Analysis
-
max time kernel
148s -
max time network
164s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
29-10-2021 08:10
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-en-20210920
General
-
Target
1.exe
-
Size
652KB
-
MD5
ab6287e540cccfff7fc470053db92302
-
SHA1
09387a7e22e87c9555cd8abc2a9801c6e678dc05
-
SHA256
f31eb9a6841607a9a9cf253ef2ad8d27ac6d13289ee5420ebcf7f0f47ef46736
-
SHA512
3e641de591b8385408a476449cb5015d423e7ddf76b7da6299e5ff32e5d63a2fc9339c8fb21b016e457558b2e71d5d84a3ea5d949c49e42806ad729347e32da2
Malware Config
Extracted
formbook
4.1
snr6
http://www.reynbetgirisi.com/snr6/
jjglassmi1.com
vpsseattle.com
drfllc.top
staycoolonline.com
eptlove.com
solusimatasehat.site
ionrarecharlestonproperties.com
b3eflucg.xyz
tvchosun-usa.com
mmahzxwzsadqlshop.life
gospelimport.com
demoapps.website
jackburst54.com
99rocket.education
ccbwithbri.com
trapperairsoft.com
useroadly.com
ralphlaurenonline-nl.com
loanmaster4u.com
champ-beauty-tomigaoka-nail.com
theripemillennial.com
123intan.net
typopendant.com
coruscant.holdings
bio-intelligenz-therapie.com
reprv.com
directreport.net
phinespe.xyz
xuvedae.site
idilikproperties.info
wakigaggenin.com
mal2tech.com
nftwhaler.xyz
gxhnjssx.com
ozba.xyz
lecupcake.net
lucid.quest
kaleoslawncare.com
tiew.store
texcommercialpainting.com
2152351.com
likewize-xl.com
dacooligans.com
manuelmartinezs.com
beancusp.com
barbershopvalleyvillage.com
southwickfunerals.com
briellebaeslay.info
rebeccarye.com
unitedstateswelders.com
saudiarabiavegan.com
testcarona.com
serverapsd.com
crickx.email
hdszbj.com
bennettmountainoutfitter.com
leileilei1999.xyz
baroquefolke.com
francinegeorges.com
horpces.online
resolutionfix.com
mike-schultz.xyz
sohutobankueahomupezinkv.xyz
flowerseedqueen.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1352-64-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1352-65-0x000000000041F130-mapping.dmp formbook behavioral1/memory/428-73-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1096 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
1.exe1.execmmon32.exedescription pid process target process PID 268 set thread context of 1352 268 1.exe 1.exe PID 1352 set thread context of 1272 1352 1.exe Explorer.EXE PID 428 set thread context of 1272 428 cmmon32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
1.execmmon32.exepid process 1352 1.exe 1352 1.exe 428 cmmon32.exe 428 cmmon32.exe 428 cmmon32.exe 428 cmmon32.exe 428 cmmon32.exe 428 cmmon32.exe 428 cmmon32.exe 428 cmmon32.exe 428 cmmon32.exe 428 cmmon32.exe 428 cmmon32.exe 428 cmmon32.exe 428 cmmon32.exe 428 cmmon32.exe 428 cmmon32.exe 428 cmmon32.exe 428 cmmon32.exe 428 cmmon32.exe 428 cmmon32.exe 428 cmmon32.exe 428 cmmon32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
1.execmmon32.exepid process 1352 1.exe 1352 1.exe 1352 1.exe 428 cmmon32.exe 428 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1.execmmon32.exedescription pid process Token: SeDebugPrivilege 1352 1.exe Token: SeDebugPrivilege 428 cmmon32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
1.exeExplorer.EXEcmmon32.exedescription pid process target process PID 268 wrote to memory of 1352 268 1.exe 1.exe PID 268 wrote to memory of 1352 268 1.exe 1.exe PID 268 wrote to memory of 1352 268 1.exe 1.exe PID 268 wrote to memory of 1352 268 1.exe 1.exe PID 268 wrote to memory of 1352 268 1.exe 1.exe PID 268 wrote to memory of 1352 268 1.exe 1.exe PID 268 wrote to memory of 1352 268 1.exe 1.exe PID 1272 wrote to memory of 428 1272 Explorer.EXE cmmon32.exe PID 1272 wrote to memory of 428 1272 Explorer.EXE cmmon32.exe PID 1272 wrote to memory of 428 1272 Explorer.EXE cmmon32.exe PID 1272 wrote to memory of 428 1272 Explorer.EXE cmmon32.exe PID 428 wrote to memory of 1096 428 cmmon32.exe cmd.exe PID 428 wrote to memory of 1096 428 cmmon32.exe cmd.exe PID 428 wrote to memory of 1096 428 cmmon32.exe cmd.exe PID 428 wrote to memory of 1096 428 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\1.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/268-56-0x0000000074F81000-0x0000000074F83000-memory.dmpFilesize
8KB
-
memory/268-57-0x0000000004C30000-0x0000000004C31000-memory.dmpFilesize
4KB
-
memory/268-58-0x0000000000580000-0x000000000058E000-memory.dmpFilesize
56KB
-
memory/268-59-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/268-60-0x00000000051F0000-0x0000000005271000-memory.dmpFilesize
516KB
-
memory/268-61-0x0000000000A80000-0x0000000000AB0000-memory.dmpFilesize
192KB
-
memory/268-54-0x0000000000BA0000-0x0000000000BA1000-memory.dmpFilesize
4KB
-
memory/428-70-0x0000000000000000-mapping.dmp
-
memory/428-75-0x0000000000910000-0x00000000009A3000-memory.dmpFilesize
588KB
-
memory/428-73-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/428-74-0x0000000001E50000-0x0000000002153000-memory.dmpFilesize
3.0MB
-
memory/428-72-0x0000000000A40000-0x0000000000A4D000-memory.dmpFilesize
52KB
-
memory/1096-71-0x0000000000000000-mapping.dmp
-
memory/1272-69-0x0000000007030000-0x00000000071A9000-memory.dmpFilesize
1.5MB
-
memory/1272-76-0x0000000007340000-0x00000000074B6000-memory.dmpFilesize
1.5MB
-
memory/1352-68-0x00000000002A0000-0x00000000002B4000-memory.dmpFilesize
80KB
-
memory/1352-67-0x0000000000C50000-0x0000000000F53000-memory.dmpFilesize
3.0MB
-
memory/1352-65-0x000000000041F130-mapping.dmp
-
memory/1352-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1352-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1352-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB