Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
20-10-2021 16:41
Static task
static1
Behavioral task
behavioral1
Sample
obizx.exe
Resource
win7-en-20210920
General
-
Target
obizx.exe
-
Size
407KB
-
MD5
49d580ed801dcd3c12a2bf56e82a3baa
-
SHA1
ee97619d2e4a2dcec42a9a184fdead03b3016690
-
SHA256
2776237004407d8c72906ce72050cda1b0d9abeb20e313abf7a98e6fea03ce8d
-
SHA512
fbf3c5c087a96b70c9e1f95f17084fbb671f3f1fbaf5050ed4617ee869eef0c4b0365b48a07ca7a480f14ba682b3b89e246c2b15c4bea562e2099b8fbf4f6485
Malware Config
Extracted
formbook
4.1
fkt8
http://www.grampianscottages.com/fkt8/
chosenvoicesrising.com
sinanbodur.com
ajayforchange.com
ucp.coffee
voteyatooma.com
budgetsignsco.com
greenscheme.xyz
bscvbuye.xyz
onlineslot.website
posta-sk-online.com
lawrencesmithart.com
clubbiohack.com
rancrypto.net
ankitanandroy.com
mdexam.info
rochx7.com
experiencegreatness.site
rooferseeker.com
xy-marine.com
tecnograss.com
jziozizuzu.com
rtp96.com
restaurant-folie.com
erwoodrefinishing.com
1colibri.net
orurasam.com
carcof.com
rubarte.com
cosasycosas.club
ahmadsabbir.com
inooni.info
cataclysm-guild.com
fuccovid.com
evcopic.xyz
yxinst.com
ablo-chat.com
lostinmaking.com
motiandcompany.com
xcpebxon10.club
tadanootakudesu.com
vinto.link
elsoltaqueria.com
4008801923.com
veeboruto.com
utahguardianlaw.com
onzigo.net
beyondthedebt.com
fuckingme.xyz
novemberpro.com
deepakcardoza.com
forexlicai.net
lac0stevip.com
letrianviet.com
marginalizedproductions.net
oceanickapyrc.xyz
sangaltd.com
goosecheap.com
nobsmcs.com
int1-paypa1.com
stayhome.company
charmlnd.com
nosecretszone.com
comprizing.com
avaarchitect.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1984-124-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1984-125-0x000000000041F0C0-mapping.dmp formbook behavioral2/memory/1584-133-0x0000000002310000-0x000000000233F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
obizx.exeobizx.exesystray.exedescription pid process target process PID 1756 set thread context of 1984 1756 obizx.exe obizx.exe PID 1984 set thread context of 3056 1984 obizx.exe Explorer.EXE PID 1584 set thread context of 3056 1584 systray.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
obizx.exesystray.exepid process 1984 obizx.exe 1984 obizx.exe 1984 obizx.exe 1984 obizx.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe 1584 systray.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3056 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
obizx.exesystray.exepid process 1984 obizx.exe 1984 obizx.exe 1984 obizx.exe 1584 systray.exe 1584 systray.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
obizx.exesystray.exedescription pid process Token: SeDebugPrivilege 1984 obizx.exe Token: SeDebugPrivilege 1584 systray.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
obizx.exeExplorer.EXEsystray.exedescription pid process target process PID 1756 wrote to memory of 1984 1756 obizx.exe obizx.exe PID 1756 wrote to memory of 1984 1756 obizx.exe obizx.exe PID 1756 wrote to memory of 1984 1756 obizx.exe obizx.exe PID 1756 wrote to memory of 1984 1756 obizx.exe obizx.exe PID 1756 wrote to memory of 1984 1756 obizx.exe obizx.exe PID 1756 wrote to memory of 1984 1756 obizx.exe obizx.exe PID 3056 wrote to memory of 1584 3056 Explorer.EXE systray.exe PID 3056 wrote to memory of 1584 3056 Explorer.EXE systray.exe PID 3056 wrote to memory of 1584 3056 Explorer.EXE systray.exe PID 1584 wrote to memory of 824 1584 systray.exe cmd.exe PID 1584 wrote to memory of 824 1584 systray.exe cmd.exe PID 1584 wrote to memory of 824 1584 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\obizx.exe"C:\Users\Admin\AppData\Local\Temp\obizx.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\obizx.exe"C:\Users\Admin\AppData\Local\Temp\obizx.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\obizx.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/824-131-0x0000000000000000-mapping.dmp
-
memory/1584-130-0x0000000000000000-mapping.dmp
-
memory/1584-135-0x0000000004260000-0x00000000042F3000-memory.dmpFilesize
588KB
-
memory/1584-134-0x0000000004400000-0x0000000004720000-memory.dmpFilesize
3.1MB
-
memory/1584-132-0x00000000002E0000-0x00000000002E6000-memory.dmpFilesize
24KB
-
memory/1584-133-0x0000000002310000-0x000000000233F000-memory.dmpFilesize
188KB
-
memory/1756-121-0x0000000008870000-0x0000000008877000-memory.dmpFilesize
28KB
-
memory/1756-119-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/1756-117-0x0000000005680000-0x0000000005681000-memory.dmpFilesize
4KB
-
memory/1756-118-0x0000000005220000-0x0000000005221000-memory.dmpFilesize
4KB
-
memory/1756-123-0x0000000008D50000-0x0000000008DA0000-memory.dmpFilesize
320KB
-
memory/1756-120-0x0000000005180000-0x000000000567E000-memory.dmpFilesize
5.0MB
-
memory/1756-115-0x00000000008D0000-0x00000000008D1000-memory.dmpFilesize
4KB
-
memory/1756-122-0x0000000008BB0000-0x0000000008BB1000-memory.dmpFilesize
4KB
-
memory/1984-128-0x0000000000F00000-0x0000000000F14000-memory.dmpFilesize
80KB
-
memory/1984-127-0x0000000001020000-0x0000000001340000-memory.dmpFilesize
3.1MB
-
memory/1984-125-0x000000000041F0C0-mapping.dmp
-
memory/1984-124-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3056-129-0x0000000006140000-0x000000000625F000-memory.dmpFilesize
1.1MB
-
memory/3056-136-0x00000000022B0000-0x000000000234B000-memory.dmpFilesize
620KB