Analysis
-
max time kernel
156s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
11-05-2022 02:37
Static task
static1
Behavioral task
behavioral1
Sample
c9159ff175e40dca87117d9f48c89af5e096cc214b8af58da93db8cb4a75e7f4.exe
Resource
win7-20220414-en
General
-
Target
c9159ff175e40dca87117d9f48c89af5e096cc214b8af58da93db8cb4a75e7f4.exe
-
Size
415KB
-
MD5
bdb205f2b2250970a3feb5a621f8875b
-
SHA1
bae130111494303eb686a5562e794121a8cd307f
-
SHA256
c9159ff175e40dca87117d9f48c89af5e096cc214b8af58da93db8cb4a75e7f4
-
SHA512
97c41b5369b8902bde98059038774fea618d1071423104ef05c6c0c4fed4e28a28d028dd9dfb8c76f08d12e1256bacc13e3eb2625fe817b4c8a248cdb7d0384e
Malware Config
Extracted
formbook
4.1
bnc
iseoguide.com
rogerellisonline.com
thephonelenses.com
reddystone.com
explorehokianga.com
miaflcio.vote
baonihaochi.com
thewiseengineer.com
exciplexinc.com
luewaeeqaredre.com
atharvatechnologysolutions.com
vnsr1234.com
nationswines.com
toaglobalcc.com
texasbusrental.com
sailfishingcostarica.com
superbuy.today
mode-paradox.com
soperlz.xyz
filterdance.com
bllck.com
cocitas.com
hiflips.com
in-unicorn.com
panduitusa.com
pradamany.com
takingcheck.com
thinlinecreations.com
trendycollectionz.com
chantalrenaud.com
bundangsvc.com
stlouisoutdooradventures.com
patcapfinances.com
online-record.com
bangbangfactory.com
zzzttt10.com
jennishewardart.com
number1texasmedium.com
organichighqualityrush.com
ja6g.com
futureballet.com
siliconchips-synctoday.com
mesotherlioma.com
wzditai.com
chemcleandw.com
changhong433sj.com
k2night.com
londonvisas.com
luxuryfloatingflat.com
dgsazeh.com
graeciantiqui.net
finehairedgirls.com
comsweetrbx.com
pcnyyxo.icu
sevilce.com
omhwywwcxorl.com
top10mindset.com
cristinaiovu.com
fcpinnovacion.com
marcelopissardini.com
scorebuddycx.com
xn--lsuoa.net
mrchensauthenticchinese.com
jesse-mansfield.com
ccminghao.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1744-62-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1744-63-0x000000000041EB20-mapping.dmp formbook behavioral1/memory/1744-65-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1056-76-0x0000000000090000-0x00000000000BE000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
c9159ff175e40dca87117d9f48c89af5e096cc214b8af58da93db8cb4a75e7f4.exeRegSvcs.exemsiexec.exedescription pid process target process PID 1960 set thread context of 1744 1960 c9159ff175e40dca87117d9f48c89af5e096cc214b8af58da93db8cb4a75e7f4.exe RegSvcs.exe PID 1744 set thread context of 1420 1744 RegSvcs.exe Explorer.EXE PID 1744 set thread context of 1420 1744 RegSvcs.exe Explorer.EXE PID 1056 set thread context of 1420 1056 msiexec.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
RegSvcs.exemsiexec.exepid process 1744 RegSvcs.exe 1744 RegSvcs.exe 1744 RegSvcs.exe 1056 msiexec.exe 1056 msiexec.exe 1056 msiexec.exe 1056 msiexec.exe 1056 msiexec.exe 1056 msiexec.exe 1056 msiexec.exe 1056 msiexec.exe 1056 msiexec.exe 1056 msiexec.exe 1056 msiexec.exe 1056 msiexec.exe 1056 msiexec.exe 1056 msiexec.exe 1056 msiexec.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RegSvcs.exemsiexec.exepid process 1744 RegSvcs.exe 1744 RegSvcs.exe 1744 RegSvcs.exe 1744 RegSvcs.exe 1056 msiexec.exe 1056 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1744 RegSvcs.exe Token: SeDebugPrivilege 1056 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1420 Explorer.EXE 1420 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1420 Explorer.EXE 1420 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
