Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
04-03-2022 16:53
Static task
static1
Behavioral task
behavioral1
Sample
Epludok.exe
Resource
win7-20220223-en
General
-
Target
Epludok.exe
-
Size
760KB
-
MD5
44d3e3a2192ac3389703aa8dd76cc2a4
-
SHA1
c804473e0d109785e6684190406657322e14b79b
-
SHA256
4f227641cdcdea06d222012087bfc21a3eb4bf62ffaac2990e2f01bf0ec62809
-
SHA512
ba31417ea20644ab29a62723db058ef2a3f3f2ddc340b69505e73beed1b2c26234ffd3175f1b70882e95b072523747ffad0daeb4c34eb3400df99e09d8910f3f
Malware Config
Extracted
formbook
4.1
3nop
videohm.com
panache-rose.com
alnooncars-kw.com
trueblue2u.com
brussels-cafe.com
ip2c.net
influenzerr.com
rbcoq.com
zzful.com
drainthe.com
sumaholesson.com
cursosaprovados.com
genotecinc.com
dbrulhart.com
theapiarystudios.com
kensyu-kan.com
dkku88.com
tikhyper.com
aztecnort.com
homebrim.com
infinitilamp.com
leelegantflower.com
floor-space.investments
vidasustentavel.online
wholehearteddaughters.com
vipandeep.com
mdwovzrrm.icu
592215.com
academicplumbing.com
bestveganbook.com
theservantleader.com
nazarickdeveloper.xyz
delta-wing.com
girlfriendsgarb.com
sezyz11.com
ca3construction.com
smartswitchhomeloan.net
luckytwo.agency
ministry-of-barbers.com
babbageacademy.com
informationside.com
packapp.net
spacecoasthondaevent.com
thehealthyimmunereset.com
pjcavaliere.info
trebdurham.com
zhixintonghe.com
gon2580.com
dottproject.net
snakby.com
keeponsports.com
debbiewilsondesigns.com
stagingsolutionsgroup.com
forummondialdelamerbizerte.com
garnier.red
tempestchs.com
zpxinxi.com
jam-nins.com
inclusiocg.com
msmenders.com
whachupichu.com
pursemore.com
thebusinessfitclub.com
scootgotti.com
jakesplacebarbers.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2992-139-0x0000000072480000-0x00000000724AE000-memory.dmp formbook behavioral2/memory/4404-159-0x0000000000F10000-0x0000000000F3E000-memory.dmp formbook -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Epludok.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Epludok = "C:\\Users\\Public\\kodulpE.url" Epludok.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
logagent.exeNETSTAT.EXEdescription pid process target process PID 2992 set thread context of 2488 2992 logagent.exe Explorer.EXE PID 4404 set thread context of 2488 4404 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 4404 NETSTAT.EXE -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
logagent.exepowershell.exeNETSTAT.EXEpid process 2992 logagent.exe 2992 logagent.exe 2992 logagent.exe 2992 logagent.exe 3644 powershell.exe 3644 powershell.exe 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE 4404 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2488 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
logagent.exeNETSTAT.EXEpid process 2992 logagent.exe 2992 logagent.exe 2992 logagent.exe 4404 NETSTAT.EXE 4404 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
