Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
21-10-2021 13:32
Static task
static1
Behavioral task
behavioral1
Sample
Factura de proforma.exe
Resource
win7-en-20211014
General
-
Target
Factura de proforma.exe
-
Size
973KB
-
MD5
3b28cc0c40a9122c19279e34ede6b2a6
-
SHA1
2c97655615b623605be40e708295e12499674640
-
SHA256
c4b4ddf8aec0347fd4640a12009f51ba60ed1b202e18b421a3faef74bfe18ea1
-
SHA512
95fc3c78c572285fa8b13993dab2cf25e5c2efbe6aa40930c7745d5b3f3bdecb14a51f6a3f78ac66ec5307b7a97d4843615f78639b5d815f16b4b31e086e3d08
Malware Config
Extracted
formbook
4.1
bc3s
http://www.topei-products.com/bc3s/
anna-ng.com
mariangelamata.com
szqnbl.com
nesherguitars.com
mysekrit.com
againbeautyviensui.xyz
appf.life
bilalsolution.com
technoratii.com
11restoran.com
birthingly.com
crystalcarrillo.com
cohenasset.info
bunchofdesign.com
highstreetmag.com
talentkerning.com
outdoor-glassesadvice.com
aliceeety.com
habbuhot.info
pao91.com
resgatarpontosparavoce.com
tuancai.net
cnynckcrw.com
visaza.com
paulettecallen.com
kandmfinancialgroup.com
malibuclassix.com
thespoonteller.com
vidyaxyp.com
xn--gmsepetim-q9ab20j.com
saudesexualdoshomens.com
safehandmarketing.com
yebimhieu.site
alimitchellmedia.com
andrewpatrickpiette.com
astro-paradise.com
domainechoquet.com
navihealthpartners.com
detroitveganseafood.com
spankingandpunishment.com
magalu-queromais.com
mallsinup.com
rmsnidlogini.cloud
lifeisveryessential.com
stolzfus.com
iniciala.com
designslayers.com
clinivahq.com
ubersms.com
welenb.com
skyegroupllc.com
happyburger.net
moredate-s.com
alon-mail.com
voceprofessor.com
dokadveri.com
lafabricadisseny.com
westwooddesign.net
blossoms-boutique.com
jumtix.xyz
dietgulfport.com
soccerstreamer.com
lapurtcedd.com
secret-mall.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/840-117-0x0000000000000000-mapping.dmp formbook behavioral2/memory/840-120-0x0000000072480000-0x00000000724AE000-memory.dmp formbook behavioral2/memory/516-126-0x00000000004F0000-0x000000000051E000-memory.dmp formbook -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Factura de proforma.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Tfiudl = "C:\\Users\\Public\\lduifT.url" Factura de proforma.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
secinit.exehelp.exedescription pid process target process PID 840 set thread context of 3028 840 secinit.exe Explorer.EXE PID 516 set thread context of 3028 516 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
secinit.exehelp.exepid process 840 secinit.exe 840 secinit.exe 840 secinit.exe 840 secinit.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe 516 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3028 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
secinit.exehelp.exepid process 840 secinit.exe 840 secinit.exe 840 secinit.exe 516 help.exe 516 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
secinit.exehelp.exedescription pid process Token: SeDebugPrivilege 840 secinit.exe Token: SeDebugPrivilege 516 help.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Factura de proforma.exeExplorer.EXEhelp.exedescription pid process target process PID 3568 wrote to memory of 840 3568 Factura de proforma.exe secinit.exe PID 3568 wrote to memory of 840 3568 Factura de proforma.exe secinit.exe PID 3568 wrote to memory of 840 3568 Factura de proforma.exe secinit.exe PID 3568 wrote to memory of 840 3568 Factura de proforma.exe secinit.exe PID 3568 wrote to memory of 840 3568 Factura de proforma.exe secinit.exe PID 3568 wrote to memory of 840 3568 Factura de proforma.exe secinit.exe PID 3028 wrote to memory of 516 3028 Explorer.EXE help.exe PID 3028 wrote to memory of 516 3028 Explorer.EXE help.exe PID 3028 wrote to memory of 516 3028 Explorer.EXE help.exe PID 516 wrote to memory of 3168 516 help.exe cmd.exe PID 516 wrote to memory of 3168 516 help.exe cmd.exe PID 516 wrote to memory of 3168 516 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Factura de proforma.exe"C:\Users\Admin\AppData\Local\Temp\Factura de proforma.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\secinit.exeC:\Windows\System32\secinit.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\secinit.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/516-124-0x0000000000000000-mapping.dmp
-
memory/516-129-0x0000000000AC0000-0x0000000000B53000-memory.dmpFilesize
588KB
-
memory/516-128-0x0000000000C60000-0x0000000000F80000-memory.dmpFilesize
3.1MB
-
memory/516-126-0x00000000004F0000-0x000000000051E000-memory.dmpFilesize
184KB
-
memory/516-125-0x0000000000FD0000-0x0000000000FD7000-memory.dmpFilesize
28KB
-
memory/840-120-0x0000000072480000-0x00000000724AE000-memory.dmpFilesize
184KB
-
memory/840-122-0x0000000004700000-0x0000000004714000-memory.dmpFilesize
80KB
-
memory/840-121-0x00000000043E0000-0x0000000004700000-memory.dmpFilesize
3.1MB
-
memory/840-119-0x0000000002A80000-0x0000000002A81000-memory.dmpFilesize
4KB
-
memory/840-117-0x0000000000000000-mapping.dmp
-
memory/3028-123-0x0000000006B20000-0x0000000006CBA000-memory.dmpFilesize
1.6MB
-
memory/3028-130-0x0000000001050000-0x0000000001124000-memory.dmpFilesize
848KB
-
memory/3168-127-0x0000000000000000-mapping.dmp
-
memory/3568-115-0x0000000002121000-0x0000000002135000-memory.dmpFilesize
80KB
-
memory/3568-116-0x0000000000950000-0x0000000000951000-memory.dmpFilesize
4KB