Analysis
-
max time kernel
148s -
max time network
173s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 01:58
Static task
static1
Behavioral task
behavioral1
Sample
Payment transfer.exe
Resource
win7-20220414-en
General
-
Target
Payment transfer.exe
-
Size
317KB
-
MD5
96106d8d331a6f9c135c1f81bb82d9fe
-
SHA1
7e59ba122d299460504be159a862faeaf2f80491
-
SHA256
293f8c9b635a869a00e4f0d275c8a3e8f358242e4813e443282cbc5ceb8f099d
-
SHA512
87309e2ed58c1d5b257a73abb1332c0faf36c98972840487b2388d7dd96ed1805d06bcafd831f36c980b1fd1283ff54636f885eaa9e4797fb7d19387144af4d3
Malware Config
Extracted
formbook
3.9
rmj
arksarto.com
immigrationlawyersanjose.com
o60q2.com
my-mind-impulse.com
tenkai.info
southgeorgiaroofs.com
seo.ltd
joinpznow.today
acow.ltd
psychologue-paysdegex.com
ameenuzpg.com
iddua.com
jsfvat.info
fatalsdetale.online
91javac.com
racheldinwiddie.com
kedipvps.com
kinmeginme.com
greatarmor.com
golden.solar
exiomsystems.com
irancustomer.com
ultimate-detailing.com
fievuc.men
sukiengamelienquan.com
accofrance.com
bobbyblvxq.com
drkathleenvaeth.com
netmarketingtrade.com
katilimevimsikayet.com
peninsulapointproperties.com
yeniofisim.com
cell-technologie.com
hxzszks.com
natuliquepr.com
gresla.info
ckdpj.info
5icfashoes.com
porqueempreender.com
chache0.com
portsmouthresindriveways.com
theamericanfoundingpodcast.com
smartcityaltert.com
xumumenhu.com
nowledge.academy
ncctdn.loan
splashofreality.com
de-wolshop.com
savvyscope.com
yoprcorp.com
craft-adept.men
presidentialrxnorthcarolina.com
gzff56.com
jinyanjie.com
aixin-sh.com
greatsalesontheweb.com
karneshomegoods.com
erimiii.com
belasereyesurgeryone.live
bestdamncakes.com
digitpetsitting.com
homesforsaleincentralfla.com
rentalcarscroatia.com
mailandsend.com
salomdy.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1104-59-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/1104-60-0x000000000041B710-mapping.dmp formbook behavioral1/memory/1004-68-0x0000000000080000-0x00000000000AA000-memory.dmp formbook -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Payment transfer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Payment transfer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Payment transfer.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 440 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
netsh.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run netsh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\T4XDCX58GPG = "C:\\Program Files (x86)\\Clf_tq41\\gdi9rex.exe" netsh.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Payment transfer.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Payment transfer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 Payment transfer.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Payment transfer.exePayment transfer.exenetsh.exedescription pid process target process PID 1676 set thread context of 1104 1676 Payment transfer.exe Payment transfer.exe PID 1104 set thread context of 1264 1104 Payment transfer.exe Explorer.EXE PID 1004 set thread context of 1264 1004 netsh.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
netsh.exedescription ioc process File opened for modification C:\Program Files (x86)\Clf_tq41\gdi9rex.exe netsh.exe -
Processes:
netsh.exedescription ioc process Key created \Registry\User\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 netsh.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
