Analysis
-
max time kernel
148s -
max time network
139s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
31-01-2022 10:56
Static task
static1
Behavioral task
behavioral1
Sample
PO 0131.exe
Resource
win7-en-20211208
General
-
Target
PO 0131.exe
-
Size
601KB
-
MD5
eb437cbf64c34aebc51d6fd32ceec985
-
SHA1
2a1d8901240f6079da9c6978aabb658d55114d12
-
SHA256
3d4e25f876b2007b8b03a1d79109a52fcb5602644fb4554eb065f97853daa5de
-
SHA512
af5a6a5c4479ac2a5dc6988d8a283ff022914347159440bb8f292fa426253cb6eefe67809701eb4996de4f92a85e933003796669523cd99500f5337e547d9d38
Malware Config
Extracted
formbook
4.1
je16
antonavt.com
sdfvlog.xyz
xn--arbetslivsaktren-ywb.com
propelcolor.com
uniqueclsssiccars.com
colorbells.com
synjive.com
cloudymellows.com
walltage.com
qterps.com
kezorup.online
soakedindelight.online
thefirstgroupscam.biz
miclanka.com
mwm-security.com
trinksaifenradiodocumentary.com
spineklinik.com
javacodecafe.com
groovyrelease-toknowtoday.info
ventadesillasymesas.com
metaheaven.global
supershhhbros.com
tradecardsbtz.com
parcel-alert-redelivery.com
manoncollinet.com
yfsallegiance.com
my12127.com
connectedmk.com
m7ssucx.xyz
chefjeffrecipes.com
tgogziae.com
xu7d7mfh6fht.xyz
cdamanagementservices.com
tampanazareno.com
albanybestbuyers.com
cowboychannellpus.com
dreamyhousewife.com
wu8jvohkp12w.xyz
mohaisen.xyz
s-h-a-h.com
hainanmizhi.xyz
hypedrize.com
77hub.cloud
phxpowdercoating.com
vozeestore.com
infostate.store
woshinidie1990.com
riskfreeenergy.com
southernfreelancersph.com
smithstores.net
cryptopal.xyz
xk8abxci6ogf.xyz
explainersadvids.team
ponpesihsaniyah.com
szabossteakandseafood.com
willtuckfinancial.com
unitedwii.com
thenftlotterys.com
599qu.com
threegalasdesigns.com
bedplot.xyz
liquidministry.store
amazingfactsabouteverything.com
wofdex.com
wakilin.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/752-61-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/752-66-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1652-70-0x0000000000190000-0x00000000001BF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1152 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
PO 0131.exePO 0131.execscript.exedescription pid process target process PID 964 set thread context of 752 964 PO 0131.exe PO 0131.exe PID 752 set thread context of 1384 752 PO 0131.exe Explorer.EXE PID 752 set thread context of 1384 752 PO 0131.exe Explorer.EXE PID 1652 set thread context of 1384 1652 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
PO 0131.execscript.exepid process 752 PO 0131.exe 752 PO 0131.exe 752 PO 0131.exe 1652 cscript.exe 1652 cscript.exe 1652 cscript.exe 1652 cscript.exe 1652 cscript.exe 1652 cscript.exe 1652 cscript.exe 1652 cscript.exe 1652 cscript.exe 1652 cscript.exe 1652 cscript.exe 1652 cscript.exe 1652 cscript.exe 1652 cscript.exe 1652 cscript.exe 1652 cscript.exe 1652 cscript.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
PO 0131.execscript.exepid process 752 PO 0131.exe 752 PO 0131.exe 752 PO 0131.exe 752 PO 0131.exe 1652 cscript.exe 1652 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO 0131.execscript.exedescription pid process Token: SeDebugPrivilege 752 PO 0131.exe Token: SeDebugPrivilege 1652 cscript.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1384 Explorer.EXE 1384 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1384 Explorer.EXE 1384 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
PO 0131.exeExplorer.EXEcscript.exedescription pid process target process PID 964 wrote to memory of 752 964 PO 0131.exe PO 0131.exe PID 964 wrote to memory of 752 964 PO 0131.exe PO 0131.exe PID 964 wrote to memory of 752 964 PO 0131.exe PO 0131.exe PID 964 wrote to memory of 752 964 PO 0131.exe PO 0131.exe PID 964 wrote to memory of 752 964 PO 0131.exe PO 0131.exe PID 964 wrote to memory of 752 964 PO 0131.exe PO 0131.exe PID 964 wrote to memory of 752 964 PO 0131.exe PO 0131.exe PID 1384 wrote to memory of 1652 1384 Explorer.EXE cscript.exe PID 1384 wrote to memory of 1652 1384 Explorer.EXE cscript.exe PID 1384 wrote to memory of 1652 1384 Explorer.EXE cscript.exe PID 1384 wrote to memory of 1652 1384 Explorer.EXE cscript.exe PID 1652 wrote to memory of 1152 1652 cscript.exe cmd.exe PID 1652 wrote to memory of 1152 1652 cscript.exe cmd.exe PID 1652 wrote to memory of 1152 1652 cscript.exe cmd.exe PID 1652 wrote to memory of 1152 1652 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO 0131.exe"C:\Users\Admin\AppData\Local\Temp\PO 0131.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO 0131.exe"C:\Users\Admin\AppData\Local\Temp\PO 0131.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO 0131.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/752-67-0x00000000001D0000-0x00000000001E4000-memory.dmpFilesize
80KB
-
memory/752-63-0x0000000000870000-0x0000000000E03000-memory.dmpFilesize
5.6MB
-
memory/752-59-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/752-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/752-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/752-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/752-64-0x0000000000180000-0x0000000000194000-memory.dmpFilesize
80KB
-
memory/964-54-0x0000000000A60000-0x0000000000AFC000-memory.dmpFilesize
624KB
-
memory/964-57-0x0000000000450000-0x00000000004C1000-memory.dmpFilesize
452KB
-
memory/964-58-0x0000000004CB0000-0x0000000004D16000-memory.dmpFilesize
408KB
-
memory/964-56-0x0000000000760000-0x0000000000774000-memory.dmpFilesize
80KB
-
memory/964-55-0x0000000075601000-0x0000000075603000-memory.dmpFilesize
8KB
-
memory/1384-73-0x0000000004730000-0x000000000484E000-memory.dmpFilesize
1.1MB
-
memory/1384-68-0x0000000007050000-0x00000000071BF000-memory.dmpFilesize
1.4MB
-
memory/1384-65-0x0000000006940000-0x0000000006AC5000-memory.dmpFilesize
1.5MB
-
memory/1652-69-0x0000000000800000-0x0000000000822000-memory.dmpFilesize
136KB
-
memory/1652-70-0x0000000000190000-0x00000000001BF000-memory.dmpFilesize
188KB
-
memory/1652-71-0x0000000002090000-0x0000000002393000-memory.dmpFilesize
3.0MB
-
memory/1652-72-0x0000000001DC0000-0x0000000001E53000-memory.dmpFilesize
588KB