Analysis
-
max time kernel
151s -
max time network
142s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
22-10-2021 09:05
Static task
static1
Behavioral task
behavioral1
Sample
2.exe
Resource
win7-en-20211014
General
-
Target
2.exe
-
Size
510KB
-
MD5
831a54a05443e82a26a005ec26234144
-
SHA1
62c5e762a4daf6b70b0d56d8073f5fde4c178e8d
-
SHA256
7384abd36e0c316a0a343a943245ef61e6ecbcf6fe2aab10a8a0f2b72de7198d
-
SHA512
7208dd92027dc273a9d3249e0af4071a0980d233465be19d1546c613845292abe0a5c9119318e5b89c506b0614c8485dd779847db0db5d90b220f7febf4a9793
Malware Config
Extracted
formbook
4.1
m4bs
http://www.bridgedai.com/m4bs/
roofingmeetssolar.com
trefacs.info
jgmoamain.com
healthbenefitmanager.com
fasten-mit-diana.com
sijialutan.com
ouchsafety.net
mmcbrasil.com
rombachholdings.com
dksolutionsga.com
katherinewaltersconsulting.com
jfuejea.com
maintainarea.net
epilationnice.com
nightanddate.com
augustuslegacy.com
cricketaddicyor.com
norenasefamuf.rest
charlottesvilletowing.com
mortgagecreek.com
gbaguild.com
theinneroceanscall.com
menicheers.com
coursesrtltd.com
a68-28b8.biz
bitpanda-crypto-tracker.finance
pxhakl.com
vidatulum.com
hyid2021.com
walletmessage.com
zenstepsound.com
ypfycownxo.com
clubavendre.com
ynishatech.com
portalfolhagospel.com
beadiebandbros.com
vn8938.xyz
borghiemare.com
kreativestatement.com
covidnursinghomevictim.net
cruzmalone.com
revelation4kids.com
wellschool.net
anzinibrown.com
nynft.art
c5r-bdhh.biz
allindiappds.net
athingtowrite.com
eeds7xmu.com
powerthesaurus.info
sinwaeh.online
arizonaland4sale.com
glodeliveries.com
originalbeads.com
iranporomot.net
domain45.com
xbiquge.xyz
hayaletavcilari.xyz
ueg1jxm.xyz
abcdodinheiro.com
hdeventsportvlive24.xyz
sidejobprogramer.com
8xcauw.xyz
solitek-spain.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3812-124-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3812-125-0x000000000041F130-mapping.dmp formbook behavioral2/memory/3556-132-0x0000000001200000-0x000000000122F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
2.exe2.exeNETSTAT.EXEdescription pid process target process PID 3760 set thread context of 3812 3760 2.exe 2.exe PID 3812 set thread context of 3008 3812 2.exe Explorer.EXE PID 3556 set thread context of 3008 3556 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 3556 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
2.exeNETSTAT.EXEpid process 3812 2.exe 3812 2.exe 3812 2.exe 3812 2.exe 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE 3556 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3008 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
2.exeNETSTAT.EXEpid process 3812 2.exe 3812 2.exe 3812 2.exe 3556 NETSTAT.EXE 3556 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 3812 2.exe Token: SeDebugPrivilege 3556 NETSTAT.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
2.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 3760 wrote to memory of 3812 3760 2.exe 2.exe PID 3760 wrote to memory of 3812 3760 2.exe 2.exe PID 3760 wrote to memory of 3812 3760 2.exe 2.exe PID 3760 wrote to memory of 3812 3760 2.exe 2.exe PID 3760 wrote to memory of 3812 3760 2.exe 2.exe PID 3760 wrote to memory of 3812 3760 2.exe 2.exe PID 3008 wrote to memory of 3556 3008 Explorer.EXE NETSTAT.EXE PID 3008 wrote to memory of 3556 3008 Explorer.EXE NETSTAT.EXE PID 3008 wrote to memory of 3556 3008 Explorer.EXE NETSTAT.EXE PID 3556 wrote to memory of 3308 3556 NETSTAT.EXE cmd.exe PID 3556 wrote to memory of 3308 3556 NETSTAT.EXE cmd.exe PID 3556 wrote to memory of 3308 3556 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\2.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3008-129-0x0000000005C20000-0x0000000005DA6000-memory.dmpFilesize
1.5MB
-
memory/3008-136-0x00000000032B0000-0x00000000033A3000-memory.dmpFilesize
972KB
-
memory/3308-134-0x0000000000000000-mapping.dmp
-
memory/3556-135-0x00000000038A0000-0x0000000003933000-memory.dmpFilesize
588KB
-
memory/3556-133-0x0000000003AB0000-0x0000000003DD0000-memory.dmpFilesize
3.1MB
-
memory/3556-131-0x0000000001280000-0x000000000128B000-memory.dmpFilesize
44KB
-
memory/3556-132-0x0000000001200000-0x000000000122F000-memory.dmpFilesize
188KB
-
memory/3556-130-0x0000000000000000-mapping.dmp
-
memory/3760-121-0x0000000006390000-0x0000000006397000-memory.dmpFilesize
28KB
-
memory/3760-123-0x0000000009360000-0x00000000093B0000-memory.dmpFilesize
320KB
-
memory/3760-122-0x00000000092C0000-0x00000000092C1000-memory.dmpFilesize
4KB
-
memory/3760-115-0x0000000000CE0000-0x0000000000CE1000-memory.dmpFilesize
4KB
-
memory/3760-120-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/3760-119-0x00000000055E0000-0x0000000005ADE000-memory.dmpFilesize
5.0MB
-
memory/3760-118-0x0000000005680000-0x0000000005681000-memory.dmpFilesize
4KB
-
memory/3760-117-0x0000000005AE0000-0x0000000005AE1000-memory.dmpFilesize
4KB
-
memory/3812-125-0x000000000041F130-mapping.dmp
-
memory/3812-128-0x00000000012B0000-0x00000000012C4000-memory.dmpFilesize
80KB
-
memory/3812-127-0x00000000012D0000-0x00000000015F0000-memory.dmpFilesize
3.1MB
-
memory/3812-124-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB