Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 10:53
Static task
static1
Behavioral task
behavioral1
Sample
R220917549.exe
Resource
win7-20220414-en
General
-
Target
R220917549.exe
-
Size
923KB
-
MD5
65e707bd6d53922eed2f27b35bd5355a
-
SHA1
8e2cb2687357567045584ed5cb36c11cc928f4a4
-
SHA256
ca2474c82643817c50106479f991ae282b9bb24fde98721dc5f99fe9a5eb3300
-
SHA512
606f8a9fab4b19fc43ed233f62fcefc3758e1e8fd6358b9fecbd8a3e3a43027ddded905ad2fc185eec7c3e14c1ad563ce007cb35f61797846807757b2ac1447a
Malware Config
Extracted
formbook
3.9
crt
breyononline.com
bruczko.com
5150pe.com
baltonol.com
turlkeybellflowers.com
redoxparcaitalyopposites.win
greenbox.store
aftoes.com
balipotret.com
wolfgate.pictures
330121.com
artofreggae.com
sharing-hands.info
qqdada.com
amzbeast.com
qingtaitalk.com
eldridgebrook.com
yuanyuanjuan.com
cincysteamspecialist.com
kentputtingacademy.com
woodlawnsportscomplex.com
wemissyounikki.com
small-batch.coffee
xtaac.info
komaguru.com
tinaroolakesresort.com
heiss-auf-karotte.com
keyporttelevision.com
romakidstours.com
mileneko.com
mushangec.com
accolaparkserpong.com
louzanboutique.com
thetrailshed.com
domicil24.com
wvoaradio.net
deliverables.online
wwwwnsr5544.com
dentassistant.com
midnighttalesfromthebluff.city
fyitaunton.net
iyan4life.com
shmla.com
hhzlian.com
enlivenonline.com
iktel.com
cayyoluhaliyikamaci.com
frozcrypt.com
kilianschrenk.com
marksclips.com
cassandraandnick.com
djservices.info
kendyllmaddisyn.com
stockniu.com
cryptonewsdepot.com
ho1acloud.com
franklindui.lawyer
karengkaufman.com
hfhymm.com
logods.com
losangelesphotographer.net
daocookie.com
docupeer.com
luwih.com
godhep.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/996-62-0x0000000000080000-0x00000000000AA000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1396 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
cmmon32.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run cmmon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NPE0P08HAN = "C:\\Program Files (x86)\\Jyvntivh0\\audiodgdngl.exe" cmmon32.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
R220917549.exeR220917549.execmmon32.exedescription pid process target process PID 1668 set thread context of 1984 1668 R220917549.exe R220917549.exe PID 1984 set thread context of 1260 1984 R220917549.exe Explorer.EXE PID 996 set thread context of 1260 996 cmmon32.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
cmmon32.exedescription ioc process File opened for modification C:\Program Files (x86)\Jyvntivh0\audiodgdngl.exe cmmon32.exe -
Processes:
cmmon32.exedescription ioc process Key created \Registry\User\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmmon32.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
R220917549.exeR220917549.execmmon32.exepid process 1668 R220917549.exe 1984 R220917549.exe 1984 R220917549.exe 996 cmmon32.exe 996 cmmon32.exe 996 cmmon32.exe 996 cmmon32.exe 996 cmmon32.exe 996 cmmon32.exe 996 cmmon32.exe 996 cmmon32.exe 996 cmmon32.exe 996 cmmon32.exe 996 cmmon32.exe 996 cmmon32.exe 996 cmmon32.exe 996 cmmon32.exe 996 cmmon32.exe 996 cmmon32.exe 996 cmmon32.exe 996 cmmon32.exe 996 cmmon32.exe 996 cmmon32.exe 996 cmmon32.exe 996 cmmon32.exe 996 cmmon32.exe 996 cmmon32.exe 996 cmmon32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
R220917549.exeR220917549.execmmon32.exepid process 1668 R220917549.exe 1984 R220917549.exe 1984 R220917549.exe 1984 R220917549.exe 996 cmmon32.exe 996 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
R220917549.execmmon32.exedescription pid process Token: SeDebugPrivilege 1984 R220917549.exe Token: SeDebugPrivilege 996 cmmon32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
R220917549.exeExplorer.EXEcmmon32.exedescription pid process target process PID 1668 wrote to memory of 1984 1668 R220917549.exe R220917549.exe PID 1668 wrote to memory of 1984 1668 R220917549.exe R220917549.exe PID 1668 wrote to memory of 1984 1668 R220917549.exe R220917549.exe PID 1668 wrote to memory of 1984 1668 R220917549.exe R220917549.exe PID 1260 wrote to memory of 996 1260 Explorer.EXE cmmon32.exe PID 1260 wrote to memory of 996 1260 Explorer.EXE cmmon32.exe PID 1260 wrote to memory of 996 1260 Explorer.EXE cmmon32.exe PID 1260 wrote to memory of 996 1260 Explorer.EXE cmmon32.exe PID 996 wrote to memory of 1396 996 cmmon32.exe cmd.exe PID 996 wrote to memory of 1396 996 cmmon32.exe cmd.exe PID 996 wrote to memory of 1396 996 cmmon32.exe cmd.exe PID 996 wrote to memory of 1396 996 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\R220917549.exe"C:\Users\Admin\AppData\Local\Temp\R220917549.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\R220917549.exe"C:\Users\Admin\AppData\Local\Temp\R220917549.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1984 -
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\R220917549.exe"3⤵
- Deletes itself
PID:1396
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\24AO8R8R\24Alogim.jpegFilesize
63KB
MD510bc46b124b61706b46e8372f56be4fa
SHA105a0ac2d16ebf110bbd5ada380b965362c5df180
SHA2569c5bc779bdefd69179e3f6525259e171d9b19956471e3375be4be90d52dc9ff5
SHA51272fb6b140770121131523781d046ded6bf63f59fffb159c3a15856d837866b16554feccbe70181e601aa039a028f96a1996959c8e7df9c7d9f3a723b03c1081d
-
C:\Users\Admin\AppData\Roaming\24AO8R8R\24Alogri.iniFilesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\24AO8R8R\24Alogrv.iniFilesize
40B
MD5ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf
-
memory/996-62-0x0000000000080000-0x00000000000AA000-memory.dmpFilesize
168KB
-
memory/996-65-0x0000000001E20000-0x0000000001EB3000-memory.dmpFilesize
588KB
-
memory/996-64-0x0000000001EC0000-0x00000000021C3000-memory.dmpFilesize
3.0MB
-
memory/996-60-0x0000000000000000-mapping.dmp
-
memory/996-61-0x0000000000300000-0x000000000030D000-memory.dmpFilesize
52KB
-
memory/1260-66-0x0000000006C30000-0x0000000006D58000-memory.dmpFilesize
1.2MB
-
memory/1260-59-0x0000000006AE0000-0x0000000006C23000-memory.dmpFilesize
1.3MB
-
memory/1396-63-0x0000000000000000-mapping.dmp
-
memory/1668-54-0x0000000075BF1000-0x0000000075BF3000-memory.dmpFilesize
8KB
-
memory/1668-56-0x0000000000400000-0x00000000004ED000-memory.dmpFilesize
948KB
-
memory/1984-58-0x0000000000580000-0x0000000000594000-memory.dmpFilesize
80KB
-
memory/1984-57-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/1984-55-0x000000000041B670-mapping.dmp