Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 17:52
Static task
static1
Behavioral task
behavioral1
Sample
cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe
Resource
win7-en-20211208
General
-
Target
cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe
-
Size
417KB
-
MD5
37fb2bd58342a1c5f533a567da920b9f
-
SHA1
cbf12b95467160f7d08654e6ffe08a3d560b0550
-
SHA256
cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c
-
SHA512
1e7497780ec7a38ccf66ea1013e58cf0d396face9ad01c0fcc419deffa772ca5fbccbacdb02676892bfe27f7acc4df585363b300eefb2c7448a680a60d80c48e
Malware Config
Extracted
formbook
4.1
m8g9
jimmycamel.com
bestinvilnius.com
diana-jarvis.com
manabitown.net
luxuryremyhair.com
cavesage.com
wholequote.space
truckdrivingfuture.xyz
ptcouponspt.com
stainthree-shift.space
universalstaffingpros.com
alibi-music.com
iqjlylro.com
pinterestservice.com
soolehayeiran.com
youngplatformpro.com
fidelitysafesecure.com
af258.wine
theblissdynamic.com
aliciabrooksenglishmastiff.com
wemgo.online
xl306.com
kapi-tal.com
keskinyapidekorasyon.com
voderment.com
tonnixcosmetics.com
gelmakotomasyon.com
metaonion.xyz
godrejambivaliriviera.info
netxmart.com
indocoinexchange.com
thestreetbuy.com
a-wallet.space
dharmabuttons.com
leisuredelight.com
asonesystem.com
panartproperties.com
1573.xn--czru2d
robodevendasautomatico.com
thepocketrockstars.com
chiildrensplace.com
beehivewm.com
routtcountyjail.com
annexaestheticsinc.com
realhappyshopping.com
butikcars.com
universitymoves.com
trianglespas.com
itspossibleonline.net
thevantrips.com
bt4umvjk.xyz
highlandfinancex.com
y6x7upe.xyz
ufqeils.xyz
read-book.xyz
mediwearables.com
kimbolkphotography.com
earthmamavenice.com
eraerentertainmentsync.com
235959.xyz
considericon.com
purintou.com
validenquire.com
qhhotels.com
rucystore.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2156-123-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1100-129-0x0000000002D50000-0x0000000002D7F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exeRegSvcs.exesvchost.exedescription pid process target process PID 616 set thread context of 2156 616 cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe RegSvcs.exe PID 2156 set thread context of 3056 2156 RegSvcs.exe Explorer.EXE PID 1100 set thread context of 3056 1100 svchost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exeRegSvcs.exesvchost.exepid process 616 cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe 616 cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe 2156 RegSvcs.exe 2156 RegSvcs.exe 2156 RegSvcs.exe 2156 RegSvcs.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3056 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exesvchost.exepid process 2156 RegSvcs.exe 2156 RegSvcs.exe 2156 RegSvcs.exe 1100 svchost.exe 1100 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exeRegSvcs.exesvchost.exedescription pid process Token: SeDebugPrivilege 616 cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe Token: SeDebugPrivilege 2156 RegSvcs.exe Token: SeDebugPrivilege 1100 svchost.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exeExplorer.EXEsvchost.exedescription pid process target process PID 616 wrote to memory of 2156 616 cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe RegSvcs.exe PID 616 wrote to memory of 2156 616 cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe RegSvcs.exe PID 616 wrote to memory of 2156 616 cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe RegSvcs.exe PID 616 wrote to memory of 2156 616 cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe RegSvcs.exe PID 616 wrote to memory of 2156 616 cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe RegSvcs.exe PID 616 wrote to memory of 2156 616 cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe RegSvcs.exe PID 3056 wrote to memory of 1100 3056 Explorer.EXE svchost.exe PID 3056 wrote to memory of 1100 3056 Explorer.EXE svchost.exe PID 3056 wrote to memory of 1100 3056 Explorer.EXE svchost.exe PID 1100 wrote to memory of 2912 1100 svchost.exe cmd.exe PID 1100 wrote to memory of 2912 1100 svchost.exe cmd.exe PID 1100 wrote to memory of 2912 1100 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe"C:\Users\Admin\AppData\Local\Temp\cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/616-115-0x0000000000A80000-0x0000000000AEE000-memory.dmpFilesize
440KB
-
memory/616-116-0x00000000059A0000-0x0000000005E9E000-memory.dmpFilesize
5.0MB
-
memory/616-117-0x0000000005360000-0x00000000053F2000-memory.dmpFilesize
584KB
-
memory/616-118-0x00000000054A0000-0x000000000599E000-memory.dmpFilesize
5.0MB
-
memory/616-119-0x0000000005310000-0x000000000531A000-memory.dmpFilesize
40KB
-
memory/616-120-0x0000000005480000-0x000000000548C000-memory.dmpFilesize
48KB
-
memory/616-121-0x0000000007A40000-0x0000000007ADC000-memory.dmpFilesize
624KB
-
memory/616-122-0x0000000007BD0000-0x0000000007C3A000-memory.dmpFilesize
424KB
-
memory/1100-128-0x0000000000210000-0x000000000021C000-memory.dmpFilesize
48KB
-
memory/1100-130-0x0000000003000000-0x00000000030AE000-memory.dmpFilesize
696KB
-
memory/1100-129-0x0000000002D50000-0x0000000002D7F000-memory.dmpFilesize
188KB
-
memory/1100-131-0x00000000035A0000-0x0000000003634000-memory.dmpFilesize
592KB
-
memory/2156-125-0x0000000001660000-0x0000000001980000-memory.dmpFilesize
3.1MB
-
memory/2156-126-0x0000000001200000-0x0000000001215000-memory.dmpFilesize
84KB
-
memory/2156-123-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3056-127-0x0000000005270000-0x00000000053DC000-memory.dmpFilesize
1.4MB
-
memory/3056-132-0x00000000053E0000-0x000000000556E000-memory.dmpFilesize
1.6MB