Payment transfer.exenetsh.exepid process 1104 Payment transfer.exe 1104 Payment transfer.exe 1004 netsh.exe 1004 netsh.exe 1004 netsh.exe 1004 netsh.exe 1004 netsh.exe 1004 netsh.exe 1004 netsh.exe 1004 netsh.exe 1004 netsh.exe 1004 netsh.exe 1004 netsh.exe 1004 netsh.exe 1004 netsh.exe 1004 netsh.exe 1004 netsh.exe 1004 netsh.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Payment transfer.exenetsh.exepid process 1104 Payment transfer.exe 1104 Payment transfer.exe 1104 Payment transfer.exe 1004 netsh.exe 1004 netsh.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Payment transfer.exePayment transfer.exenetsh.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1676 Payment transfer.exe Token: SeDebugPrivilege 1104 Payment transfer.exe Token: SeDebugPrivilege 1004 netsh.exe Token: SeShutdownPrivilege 1264 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Payment transfer.exeExplorer.EXEnetsh.exedescription pid process target process PID 1676 wrote to memory of 1104 1676 Payment transfer.exe Payment transfer.exe PID 1676 wrote to memory of 1104 1676 Payment transfer.exe Payment transfer.exe PID 1676 wrote to memory of 1104 1676 Payment transfer.exe Payment transfer.exe PID 1676 wrote to memory of 1104 1676 Payment transfer.exe Payment transfer.exe PID 1676 wrote to memory of 1104 1676 Payment transfer.exe Payment transfer.exe PID 1676 wrote to memory of 1104 1676 Payment transfer.exe Payment transfer.exe PID 1676 wrote to memory of 1104 1676 Payment transfer.exe Payment transfer.exe PID 1264 wrote to memory of 1004 1264 Explorer.EXE netsh.exe PID 1264 wrote to memory of 1004 1264 Explorer.EXE netsh.exe PID 1264 wrote to memory of 1004 1264 Explorer.EXE netsh.exe PID 1264 wrote to memory of 1004 1264 Explorer.EXE netsh.exe PID 1004 wrote to memory of 440 1004 netsh.exe cmd.exe PID 1004 wrote to memory of 440 1004 netsh.exe cmd.exe PID 1004 wrote to memory of 440 1004 netsh.exe cmd.exe PID 1004 wrote to memory of 440 1004 netsh.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment transfer.exe"C:\Users\Admin\AppData\Local\Temp\Payment transfer.exe"2⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment transfer.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Payment transfer.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\890309VS\890logim.jpegFilesize
49KB
MD596b6887edc2b63cbdcf89db59501f268
SHA10a7d50ca3e77762b23a0e360d6af6239b2dacd30
SHA25699d84b74837c4c28b453022220c07294881866c5490a68d8e85014528e428780
SHA512a9ad8840670014e6b68e63e81ec254a0c6d63d04db7098de350ca005bf1d0eb04a2ff48531735dd68690406ca724737200ab9c25166f1cc49719fd2967aef329
-
C:\Users\Admin\AppData\Roaming\890309VS\890logri.iniFilesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\890309VS\890logrv.iniFilesize
40B
MD5ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf
-
memory/440-66-0x0000000000000000-mapping.dmp
-
memory/1004-65-0x0000000000000000-mapping.dmp
-
memory/1004-70-0x0000000000970000-0x0000000000A03000-memory.dmpFilesize
588KB
-
memory/1004-69-0x0000000000C40000-0x0000000000F43000-memory.dmpFilesize
3.0MB
-
memory/1004-68-0x0000000000080000-0x00000000000AA000-memory.dmpFilesize
168KB
-
memory/1004-67-0x0000000001430000-0x000000000144B000-memory.dmpFilesize
108KB
-
memory/1104-59-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1104-63-0x0000000000190000-0x00000000001A4000-memory.dmpFilesize
80KB
-
memory/1104-62-0x0000000000770000-0x0000000000A73000-memory.dmpFilesize
3.0MB
-
memory/1104-60-0x000000000041B710-mapping.dmp
-
memory/1104-56-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1104-57-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1264-64-0x0000000004FE0000-0x000000000511D000-memory.dmpFilesize
1.2MB
-
memory/1264-71-0x0000000004D50000-0x0000000004E2F000-memory.dmpFilesize
892KB
-
memory/1676-54-0x0000000075761000-0x0000000075763000-memory.dmpFilesize
8KB
-
memory/1676-55-0x0000000074B40000-0x00000000750EB000-memory.dmpFilesize
5.7MB