Analysis
-
max time kernel
148s -
max time network
161s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 10:51
Static task
static1
Behavioral task
behavioral1
Sample
Requirement list.exe
Resource
win7-20220414-en
General
-
Target
Requirement list.exe
-
Size
648KB
-
MD5
5dff100422e961e681af596f5307ba6d
-
SHA1
68735aa701b4be6df63b0fed0edec4800027836b
-
SHA256
def5dbf8e48af782ccb741ff6a1e1357af8dcafb701089b7f2d1c0919ae79f05
-
SHA512
07aab159926347c24b6513c7f34a6fd52804f144ca1ff549aea14105a6bcaea715d8258a684be5fb852e9f33f87b96b991503b826bdef77b1dd2de29ac892c95
Malware Config
Extracted
formbook
4.1
c38r
angleprotool.com
drilldownaccountancy.com
puur-bb.info
laptoprepairbrighton.net
mainstale.com
soketones.com
cohi.ltd
washntivow.com
datajagabon.online
solidlike.com
tapaznoncc.com
deadoralive.site
sharkapexdwal.com
tribun-news.com
67chain.com
paramorphous.net
chicagoxqa.com
301zaq.info
mansfieldpowdercoating.net
stopdizzy.com
edildecor.info
earth-edge.com
hklpf.com
umiusnage7.ltd
justinteutonico.com
daxiangshare.com
thiwari.com
merm.world
westernconsultant.com
com-musclebuilding.services
vitaminarts.com
gbgroup100.com
sanpulga.com
timelesssurvival.com
hgeetor.com
get-it-cheaper.com
shivmudraagency.com
widthcycl.com
jhomerballfunerealhome.com
frasesymasusa.com
appsmomo.com
tv16589.info
theultimatechatzone.com
obpromote-h789.info
douxiangshou.com
lnternetbank.com
theinvestortribe.com
dentv.fyi
orchestre-rockseller.com
gefyun.com
thankgivingdecorating2017.com
randenanetu.info
engineeringku.com
ups-usa.com
911tfc.com
chairikitchen.com
recovery-web.info
top-blog.review
gettechtags.com
equifsxsecurity2017.com
icbcbk.net
sgllawnservices.com
thewellness.store
rockingchairworld.info
regulars7.info
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1644-63-0x0000000000070000-0x000000000009D000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1440 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IX4DANPXO6 = "C:\\Program Files (x86)\\Nhh1lxj9\\update-z7.exe" wscript.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Requirement list.exeRequirement list.exewscript.exedescription pid process target process PID 1228 set thread context of 964 1228 Requirement list.exe Requirement list.exe PID 964 set thread context of 1256 964 Requirement list.exe Explorer.EXE PID 1644 set thread context of 1256 1644 wscript.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
wscript.exedescription ioc process File opened for modification C:\Program Files (x86)\Nhh1lxj9\update-z7.exe wscript.exe -
Processes:
wscript.exedescription ioc process Key created \Registry\User\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wscript.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
Requirement list.exeRequirement list.exewscript.exepid process 1228 Requirement list.exe 964 Requirement list.exe 964 Requirement list.exe 1644 wscript.exe 1644 wscript.exe 1644 wscript.exe 1644 wscript.exe 1644 wscript.exe 1644 wscript.exe 1644 wscript.exe 1644 wscript.exe 1644 wscript.exe 1644 wscript.exe 1644 wscript.exe 1644 wscript.exe 1644 wscript.exe 1644 wscript.exe 1644 wscript.exe 1644 wscript.exe 1644 wscript.exe 1644 wscript.exe 1644 wscript.exe 1644 wscript.exe 1644 wscript.exe 1644 wscript.exe 1644 wscript.exe 1644 wscript.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
