Analysis
-
max time kernel
151s -
max time network
145s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
22-10-2021 09:05
Static task
static1
Behavioral task
behavioral1
Sample
2.exe
Resource
win7-en-20211014
General
-
Target
2.exe
-
Size
510KB
-
MD5
831a54a05443e82a26a005ec26234144
-
SHA1
62c5e762a4daf6b70b0d56d8073f5fde4c178e8d
-
SHA256
7384abd36e0c316a0a343a943245ef61e6ecbcf6fe2aab10a8a0f2b72de7198d
-
SHA512
7208dd92027dc273a9d3249e0af4071a0980d233465be19d1546c613845292abe0a5c9119318e5b89c506b0614c8485dd779847db0db5d90b220f7febf4a9793
Malware Config
Extracted
formbook
4.1
m4bs
http://www.bridgedai.com/m4bs/
roofingmeetssolar.com
trefacs.info
jgmoamain.com
healthbenefitmanager.com
fasten-mit-diana.com
sijialutan.com
ouchsafety.net
mmcbrasil.com
rombachholdings.com
dksolutionsga.com
katherinewaltersconsulting.com
jfuejea.com
maintainarea.net
epilationnice.com
nightanddate.com
augustuslegacy.com
cricketaddicyor.com
norenasefamuf.rest
charlottesvilletowing.com
mortgagecreek.com
gbaguild.com
theinneroceanscall.com
menicheers.com
coursesrtltd.com
a68-28b8.biz
bitpanda-crypto-tracker.finance
pxhakl.com
vidatulum.com
hyid2021.com
walletmessage.com
zenstepsound.com
ypfycownxo.com
clubavendre.com
ynishatech.com
portalfolhagospel.com
beadiebandbros.com
vn8938.xyz
borghiemare.com
kreativestatement.com
covidnursinghomevictim.net
cruzmalone.com
revelation4kids.com
wellschool.net
anzinibrown.com
nynft.art
c5r-bdhh.biz
allindiappds.net
athingtowrite.com
eeds7xmu.com
powerthesaurus.info
sinwaeh.online
arizonaland4sale.com
glodeliveries.com
originalbeads.com
iranporomot.net
domain45.com
xbiquge.xyz
hayaletavcilari.xyz
ueg1jxm.xyz
abcdodinheiro.com
hdeventsportvlive24.xyz
sidejobprogramer.com
8xcauw.xyz
solitek-spain.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/864-63-0x000000000041F130-mapping.dmp formbook behavioral1/memory/864-62-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1808-70-0x0000000000100000-0x000000000012F000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1472 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
2.exe2.exesystray.exedescription pid process target process PID 1076 set thread context of 864 1076 2.exe 2.exe PID 864 set thread context of 1384 864 2.exe Explorer.EXE PID 1808 set thread context of 1384 1808 systray.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
2.exesystray.exepid process 864 2.exe 864 2.exe 1808 systray.exe 1808 systray.exe 1808 systray.exe 1808 systray.exe 1808 systray.exe 1808 systray.exe 1808 systray.exe 1808 systray.exe 1808 systray.exe 1808 systray.exe 1808 systray.exe 1808 systray.exe 1808 systray.exe 1808 systray.exe 1808 systray.exe 1808 systray.exe 1808 systray.exe 1808 systray.exe 1808 systray.exe 1808 systray.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
2.exesystray.exepid process 864 2.exe 864 2.exe 864 2.exe 1808 systray.exe 1808 systray.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2.exesystray.exedescription pid process Token: SeDebugPrivilege 864 2.exe Token: SeDebugPrivilege 1808 systray.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1384 Explorer.EXE 1384 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1384 Explorer.EXE 1384 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
2.exeExplorer.EXEsystray.exedescription pid process target process PID 1076 wrote to memory of 864 1076 2.exe 2.exe PID 1076 wrote to memory of 864 1076 2.exe 2.exe PID 1076 wrote to memory of 864 1076 2.exe 2.exe PID 1076 wrote to memory of 864 1076 2.exe 2.exe PID 1076 wrote to memory of 864 1076 2.exe 2.exe PID 1076 wrote to memory of 864 1076 2.exe 2.exe PID 1076 wrote to memory of 864 1076 2.exe 2.exe PID 1384 wrote to memory of 1808 1384 Explorer.EXE systray.exe PID 1384 wrote to memory of 1808 1384 Explorer.EXE systray.exe PID 1384 wrote to memory of 1808 1384 Explorer.EXE systray.exe PID 1384 wrote to memory of 1808 1384 Explorer.EXE systray.exe PID 1808 wrote to memory of 1472 1808 systray.exe cmd.exe PID 1808 wrote to memory of 1472 1808 systray.exe cmd.exe PID 1808 wrote to memory of 1472 1808 systray.exe cmd.exe PID 1808 wrote to memory of 1472 1808 systray.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\2.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/864-66-0x0000000000160000-0x0000000000174000-memory.dmpFilesize
80KB
-
memory/864-63-0x000000000041F130-mapping.dmp
-
memory/864-65-0x0000000000860000-0x0000000000B63000-memory.dmpFilesize
3.0MB
-
memory/864-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/864-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/864-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1076-58-0x00000000009E0000-0x00000000009E7000-memory.dmpFilesize
28KB
-
memory/1076-57-0x00000000049D0000-0x00000000049D1000-memory.dmpFilesize
4KB
-
memory/1076-59-0x0000000004A10000-0x0000000004A60000-memory.dmpFilesize
320KB
-
memory/1076-55-0x0000000000F70000-0x0000000000F71000-memory.dmpFilesize
4KB
-
memory/1384-67-0x0000000006CA0000-0x0000000006E12000-memory.dmpFilesize
1.4MB
-
memory/1384-74-0x0000000003D20000-0x0000000003E02000-memory.dmpFilesize
904KB
-
memory/1472-71-0x0000000000000000-mapping.dmp
-
memory/1808-68-0x0000000000000000-mapping.dmp
-
memory/1808-69-0x0000000000BC0000-0x0000000000BC5000-memory.dmpFilesize
20KB
-
memory/1808-70-0x0000000000100000-0x000000000012F000-memory.dmpFilesize
188KB
-
memory/1808-72-0x0000000001FD0000-0x00000000022D3000-memory.dmpFilesize
3.0MB
-
memory/1808-73-0x00000000008C0000-0x0000000000953000-memory.dmpFilesize
588KB