory.dmpFilesize
32KB
-
memory/552-74-0x0000000000640000-0x0000000000943000-memory.dmpFilesize
3.0MB
-
memory/552-75-0x0000000000550000-0x00000000005E3000-memory.dmpFilesize
588KB
-
memory/552-70-0x0000000000000000-mapping.dmp
-
memory/1376-76-0x0000000007000000-0x000000000714F000-memory.dmpFilesize
1.3MB
-
memory/1376-66-0x00000000068C0000-0x0000000006A2E000-memory.dmpFilesize
1.4MB
-
memory/1376-69-0x0000000003E20000-0x0000000003EF2000-memory.dmpFilesize
840KB
-
memory/1544-56-0x00000000021F0000-0x00000000021F1000-memory.dmpFilesize
4KB
-
memory/1544-55-0x0000000074B91000-0x0000000074B93000-memory.dmpFilesize
8KB
-
memory/1544-58-0x0000000000800000-0x0000000000850000-memory.dmpFilesize
320KB
-
memory/1544-57-0x0000000000440000-0x0000000000447000-memory.dmpFilesize
28KB
-
memory/1544-53-0x0000000000850000-0x0000000000851000-memory.dmpFilesize
4KB
-
memory/1672-71-0x0000000000000000-mapping.dmp