Requirement list.exeRequirement list.exewscript.exepid process 1228 Requirement list.exe 964 Requirement list.exe 964 Requirement list.exe 964 Requirement list.exe 1644 wscript.exe 1644 wscript.exe 1644 wscript.exe 1644 wscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Requirement list.exewscript.exedescription pid process Token: SeDebugPrivilege 964 Requirement list.exe Token: SeDebugPrivilege 1644 wscript.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Requirement list.exeExplorer.EXEwscript.exedescription pid process target process PID 1228 wrote to memory of 964 1228 Requirement list.exe Requirement list.exe PID 1228 wrote to memory of 964 1228 Requirement list.exe Requirement list.exe PID 1228 wrote to memory of 964 1228 Requirement list.exe Requirement list.exe PID 1228 wrote to memory of 964 1228 Requirement list.exe Requirement list.exe PID 1256 wrote to memory of 1644 1256 Explorer.EXE wscript.exe PID 1256 wrote to memory of 1644 1256 Explorer.EXE wscript.exe PID 1256 wrote to memory of 1644 1256 Explorer.EXE wscript.exe PID 1256 wrote to memory of 1644 1256 Explorer.EXE wscript.exe PID 1644 wrote to memory of 1440 1644 wscript.exe cmd.exe PID 1644 wrote to memory of 1440 1644 wscript.exe cmd.exe PID 1644 wrote to memory of 1440 1644 wscript.exe cmd.exe PID 1644 wrote to memory of 1440 1644 wscript.exe cmd.exe PID 1644 wrote to memory of 1352 1644 wscript.exe Firefox.exe PID 1644 wrote to memory of 1352 1644 wscript.exe Firefox.exe PID 1644 wrote to memory of 1352 1644 wscript.exe Firefox.exe PID 1644 wrote to memory of 1352 1644 wscript.exe Firefox.exe PID 1644 wrote to memory of 1352 1644 wscript.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Requirement list.exe"C:\Users\Admin\AppData\Local\Temp\Requirement list.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Requirement list.exe"C:\Users\Admin\AppData\Local\Temp\Requirement list.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Requirement list.exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\2MAB93A4\2MAlogim.jpegFilesize
63KB
MD5bddefade2b966bb537d3cc7d19d693b4
SHA19ec0297f441e1c772d3d46944a4e2160f3522a91
SHA256fca5a278fac742d4a718d8b8826d8de735ff66132d112ffe73690e80ffbb6035
SHA512132dde354f75ce9a8acb248d7cf05aa2c3824022a589e902ff68c6a35a7168c4924a912507475ea02f859d9e8671923687b7f4f32cc2a29ce74d092272713ca2
-
C:\Users\Admin\AppData\Roaming\2MAB93A4\2MAlogrf.iniFilesize
40B
MD52f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
C:\Users\Admin\AppData\Roaming\2MAB93A4\2MAlogri.iniFilesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\2MAB93A4\2MAlogrv.iniFilesize
40B
MD5ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf
-
memory/964-55-0x000000000041E2E0-mapping.dmp
-
memory/964-57-0x0000000000920000-0x0000000000C23000-memory.dmpFilesize
3.0MB
-
memory/964-58-0x00000000002B0000-0x00000000002C4000-memory.dmpFilesize
80KB
-
memory/1228-56-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1228-54-0x00000000751C1000-0x00000000751C3000-memory.dmpFilesize
8KB
-
memory/1256-59-0x00000000048C0000-0x0000000004A04000-memory.dmpFilesize
1.3MB
-
memory/1256-66-0x0000000004A90000-0x0000000004B4B000-memory.dmpFilesize
748KB
-
memory/1440-61-0x0000000000000000-mapping.dmp
-
memory/1644-62-0x00000000009B0000-0x00000000009D6000-memory.dmpFilesize
152KB
-
memory/1644-65-0x0000000002280000-0x0000000002313000-memory.dmpFilesize
588KB
-
memory/1644-64-0x0000000001F70000-0x0000000002273000-memory.dmpFilesize
3.0MB
-
memory/1644-63-0x0000000000070000-0x000000000009D000-memory.dmpFilesize
180KB
-
memory/1644-60-0x0000000000000000-mapping.dmp