logagent.exepowershell.exeExplorer.EXENETSTAT.EXEdescription pid process Token: SeDebugPrivilege 2992 logagent.exe Token: SeDebugPrivilege 3644 powershell.exe Token: SeShutdownPrivilege 2488 Explorer.EXE Token: SeCreatePagefilePrivilege 2488 Explorer.EXE Token: SeDebugPrivilege 4404 NETSTAT.EXE Token: SeShutdownPrivilege 2488 Explorer.EXE Token: SeCreatePagefilePrivilege 2488 Explorer.EXE Token: SeShutdownPrivilege 2488 Explorer.EXE Token: SeCreatePagefilePrivilege 2488 Explorer.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
Epludok.execmd.execmd.exenet.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 3816 wrote to memory of 2992 3816 Epludok.exe logagent.exe PID 3816 wrote to memory of 2992 3816 Epludok.exe logagent.exe PID 3816 wrote to memory of 2992 3816 Epludok.exe logagent.exe PID 3816 wrote to memory of 2992 3816 Epludok.exe logagent.exe PID 3816 wrote to memory of 2992 3816 Epludok.exe logagent.exe PID 3816 wrote to memory of 2992 3816 Epludok.exe logagent.exe PID 3816 wrote to memory of 2132 3816 Epludok.exe cmd.exe PID 3816 wrote to memory of 2132 3816 Epludok.exe cmd.exe PID 3816 wrote to memory of 2132 3816 Epludok.exe cmd.exe PID 2132 wrote to memory of 3016 2132 cmd.exe cmd.exe PID 2132 wrote to memory of 3016 2132 cmd.exe cmd.exe PID 2132 wrote to memory of 3016 2132 cmd.exe cmd.exe PID 3016 wrote to memory of 3364 3016 cmd.exe net.exe PID 3016 wrote to memory of 3364 3016 cmd.exe net.exe PID 3016 wrote to memory of 3364 3016 cmd.exe net.exe PID 3364 wrote to memory of 3584 3364 net.exe net1.exe PID 3364 wrote to memory of 3584 3364 net.exe net1.exe PID 3364 wrote to memory of 3584 3364 net.exe net1.exe PID 3016 wrote to memory of 3644 3016 cmd.exe powershell.exe PID 3016 wrote to memory of 3644 3016 cmd.exe powershell.exe PID 3016 wrote to memory of 3644 3016 cmd.exe powershell.exe PID 2488 wrote to memory of 4404 2488 Explorer.EXE NETSTAT.EXE PID 2488 wrote to memory of 4404 2488 Explorer.EXE NETSTAT.EXE PID 2488 wrote to memory of 4404 2488 Explorer.EXE NETSTAT.EXE PID 4404 wrote to memory of 4756 4404 NETSTAT.EXE cmd.exe PID 4404 wrote to memory of 4756 4404 NETSTAT.EXE cmd.exe PID 4404 wrote to memory of 4756 4404 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Epludok.exe"C:\Users\Admin\AppData\Local\Temp\Epludok.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Epludokt.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Public\EpludokO.bat4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet session5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 session6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\logagent.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Cdex.batMD5
213c60adf1c9ef88dc3c9b2d579959d2
SHA1e4d2ad7b22b1a8b5b1f7a702b303c7364b0ee021
SHA25637c59c8398279916cfce45f8c5e3431058248f5e3bef4d9f5c0f44a7d564f82e
SHA512fe897d9caa306b0e761b2fd61bb5dc32a53bfaad1ce767c6860af4e3ad59c8f3257228a6e1072dab0f990cb51c59c648084ba419ac6bc5c0a99bdffa569217b7
-
C:\Users\Public\EpludokO.batMD5
df48c09f243ebcc8a165f77a1c2bf889
SHA1455f7db0adcc2a58d006f1630fb0bd55cd868c07
SHA2564ef9821678da07138c19405387f3fb95e409fbd461c7b8d847c05075facd63ca
SHA512735838c7cca953697ded48adfcd037b7f198072a8962f5940ce12e1bb1c7dd8c1f257a829276f5f5456f776f5bd13342222dd6e0dfc8f18a23f464f2c8d8f1cc
-
C:\Users\Public\Epludokt.batMD5
f229d960a7904ac2ec6065f25ca9333b
SHA17702e067ec3edc567bb29f8da56723d2740f9939
SHA25675bc1cd2ea27a701ff672aa9d3f28630bc079c8df41ba17ea9331c55261b3c25
SHA5123d980b3d7153385acda0732e9eda29f34aeb4105415d8effb3f4fbd5309828d511bb22d8c406a3375586391cf6a4bfd0d25964f755918c1bf91959c03ec38b84
-
memory/2488-170-0x0000000008CB0000-0x0000000008E24000-memory.dmpFilesize
1.5MB
-
memory/2488-152-0x00000000089F0000-0x0000000008AFC000-memory.dmpFilesize
1.0MB
-
memory/2992-147-0x00000000031F0000-0x000000000353A000-memory.dmpFilesize
3.3MB
-
memory/2992-139-0x0000000072480000-0x00000000724AE000-memory.dmpFilesize
184KB
-
memory/2992-138-0x0000000000F80000-0x0000000000F81000-memory.dmpFilesize
4KB
-
memory/2992-151-0x0000000001820000-0x0000000001834000-memory.dmpFilesize
80KB
-
memory/2992-150-0x000000007249E000-0x000000007249F000-memory.dmpFilesize
4KB
-
memory/3644-141-0x0000000005060000-0x0000000005688000-memory.dmpFilesize
6.2MB
-
memory/3644-162-0x00000000077A0000-0x0000000007E1A000-memory.dmpFilesize
6.5MB
-
memory/3644-144-0x0000000005700000-0x0000000005766000-memory.dmpFilesize
408KB
-
memory/3644-143-0x0000000004F30000-0x0000000004F52000-memory.dmpFilesize
136KB
-
memory/3644-146-0x0000000005770000-0x00000000057D6000-memory.dmpFilesize
408KB
-
memory/3644-148-0x0000000004A20000-0x0000000004A21000-memory.dmpFilesize
4KB
-
memory/3644-149-0x0000000004A22000-0x0000000004A23000-memory.dmpFilesize
4KB
-
memory/3644-168-0x0000000007400000-0x0000000007408000-memory.dmpFilesize
32KB
-
memory/3644-140-0x0000000004950000-0x0000000004986000-memory.dmpFilesize
216KB
-
memory/3644-167-0x0000000007420000-0x000000000743A000-memory.dmpFilesize
104KB
-
memory/3644-153-0x0000000005E00000-0x0000000005E1E000-memory.dmpFilesize
120KB
-
memory/3644-154-0x0000000006390000-0x00000000063C2000-memory.dmpFilesize
200KB
-
memory/3644-155-0x000000006F450000-0x000000006F49C000-memory.dmpFilesize
304KB
-
memory/3644-156-0x0000000006350000-0x000000000636E000-memory.dmpFilesize
120KB
-
memory/3644-166-0x0000000007310000-0x000000000731E000-memory.dmpFilesize
56KB
-
memory/3644-165-0x0000000007350000-0x00000000073E6000-memory.dmpFilesize
600KB
-
memory/3644-160-0x000000007F420000-0x000000007F421000-memory.dmpFilesize
4KB
-
memory/3644-157-0x0000000004A25000-0x0000000004A27000-memory.dmpFilesize
8KB
-
memory/3644-164-0x0000000007160000-0x000000000716A000-memory.dmpFilesize
40KB
-
memory/3644-145-0x0000000072AA0000-0x0000000073250000-memory.dmpFilesize
7.7MB
-
memory/3644-163-0x0000000007020000-0x000000000703A000-memory.dmpFilesize
104KB
-
memory/3816-137-0x0000000003926000-0x0000000003927000-memory.dmpFilesize
4KB
-
memory/3816-131-0x00000000006C0000-0x00000000006C1000-memory.dmpFilesize
4KB
-
memory/3816-132-0x0000000000400000-0x00000000004C4000-memory.dmpFilesize
784KB
-
memory/4404-161-0x0000000001930000-0x0000000001C7A000-memory.dmpFilesize
3.3MB
-
memory/4404-159-0x0000000000F10000-0x0000000000F3E000-memory.dmpFilesize
184KB
-
memory/4404-158-0x0000000000020000-0x000000000002B000-memory.dmpFilesize
44KB
-
memory/4404-169-0x00000000016A0000-0x0000000001733000-memory.dmpFilesize
588KB