c9159ff175e40dca87117d9f48c89af5e096cc214b8af58da93db8cb4a75e7f4.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1960 wrote to memory of 1744 1960 c9159ff175e40dca87117d9f48c89af5e096cc214b8af58da93db8cb4a75e7f4.exe RegSvcs.exe PID 1960 wrote to memory of 1744 1960 c9159ff175e40dca87117d9f48c89af5e096cc214b8af58da93db8cb4a75e7f4.exe RegSvcs.exe PID 1960 wrote to memory of 1744 1960 c9159ff175e40dca87117d9f48c89af5e096cc214b8af58da93db8cb4a75e7f4.exe RegSvcs.exe PID 1960 wrote to memory of 1744 1960 c9159ff175e40dca87117d9f48c89af5e096cc214b8af58da93db8cb4a75e7f4.exe RegSvcs.exe PID 1960 wrote to memory of 1744 1960 c9159ff175e40dca87117d9f48c89af5e096cc214b8af58da93db8cb4a75e7f4.exe RegSvcs.exe PID 1960 wrote to memory of 1744 1960 c9159ff175e40dca87117d9f48c89af5e096cc214b8af58da93db8cb4a75e7f4.exe RegSvcs.exe PID 1960 wrote to memory of 1744 1960 c9159ff175e40dca87117d9f48c89af5e096cc214b8af58da93db8cb4a75e7f4.exe RegSvcs.exe PID 1960 wrote to memory of 1744 1960 c9159ff175e40dca87117d9f48c89af5e096cc214b8af58da93db8cb4a75e7f4.exe RegSvcs.exe PID 1960 wrote to memory of 1744 1960 c9159ff175e40dca87117d9f48c89af5e096cc214b8af58da93db8cb4a75e7f4.exe RegSvcs.exe PID 1960 wrote to memory of 1744 1960 c9159ff175e40dca87117d9f48c89af5e096cc214b8af58da93db8cb4a75e7f4.exe RegSvcs.exe PID 1420 wrote to memory of 1056 1420 Explorer.EXE msiexec.exe PID 1420 wrote to memory of 1056 1420 Explorer.EXE msiexec.exe PID 1420 wrote to memory of 1056 1420 Explorer.EXE msiexec.exe PID 1420 wrote to memory of 1056 1420 Explorer.EXE msiexec.exe PID 1420 wrote to memory of 1056 1420 Explorer.EXE msiexec.exe PID 1420 wrote to memory of 1056 1420 Explorer.EXE msiexec.exe PID 1420 wrote to memory of 1056 1420 Explorer.EXE msiexec.exe PID 1056 wrote to memory of 1412 1056 msiexec.exe cmd.exe PID 1056 wrote to memory of 1412 1056 msiexec.exe cmd.exe PID 1056 wrote to memory of 1412 1056 msiexec.exe cmd.exe PID 1056 wrote to memory of 1412 1056 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c9159ff175e40dca87117d9f48c89af5e096cc214b8af58da93db8cb4a75e7f4.exe"C:\Users\Admin\AppData\Local\Temp\c9159ff175e40dca87117d9f48c89af5e096cc214b8af58da93db8cb4a75e7f4.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1056-78-0x0000000001FA0000-0x0000000002033000-memory.dmpFilesize
588KB
-
memory/1056-76-0x0000000000090000-0x00000000000BE000-memory.dmpFilesize
184KB
-
memory/1056-75-0x0000000002260000-0x0000000002563000-memory.dmpFilesize
3.0MB
-
memory/1056-74-0x0000000000950000-0x0000000000964000-memory.dmpFilesize
80KB
-
memory/1056-72-0x0000000000000000-mapping.dmp
-
memory/1412-77-0x0000000000000000-mapping.dmp
-
memory/1420-68-0x0000000004930000-0x0000000004A00000-memory.dmpFilesize
832KB
-
memory/1420-79-0x0000000007030000-0x0000000007198000-memory.dmpFilesize
1.4MB
-
memory/1420-71-0x0000000004AC0000-0x0000000004B87000-memory.dmpFilesize
796KB
-
memory/1744-59-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1744-66-0x00000000008F0000-0x0000000000BF3000-memory.dmpFilesize
3.0MB
-
memory/1744-67-0x00000000001F0000-0x0000000000204000-memory.dmpFilesize
80KB
-
memory/1744-65-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1744-70-0x0000000000350000-0x0000000000364000-memory.dmpFilesize
80KB
-
memory/1744-63-0x000000000041EB20-mapping.dmp
-
memory/1744-60-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1744-62-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1960-54-0x0000000000D50000-0x0000000000DBE000-memory.dmpFilesize
440KB
-
memory/1960-58-0x00000000004E0000-0x0000000000516000-memory.dmpFilesize
216KB
-
memory/1960-57-0x0000000002310000-0x0000000002366000-memory.dmpFilesize
344KB
-
memory/1960-56-0x0000000000250000-0x000000000025A000-memory.dmpFilesize
40KB
-
memory/1960-55-0x0000000076421000-0x0000000076423000-memory.dmpFilesize
8KB