Analysis
-
max time kernel
79s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
31-01-2022 12:20
Static task
static1
Behavioral task
behavioral1
Sample
9e50ed09439b4f2206f6cee1b233677c.exe
Resource
win7-en-20211208
General
-
Target
9e50ed09439b4f2206f6cee1b233677c.exe
-
Size
510KB
-
MD5
9e50ed09439b4f2206f6cee1b233677c
-
SHA1
719705903de481a3c680db18f8cef892efef3dc7
-
SHA256
b45a38f7012d02b12d3613d25450847d87c14c9b3207380594fc5e1f1b1728d9
-
SHA512
927789d6fca24317b1cc41825485cf06cf337204d8007b32220ef2fb28ee48275102a9148682336f76e7586e5ed714d1de2098c08886ea1b76007880a5c45d80
Malware Config
Extracted
formbook
4.1
bt33
mbaonlinefreedegress.info
myforevermaid.com
daoyi365.com
weientm.com
legal-mx.com
formationrigging.com
heidiet.xyz
school-prosto.store
healthvitaminnutrition.com
digitalsolutionusa.com
little-bazar.com
jnbeautycanada.com
optoelek.com
learntoairmail.com
hawkminer.com
kingofearth.love
ktnstay.xyz
zouxin.love
mainlandpr.com
mamm-hummel.com
planosdwgcad.com
dlscordapp.info
northfacecore.online
professionalswhotrade.com
vbcgrp.com
spares245.com
alphasignsatl.online
342731.com
amazingarizonaproperty.com
priorlakecarpetcleaning.com
boardwalksnj.com
shiinebydesign.com
dymends.digital
indie-shopper.com
weihiw.quest
dchehe.com
momshousegeorgia.com
bnvxnohpcuhxbcueuvl.biz
tinyspout.com
hambransupply.com
keywordjord.com
koebnertriangle.com
aodiskoo.com
zgqyjlhw.com
thule-usa.store
western-overseas.online
woofpack-adventures.com
tilallarehome.com
51easyprint.com
arucad.university
llanoseeds.com
3-v0.space
harsors.com
sumiyoshiku-tenisuhiji.xyz
alsafqah.com
wrxworld.net
evrefill.com
multicoopltda.com
ziggytherealtor.com
candidatbellomansour.info
bigpromo.club
evagrombook.com
lyni7lyo.xyz
ways.express
karasevda-jor.com
Signatures
-
Formbook Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1020-138-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Sets service image path in registry 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
9e50ed09439b4f2206f6cee1b233677c.exedescription pid process target process PID 916 set thread context of 1020 916 9e50ed09439b4f2206f6cee1b233677c.exe 9e50ed09439b4f2206f6cee1b233677c.exe -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
9e50ed09439b4f2206f6cee1b233677c.exe9e50ed09439b4f2206f6cee1b233677c.exepid process 916 9e50ed09439b4f2206f6cee1b233677c.exe 916 9e50ed09439b4f2206f6cee1b233677c.exe 1020 9e50ed09439b4f2206f6cee1b233677c.exe 1020 9e50ed09439b4f2206f6cee1b233677c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
9e50ed09439b4f2206f6cee1b233677c.exedescription pid process Token: SeDebugPrivilege 916 9e50ed09439b4f2206f6cee1b233677c.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
9e50ed09439b4f2206f6cee1b233677c.exedescription pid process target process PID 916 wrote to memory of 2100 916 9e50ed09439b4f2206f6cee1b233677c.exe 9e50ed09439b4f2206f6cee1b233677c.exe PID 916 wrote to memory of 2100 916 9e50ed09439b4f2206f6cee1b233677c.exe 9e50ed09439b4f2206f6cee1b233677c.exe PID 916 wrote to memory of 2100 916 9e50ed09439b4f2206f6cee1b233677c.exe 9e50ed09439b4f2206f6cee1b233677c.exe PID 916 wrote to memory of 1020 916 9e50ed09439b4f2206f6cee1b233677c.exe 9e50ed09439b4f2206f6cee1b233677c.exe PID 916 wrote to memory of 1020 916 9e50ed09439b4f2206f6cee1b233677c.exe 9e50ed09439b4f2206f6cee1b233677c.exe PID 916 wrote to memory of 1020 916 9e50ed09439b4f2206f6cee1b233677c.exe 9e50ed09439b4f2206f6cee1b233677c.exe PID 916 wrote to memory of 1020 916 9e50ed09439b4f2206f6cee1b233677c.exe 9e50ed09439b4f2206f6cee1b233677c.exe PID 916 wrote to memory of 1020 916 9e50ed09439b4f2206f6cee1b233677c.exe 9e50ed09439b4f2206f6cee1b233677c.exe PID 916 wrote to memory of 1020 916 9e50ed09439b4f2206f6cee1b233677c.exe 9e50ed09439b4f2206f6cee1b233677c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e50ed09439b4f2206f6cee1b233677c.exe"C:\Users\Admin\AppData\Local\Temp\9e50ed09439b4f2206f6cee1b233677c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9e50ed09439b4f2206f6cee1b233677c.exe"C:\Users\Admin\AppData\Local\Temp\9e50ed09439b4f2206f6cee1b233677c.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\9e50ed09439b4f2206f6cee1b233677c.exe"C:\Users\Admin\AppData\Local\Temp\9e50ed09439b4f2206f6cee1b233677c.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 0048a8bd3e55df3f36d8f69936799031 neWrerG0IkW2h9X5MLBNpw.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/916-133-0x0000000000C20000-0x0000000000CA6000-memory.dmpFilesize
536KB
-
memory/916-134-0x0000000005790000-0x0000000005791000-memory.dmpFilesize
4KB
-
memory/916-135-0x0000000005840000-0x00000000058D2000-memory.dmpFilesize
584KB
-
memory/916-136-0x0000000005B80000-0x0000000005C1C000-memory.dmpFilesize
624KB
-
memory/916-137-0x0000000006550000-0x0000000006AF4000-memory.dmpFilesize
5.6MB
-
memory/1020-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB