Analysis
-
max time kernel
151s -
max time network
140s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
31-01-2022 09:39
Static task
static1
Behavioral task
behavioral1
Sample
TURKEY ORDER .scr
Resource
win7-en-20211208
General
-
Target
TURKEY ORDER .scr
-
Size
503KB
-
MD5
8d97825fcb618d066758c26345a0e1a7
-
SHA1
75cd534c1749636a42275ba79e47cffa45d238c0
-
SHA256
c9d9d795f4da4b011059eefc991e9e0790df60b47a992973b56a4261dbe943a5
-
SHA512
1a4caac07969533aff4f10a3af56cb2b3437b65e1776bcf8c36168ffa721f8acd928ee053079a71c106ccca664d3407d45005b71e18c3ae7909be4028d3f58cc
Malware Config
Extracted
formbook
4.1
s16r
kellieroysellsnc.com
valleylowvoltage.com
mltuo900.xyz
visitingpuntacana.com
weiwushi.com
austintechjob.com
rxstarcbd.com
shopstudioesi.com
filetto-server.xyz
relianceltdbnk.com
unethical.world
yedd.store
esthershhs.com
magaddis.com
scenicdrivetours.com
123gest.com
2020mortagelifeinsurance.com
faceinle.com
integritymarking.com
alfatoto.xyz
nwebcam.com
wu8hx5cpgl3i.xyz
shiningbellsscrubs.com
visitorego.com
101-bg.com
blaccforestsociety.com
caremeinternational.com
devanharle.com
d2h7e3q.xyz
excaliburteacher.com
tatouagejaponais.com
gallematias.com
sobacoffee.com
thetravelbanana.com
artandmag.com
swoutfit.com
pecintaotomotif.com
realkezorup.xyz
shoplitumi.com
taylorhudak.net
prime-links.net
openvmsdatabasemigration.com
digitaltradingforex.com
vocenoazulnovamente.com
ertyuhjul.xyz
yunshangzhongwen.com
psalm686.com
breastfeedcare.com
matjaralmona.com
insurancesalesreps.com
octets.biz
reviewopenaccess.biz
parvatakrachka.com
vector-center.xyz
hatchvi.com
hmamah.com
a-home4you.com
lq-safe-keepingyuchand91.xyz
amplexus.xyz
h3ssel.xyz
aims-colorado.com
clickforrichesvision.com
belcantato.com
minidentalimplantsdaytonoh.com
mlniubi.xyz
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1712-122-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1712-125-0x0000000001220000-0x00000000013B4000-memory.dmp formbook behavioral2/memory/3420-128-0x00000000010F0000-0x000000000111F000-memory.dmp formbook behavioral2/memory/3420-130-0x00000000050A0000-0x0000000005231000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
TURKEY ORDER .scrTURKEY ORDER .scrmstsc.exedescription pid process target process PID 2732 set thread context of 1712 2732 TURKEY ORDER .scr TURKEY ORDER .scr PID 1712 set thread context of 3056 1712 TURKEY ORDER .scr Explorer.EXE PID 3420 set thread context of 3056 3420 mstsc.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
TURKEY ORDER .scrmstsc.exepid process 1712 TURKEY ORDER .scr 1712 TURKEY ORDER .scr 1712 TURKEY ORDER .scr 1712 TURKEY ORDER .scr 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe 3420 mstsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3056 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
TURKEY ORDER .scrmstsc.exepid process 1712 TURKEY ORDER .scr 1712 TURKEY ORDER .scr 1712 TURKEY ORDER .scr 3420 mstsc.exe 3420 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
TURKEY ORDER .scrmstsc.exedescription pid process Token: SeDebugPrivilege 1712 TURKEY ORDER .scr Token: SeDebugPrivilege 3420 mstsc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
TURKEY ORDER .scrExplorer.EXEmstsc.exedescription pid process target process PID 2732 wrote to memory of 1712 2732 TURKEY ORDER .scr TURKEY ORDER .scr PID 2732 wrote to memory of 1712 2732 TURKEY ORDER .scr TURKEY ORDER .scr PID 2732 wrote to memory of 1712 2732 TURKEY ORDER .scr TURKEY ORDER .scr PID 2732 wrote to memory of 1712 2732 TURKEY ORDER .scr TURKEY ORDER .scr PID 2732 wrote to memory of 1712 2732 TURKEY ORDER .scr TURKEY ORDER .scr PID 2732 wrote to memory of 1712 2732 TURKEY ORDER .scr TURKEY ORDER .scr PID 3056 wrote to memory of 3420 3056 Explorer.EXE mstsc.exe PID 3056 wrote to memory of 3420 3056 Explorer.EXE mstsc.exe PID 3056 wrote to memory of 3420 3056 Explorer.EXE mstsc.exe PID 3420 wrote to memory of 3132 3420 mstsc.exe cmd.exe PID 3420 wrote to memory of 3132 3420 mstsc.exe cmd.exe PID 3420 wrote to memory of 3132 3420 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TURKEY ORDER .scr"C:\Users\Admin\AppData\Local\Temp\TURKEY ORDER .scr" /S2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TURKEY ORDER .scr"C:\Users\Admin\AppData\Local\Temp\TURKEY ORDER .scr"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\TURKEY ORDER .scr"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1712-122-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1712-125-0x0000000001220000-0x00000000013B4000-memory.dmpFilesize
1.6MB
-
memory/1712-124-0x00000000013C0000-0x00000000016E0000-memory.dmpFilesize
3.1MB
-
memory/2732-119-0x0000000005910000-0x00000000059AC000-memory.dmpFilesize
624KB
-
memory/2732-115-0x0000000000980000-0x0000000000A04000-memory.dmpFilesize
528KB
-
memory/2732-120-0x0000000005C80000-0x0000000005CE6000-memory.dmpFilesize
408KB
-
memory/2732-121-0x00000000061E0000-0x00000000066DE000-memory.dmpFilesize
5.0MB
-
memory/2732-118-0x0000000005670000-0x0000000005702000-memory.dmpFilesize
584KB
-
memory/2732-117-0x0000000002E80000-0x0000000002E94000-memory.dmpFilesize
80KB
-
memory/2732-116-0x00000000054D0000-0x00000000054D1000-memory.dmpFilesize
4KB
-
memory/3056-126-0x0000000003120000-0x00000000031E1000-memory.dmpFilesize
772KB
-
memory/3056-131-0x00000000032A0000-0x0000000003398000-memory.dmpFilesize
992KB
-
memory/3420-127-0x0000000001150000-0x000000000144C000-memory.dmpFilesize
3.0MB
-
memory/3420-129-0x00000000053E0000-0x0000000005700000-memory.dmpFilesize
3.1MB
-
memory/3420-128-0x00000000010F0000-0x000000000111F000-memory.dmpFilesize
188KB
-
memory/3420-130-0x00000000050A0000-0x0000000005231000-memory.dmpFilesize
1.6MB