Analysis
-
max time kernel
153s -
max time network
140s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 14:04
Static task
static1
Behavioral task
behavioral1
Sample
H4vBtZsi8xAKaMm.exe
Resource
win7-en-20211208
General
-
Target
H4vBtZsi8xAKaMm.exe
-
Size
1.2MB
-
MD5
7eabab04e4a6fdd45238e32ed81e222c
-
SHA1
e0e1dc469746f5e2e049ea4a93d9b09a9227b342
-
SHA256
b79d2d02fe777cfd64723ad9b3935b30c00cbc75614fcadbf867cce88df4a8fd
-
SHA512
eeaa0f02a15a66b3363f94730ad3cf7c533a4bf303cfa0f53b21959a54dc0f65c50b1ac179aa5f992e3e17bbfaaa1b7393da3d1859ddd51932d36bdf0b7fa21b
Malware Config
Extracted
formbook
4.1
u1p5
yannickrast.com
shitcoin.team
mysweetelissa.com
tpnfrgm2wrld.xyz
freeclothesonline.com
rhoads-music.com
tanglewoodrx.com
sharkeycustoms.com
bonin-island.com
apeutah.com
metacehennem.xyz
deutscheno1.com
e-gate-io.store
hometoto.xyz
jojomove.com
vzn2aai2qj.icu
couponcodes6.com
pbcgotv.com
metarealtyhome.com
geymall.com
cassies.online
panasonicamazingdeals.com
elfontheshelef.com
knoxvillehomelistings.com
codotjonz.site
hokabrazil.com
vinewineltd.com
arcanefiretarot.com
ameustudio.com
missromeroli.com
emagrecerja.site
newsforindia.xyz
runcel.com
hornnbach.com
makemoneyquick.xyz
99468.xyz
anayahgrandmall.com
baskethabitualgoals.xyz
walkemboys.com
living---room.com
halkcigkofte.com
pm4rfg3i.xyz
ovivacious.com
studioaah.com
kailibianminwang.com
talleresjoyca.com
radiosharm.com
aardvanslooten.one
myscrappingkits.com
piertrafesa.com
soil-spot-ms.com
marymarinho.com
diasporagirl.com
cloud02-piggy.xyz
holywaterjewelry.com
policereportingsystems.com
agengrosirfashion.com
neseggidul.com
ymbdyktldh.biz
fizyoterapistmertsevinc.com
dasmonica.com
jovam.xyz
bettingweb365.com
doublecuttrails.com
verifyaxcx.com
Signatures
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4344-125-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4344-128-0x0000000001020000-0x000000000116A000-memory.dmp formbook behavioral2/memory/4344-130-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4504-134-0x0000000000C00000-0x0000000000C2F000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
H4vBtZsi8xAKaMm.exeMSBuild.exechkdsk.exedescription pid process target process PID 3452 set thread context of 4344 3452 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 4344 set thread context of 3020 4344 MSBuild.exe Explorer.EXE PID 4344 set thread context of 3020 4344 MSBuild.exe Explorer.EXE PID 4504 set thread context of 3020 4504 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 41 IoCs
Processes:
H4vBtZsi8xAKaMm.exeMSBuild.exechkdsk.exepid process 3452 H4vBtZsi8xAKaMm.exe 4344 MSBuild.exe 4344 MSBuild.exe 4344 MSBuild.exe 4344 MSBuild.exe 4344 MSBuild.exe 4344 MSBuild.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe 4504 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3020 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
MSBuild.exechkdsk.exepid process 4344 MSBuild.exe 4344 MSBuild.exe 4344 MSBuild.exe 4344 MSBuild.exe 4504 chkdsk.exe 4504 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
H4vBtZsi8xAKaMm.exeMSBuild.exechkdsk.exedescription pid process Token: SeDebugPrivilege 3452 H4vBtZsi8xAKaMm.exe Token: SeDebugPrivilege 4344 MSBuild.exe Token: SeDebugPrivilege 4504 chkdsk.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
H4vBtZsi8xAKaMm.exeMSBuild.exechkdsk.exedescription pid process target process PID 3452 wrote to memory of 4344 3452 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 3452 wrote to memory of 4344 3452 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 3452 wrote to memory of 4344 3452 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 3452 wrote to memory of 4344 3452 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 3452 wrote to memory of 4344 3452 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 3452 wrote to memory of 4344 3452 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 4344 wrote to memory of 4504 4344 MSBuild.exe chkdsk.exe PID 4344 wrote to memory of 4504 4344 MSBuild.exe chkdsk.exe PID 4344 wrote to memory of 4504 4344 MSBuild.exe chkdsk.exe PID 4504 wrote to memory of 2684 4504 chkdsk.exe cmd.exe PID 4504 wrote to memory of 2684 4504 chkdsk.exe cmd.exe PID 4504 wrote to memory of 2684 4504 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\H4vBtZsi8xAKaMm.exe"C:\Users\Admin\AppData\Local\Temp\H4vBtZsi8xAKaMm.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"4⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3020-129-0x0000000005F30000-0x00000000060D9000-memory.dmpFilesize
1.7MB
-
memory/3020-132-0x0000000006480000-0x00000000065AE000-memory.dmpFilesize
1.2MB
-
memory/3020-137-0x0000000002D80000-0x0000000002E64000-memory.dmpFilesize
912KB
-
memory/3452-121-0x0000000004FA0000-0x000000000549E000-memory.dmpFilesize
5.0MB
-
memory/3452-119-0x0000000004F10000-0x0000000004F1A000-memory.dmpFilesize
40KB
-
memory/3452-120-0x0000000005190000-0x00000000051E6000-memory.dmpFilesize
344KB
-
memory/3452-118-0x0000000004FA0000-0x0000000005032000-memory.dmpFilesize
584KB
-
memory/3452-122-0x0000000005170000-0x000000000517A000-memory.dmpFilesize
40KB
-
memory/3452-123-0x0000000007450000-0x00000000074D8000-memory.dmpFilesize
544KB
-
memory/3452-124-0x00000000099C0000-0x00000000099F4000-memory.dmpFilesize
208KB
-
memory/3452-115-0x00000000003E0000-0x0000000000524000-memory.dmpFilesize
1.3MB
-
memory/3452-117-0x00000000054A0000-0x000000000599E000-memory.dmpFilesize
5.0MB
-
memory/3452-116-0x0000000004E30000-0x0000000004ECC000-memory.dmpFilesize
624KB
-
memory/4344-125-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4344-130-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4344-131-0x0000000001180000-0x0000000001A40000-memory.dmpFilesize
8.8MB
-
memory/4344-128-0x0000000001020000-0x000000000116A000-memory.dmpFilesize
1.3MB
-
memory/4344-127-0x00000000015C0000-0x00000000018E0000-memory.dmpFilesize
3.1MB
-
memory/4504-134-0x0000000000C00000-0x0000000000C2F000-memory.dmpFilesize
188KB
-
memory/4504-133-0x0000000000E90000-0x0000000000E9A000-memory.dmpFilesize
40KB
-
memory/4504-135-0x0000000005540000-0x0000000005860000-memory.dmpFilesize
3.1MB
-
memory/4504-136-0x0000000005200000-0x000000000539A000-memory.dmpFilesize
1.6MB