Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
31-01-2022 09:39
Static task
static1
Behavioral task
behavioral1
Sample
TURKEY ORDER .scr
Resource
win7-en-20211208
General
-
Target
TURKEY ORDER .scr
-
Size
503KB
-
MD5
8d97825fcb618d066758c26345a0e1a7
-
SHA1
75cd534c1749636a42275ba79e47cffa45d238c0
-
SHA256
c9d9d795f4da4b011059eefc991e9e0790df60b47a992973b56a4261dbe943a5
-
SHA512
1a4caac07969533aff4f10a3af56cb2b3437b65e1776bcf8c36168ffa721f8acd928ee053079a71c106ccca664d3407d45005b71e18c3ae7909be4028d3f58cc
Malware Config
Extracted
formbook
4.1
s16r
kellieroysellsnc.com
valleylowvoltage.com
mltuo900.xyz
visitingpuntacana.com
weiwushi.com
austintechjob.com
rxstarcbd.com
shopstudioesi.com
filetto-server.xyz
relianceltdbnk.com
unethical.world
yedd.store
esthershhs.com
magaddis.com
scenicdrivetours.com
123gest.com
2020mortagelifeinsurance.com
faceinle.com
integritymarking.com
alfatoto.xyz
nwebcam.com
wu8hx5cpgl3i.xyz
shiningbellsscrubs.com
visitorego.com
101-bg.com
blaccforestsociety.com
caremeinternational.com
devanharle.com
d2h7e3q.xyz
excaliburteacher.com
tatouagejaponais.com
gallematias.com
sobacoffee.com
thetravelbanana.com
artandmag.com
swoutfit.com
pecintaotomotif.com
realkezorup.xyz
shoplitumi.com
taylorhudak.net
prime-links.net
openvmsdatabasemigration.com
digitaltradingforex.com
vocenoazulnovamente.com
ertyuhjul.xyz
yunshangzhongwen.com
psalm686.com
breastfeedcare.com
matjaralmona.com
insurancesalesreps.com
octets.biz
reviewopenaccess.biz
parvatakrachka.com
vector-center.xyz
hatchvi.com
hmamah.com
a-home4you.com
lq-safe-keepingyuchand91.xyz
amplexus.xyz
h3ssel.xyz
aims-colorado.com
clickforrichesvision.com
belcantato.com
minidentalimplantsdaytonoh.com
mlniubi.xyz
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/584-61-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1384-68-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1820 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
TURKEY ORDER .scrTURKEY ORDER .scrmstsc.exedescription pid process target process PID 1748 set thread context of 584 1748 TURKEY ORDER .scr TURKEY ORDER .scr PID 584 set thread context of 1208 584 TURKEY ORDER .scr Explorer.EXE PID 1384 set thread context of 1208 1384 mstsc.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
TURKEY ORDER .scrmstsc.exepid process 584 TURKEY ORDER .scr 584 TURKEY ORDER .scr 1384 mstsc.exe 1384 mstsc.exe 1384 mstsc.exe 1384 mstsc.exe 1384 mstsc.exe 1384 mstsc.exe 1384 mstsc.exe 1384 mstsc.exe 1384 mstsc.exe 1384 mstsc.exe 1384 mstsc.exe 1384 mstsc.exe 1384 mstsc.exe 1384 mstsc.exe 1384 mstsc.exe 1384 mstsc.exe 1384 mstsc.exe 1384 mstsc.exe 1384 mstsc.exe 1384 mstsc.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
TURKEY ORDER .scrmstsc.exepid process 584 TURKEY ORDER .scr 584 TURKEY ORDER .scr 584 TURKEY ORDER .scr 1384 mstsc.exe 1384 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
TURKEY ORDER .scrmstsc.exedescription pid process Token: SeDebugPrivilege 584 TURKEY ORDER .scr Token: SeDebugPrivilege 1384 mstsc.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
TURKEY ORDER .scrExplorer.EXEmstsc.exedescription pid process target process PID 1748 wrote to memory of 584 1748 TURKEY ORDER .scr TURKEY ORDER .scr PID 1748 wrote to memory of 584 1748 TURKEY ORDER .scr TURKEY ORDER .scr PID 1748 wrote to memory of 584 1748 TURKEY ORDER .scr TURKEY ORDER .scr PID 1748 wrote to memory of 584 1748 TURKEY ORDER .scr TURKEY ORDER .scr PID 1748 wrote to memory of 584 1748 TURKEY ORDER .scr TURKEY ORDER .scr PID 1748 wrote to memory of 584 1748 TURKEY ORDER .scr TURKEY ORDER .scr PID 1748 wrote to memory of 584 1748 TURKEY ORDER .scr TURKEY ORDER .scr PID 1208 wrote to memory of 1384 1208 Explorer.EXE mstsc.exe PID 1208 wrote to memory of 1384 1208 Explorer.EXE mstsc.exe PID 1208 wrote to memory of 1384 1208 Explorer.EXE mstsc.exe PID 1208 wrote to memory of 1384 1208 Explorer.EXE mstsc.exe PID 1384 wrote to memory of 1820 1384 mstsc.exe cmd.exe PID 1384 wrote to memory of 1820 1384 mstsc.exe cmd.exe PID 1384 wrote to memory of 1820 1384 mstsc.exe cmd.exe PID 1384 wrote to memory of 1820 1384 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TURKEY ORDER .scr"C:\Users\Admin\AppData\Local\Temp\TURKEY ORDER .scr" /S2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TURKEY ORDER .scr"C:\Users\Admin\AppData\Local\Temp\TURKEY ORDER .scr"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\TURKEY ORDER .scr"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/584-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/584-64-0x0000000000180000-0x0000000000194000-memory.dmpFilesize
80KB
-
memory/584-63-0x0000000000A40000-0x0000000000D43000-memory.dmpFilesize
3.0MB
-
memory/584-59-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/584-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1208-71-0x0000000006F00000-0x0000000007077000-memory.dmpFilesize
1.5MB
-
memory/1208-65-0x00000000042F0000-0x00000000043C5000-memory.dmpFilesize
852KB
-
memory/1384-68-0x00000000000C0000-0x00000000000EF000-memory.dmpFilesize
188KB
-
memory/1384-67-0x00000000004E0000-0x00000000005E4000-memory.dmpFilesize
1.0MB
-
memory/1384-69-0x00000000021D0000-0x00000000024D3000-memory.dmpFilesize
3.0MB
-
memory/1384-70-0x00000000006E0000-0x00000000021C1000-memory.dmpFilesize
26.9MB
-
memory/1748-58-0x0000000004DF0000-0x0000000004E56000-memory.dmpFilesize
408KB
-
memory/1748-57-0x00000000002B0000-0x00000000002C4000-memory.dmpFilesize
80KB
-
memory/1748-56-0x0000000004C00000-0x0000000004C01000-memory.dmpFilesize
4KB
-
memory/1748-54-0x00000000001A0000-0x0000000000224000-memory.dmpFilesize
528KB
-
memory/1748-55-0x0000000075761000-0x0000000075763000-memory.dmpFilesize
8KB