Analysis
-
max time kernel
154s -
max time network
154s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
27-01-2022 17:52
Static task
static1
Behavioral task
behavioral1
Sample
cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe
Resource
win7-en-20211208
General
-
Target
cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe
-
Size
417KB
-
MD5
37fb2bd58342a1c5f533a567da920b9f
-
SHA1
cbf12b95467160f7d08654e6ffe08a3d560b0550
-
SHA256
cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c
-
SHA512
1e7497780ec7a38ccf66ea1013e58cf0d396face9ad01c0fcc419deffa772ca5fbccbacdb02676892bfe27f7acc4df585363b300eefb2c7448a680a60d80c48e
Malware Config
Extracted
formbook
4.1
m8g9
jimmycamel.com
bestinvilnius.com
diana-jarvis.com
manabitown.net
luxuryremyhair.com
cavesage.com
wholequote.space
truckdrivingfuture.xyz
ptcouponspt.com
stainthree-shift.space
universalstaffingpros.com
alibi-music.com
iqjlylro.com
pinterestservice.com
soolehayeiran.com
youngplatformpro.com
fidelitysafesecure.com
af258.wine
theblissdynamic.com
aliciabrooksenglishmastiff.com
wemgo.online
xl306.com
kapi-tal.com
keskinyapidekorasyon.com
voderment.com
tonnixcosmetics.com
gelmakotomasyon.com
metaonion.xyz
godrejambivaliriviera.info
netxmart.com
indocoinexchange.com
thestreetbuy.com
a-wallet.space
dharmabuttons.com
leisuredelight.com
asonesystem.com
panartproperties.com
1573.xn--czru2d
robodevendasautomatico.com
thepocketrockstars.com
chiildrensplace.com
beehivewm.com
routtcountyjail.com
annexaestheticsinc.com
realhappyshopping.com
butikcars.com
universitymoves.com
trianglespas.com
itspossibleonline.net
thevantrips.com
bt4umvjk.xyz
highlandfinancex.com
y6x7upe.xyz
ufqeils.xyz
read-book.xyz
mediwearables.com
kimbolkphotography.com
earthmamavenice.com
eraerentertainmentsync.com
235959.xyz
considericon.com
purintou.com
validenquire.com
qhhotels.com
rucystore.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/860-61-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/860-66-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1120-71-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exeRegSvcs.exeipconfig.exedescription pid process target process PID 1892 set thread context of 860 1892 cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe RegSvcs.exe PID 860 set thread context of 1292 860 RegSvcs.exe Explorer.EXE PID 860 set thread context of 1292 860 RegSvcs.exe Explorer.EXE PID 1120 set thread context of 1292 1120 ipconfig.exe Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 1120 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exeRegSvcs.exeipconfig.exepid process 1892 cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe 1892 cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe 860 RegSvcs.exe 860 RegSvcs.exe 860 RegSvcs.exe 1120 ipconfig.exe 1120 ipconfig.exe 1120 ipconfig.exe 1120 ipconfig.exe 1120 ipconfig.exe 1120 ipconfig.exe 1120 ipconfig.exe 1120 ipconfig.exe 1120 ipconfig.exe 1120 ipconfig.exe 1120 ipconfig.exe 1120 ipconfig.exe 1120 ipconfig.exe 1120 ipconfig.exe 1120 ipconfig.exe 1120 ipconfig.exe 1120 ipconfig.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RegSvcs.exeipconfig.exepid process 860 RegSvcs.exe 860 RegSvcs.exe 860 RegSvcs.exe 860 RegSvcs.exe 1120 ipconfig.exe 1120 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exeRegSvcs.exeipconfig.exedescription pid process Token: SeDebugPrivilege 1892 cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe Token: SeDebugPrivilege 860 RegSvcs.exe Token: SeDebugPrivilege 1120 ipconfig.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1292 Explorer.EXE 1292 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1292 Explorer.EXE 1292 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exeExplorer.EXEipconfig.exedescription pid process target process PID 1892 wrote to memory of 860 1892 cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe RegSvcs.exe PID 1892 wrote to memory of 860 1892 cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe RegSvcs.exe PID 1892 wrote to memory of 860 1892 cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe RegSvcs.exe PID 1892 wrote to memory of 860 1892 cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe RegSvcs.exe PID 1892 wrote to memory of 860 1892 cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe RegSvcs.exe PID 1892 wrote to memory of 860 1892 cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe RegSvcs.exe PID 1892 wrote to memory of 860 1892 cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe RegSvcs.exe PID 1892 wrote to memory of 860 1892 cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe RegSvcs.exe PID 1892 wrote to memory of 860 1892 cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe RegSvcs.exe PID 1892 wrote to memory of 860 1892 cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe RegSvcs.exe PID 1292 wrote to memory of 1120 1292 Explorer.EXE ipconfig.exe PID 1292 wrote to memory of 1120 1292 Explorer.EXE ipconfig.exe PID 1292 wrote to memory of 1120 1292 Explorer.EXE ipconfig.exe PID 1292 wrote to memory of 1120 1292 Explorer.EXE ipconfig.exe PID 1120 wrote to memory of 1996 1120 ipconfig.exe cmd.exe PID 1120 wrote to memory of 1996 1120 ipconfig.exe cmd.exe PID 1120 wrote to memory of 1996 1120 ipconfig.exe cmd.exe PID 1120 wrote to memory of 1996 1120 ipconfig.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe"C:\Users\Admin\AppData\Local\Temp\cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/860-67-0x00000000002F0000-0x0000000000305000-memory.dmpFilesize
84KB
-
memory/860-63-0x00000000007D0000-0x0000000000E43000-memory.dmpFilesize
6.4MB
-
memory/860-64-0x00000000001A0000-0x00000000001B5000-memory.dmpFilesize
84KB
-
memory/860-59-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/860-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/860-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/860-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1120-71-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1120-73-0x0000000000560000-0x00000000005F4000-memory.dmpFilesize
592KB
-
memory/1120-72-0x00000000020F0000-0x00000000023F3000-memory.dmpFilesize
3.0MB
-
memory/1120-70-0x0000000000140000-0x000000000014A000-memory.dmpFilesize
40KB
-
memory/1292-74-0x0000000007AC0000-0x0000000007BFE000-memory.dmpFilesize
1.2MB
-
memory/1292-68-0x0000000006610000-0x0000000006757000-memory.dmpFilesize
1.3MB
-
memory/1292-65-0x0000000004E80000-0x0000000004FC9000-memory.dmpFilesize
1.3MB
-
memory/1892-54-0x0000000000D60000-0x0000000000DCE000-memory.dmpFilesize
440KB
-
memory/1892-55-0x0000000076071000-0x0000000076073000-memory.dmpFilesize
8KB
-
memory/1892-56-0x0000000004E80000-0x0000000004E81000-memory.dmpFilesize
4KB
-
memory/1892-58-0x0000000005400000-0x000000000546A000-memory.dmpFilesize
424KB
-
memory/1892-57-0x0000000000440000-0x000000000044C000-memory.dmpFilesize
48KB