Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
16-05-2022 18:49
Static task
static1
Behavioral task
behavioral1
Sample
2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe
Resource
win7-20220414-en
General
-
Target
2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe
-
Size
737KB
-
MD5
38694cf4cf60fc8408f11b40e2e62338
-
SHA1
e42b57f70784715d37794ec05cc0da6ff356345c
-
SHA256
2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a
-
SHA512
fdb9cc5ff5a872bc9f383d06582a726652b4a2ce491bc1482bcf6e1808950835d57144061ee68b73a917db660f8aaaa381d4e6dc1657e69e5dca4d32d7648657
Malware Config
Extracted
formbook
4.1
bnc
iseoguide.com
rogerellisonline.com
thephonelenses.com
reddystone.com
explorehokianga.com
miaflcio.vote
baonihaochi.com
thewiseengineer.com
exciplexinc.com
luewaeeqaredre.com
atharvatechnologysolutions.com
vnsr1234.com
nationswines.com
toaglobalcc.com
texasbusrental.com
sailfishingcostarica.com
superbuy.today
mode-paradox.com
soperlz.xyz
filterdance.com
bllck.com
cocitas.com
hiflips.com
in-unicorn.com
panduitusa.com
pradamany.com
takingcheck.com
thinlinecreations.com
trendycollectionz.com
chantalrenaud.com
bundangsvc.com
stlouisoutdooradventures.com
patcapfinances.com
online-record.com
bangbangfactory.com
zzzttt10.com
jennishewardart.com
number1texasmedium.com
organichighqualityrush.com
ja6g.com
futureballet.com
siliconchips-synctoday.com
mesotherlioma.com
wzditai.com
chemcleandw.com
changhong433sj.com
k2night.com
londonvisas.com
luxuryfloatingflat.com
dgsazeh.com
graeciantiqui.net
finehairedgirls.com
comsweetrbx.com
pcnyyxo.icu
sevilce.com
omhwywwcxorl.com
top10mindset.com
cristinaiovu.com
fcpinnovacion.com
marcelopissardini.com
scorebuddycx.com
xn--lsuoa.net
mrchensauthenticchinese.com
jesse-mansfield.com
ccminghao.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1500-138-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/1804-145-0x0000000000A80000-0x0000000000AAE000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exeRegSvcs.exechkdsk.exedescription pid process target process PID 1308 set thread context of 1500 1308 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe RegSvcs.exe PID 1500 set thread context of 2628 1500 RegSvcs.exe Explorer.EXE PID 1804 set thread context of 2628 1804 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exeRegSvcs.exechkdsk.exepid process 1308 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe 1308 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe 1308 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe 1308 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe 1308 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe 1308 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe 1500 RegSvcs.exe 1500 RegSvcs.exe 1500 RegSvcs.exe 1500 RegSvcs.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe 1804 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2628 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exechkdsk.exepid process 1500 RegSvcs.exe 1500 RegSvcs.exe 1500 RegSvcs.exe 1804 chkdsk.exe 1804 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exeRegSvcs.exechkdsk.exedescription pid process Token: SeDebugPrivilege 1308 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe Token: SeDebugPrivilege 1500 RegSvcs.exe Token: SeDebugPrivilege 1804 chkdsk.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1308 wrote to memory of 3020 1308 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe RegSvcs.exe PID 1308 wrote to memory of 3020 1308 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe RegSvcs.exe PID 1308 wrote to memory of 3020 1308 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe RegSvcs.exe PID 1308 wrote to memory of 1500 1308 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe RegSvcs.exe PID 1308 wrote to memory of 1500 1308 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe RegSvcs.exe PID 1308 wrote to memory of 1500 1308 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe RegSvcs.exe PID 1308 wrote to memory of 1500 1308 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe RegSvcs.exe PID 1308 wrote to memory of 1500 1308 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe RegSvcs.exe PID 1308 wrote to memory of 1500 1308 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe RegSvcs.exe PID 2628 wrote to memory of 1804 2628 Explorer.EXE chkdsk.exe PID 2628 wrote to memory of 1804 2628 Explorer.EXE chkdsk.exe PID 2628 wrote to memory of 1804 2628 Explorer.EXE chkdsk.exe PID 1804 wrote to memory of 636 1804 chkdsk.exe cmd.exe PID 1804 wrote to memory of 636 1804 chkdsk.exe cmd.exe PID 1804 wrote to memory of 636 1804 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe"C:\Users\Admin\AppData\Local\Temp\2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/636-147-0x0000000000000000-mapping.dmp
-
memory/1308-130-0x0000000000FA0000-0x0000000001060000-memory.dmpFilesize
768KB
-
memory/1308-131-0x0000000005E20000-0x0000000005EBC000-memory.dmpFilesize
624KB
-
memory/1308-132-0x0000000006470000-0x0000000006A14000-memory.dmpFilesize
5.6MB
-
memory/1308-133-0x0000000005EC0000-0x0000000005F52000-memory.dmpFilesize
584KB
-
memory/1308-134-0x0000000005DA0000-0x0000000005DAA000-memory.dmpFilesize
40KB
-
memory/1308-135-0x0000000006070000-0x00000000060C6000-memory.dmpFilesize
344KB
-
memory/1500-138-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1500-137-0x0000000000000000-mapping.dmp
-
memory/1500-140-0x0000000000EB0000-0x00000000011FA000-memory.dmpFilesize
3.3MB
-
memory/1500-141-0x0000000000E40000-0x0000000000E54000-memory.dmpFilesize
80KB
-
memory/1804-143-0x0000000000000000-mapping.dmp
-
memory/1804-145-0x0000000000A80000-0x0000000000AAE000-memory.dmpFilesize
184KB
-
memory/1804-144-0x00000000007A0000-0x00000000007AA000-memory.dmpFilesize
40KB
-
memory/1804-146-0x00000000011D0000-0x000000000151A000-memory.dmpFilesize
3.3MB
-
memory/1804-148-0x0000000001010000-0x00000000010A3000-memory.dmpFilesize
588KB
-
memory/2628-142-0x00000000032E0000-0x0000000003412000-memory.dmpFilesize
1.2MB
-
memory/2628-149-0x00000000035A0000-0x000000000368E000-memory.dmpFilesize
952KB
-
memory/3020-136-0x0000000000000000-mapping.dmp