Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:24
Static task
static1
Behavioral task
behavioral1
Sample
Salary.exe
Resource
win7-20220414-en
General
-
Target
Salary.exe
-
Size
301KB
-
MD5
cddc72c9292768f8719c1e5127a9997d
-
SHA1
5ae294116d27d67b2c3cee4b0b1b79ecbd25d582
-
SHA256
f3f3cda95f4d655f189381268676beef7ab70ed8355ff178abcad416c71adb22
-
SHA512
240c7a82c7b848f59aef3e09c01eca8d97c853ae7bf1270dea844835876019d8ee9eac83c5d7bc2ad56bdddd8853c6877a3a5c79ec0ba504eb4e8cb1200a49c1
Malware Config
Extracted
formbook
4.0
g8u
stuition.com
mj-sculpture.com
cannatainmentevents.com
dianjintang.com
rmlusitania.info
effet-spiruline.com
flatheme.com
supergaminator-vip.com
craftyourmagic.com
lakai.ltd
electionshawaii.com
iqpdct.com
thebestfourstarhotels.com
satoshiceo.com
saintmartiner.com
brothersmarinetoronto.com
citicoin.online
scentsationalsniffers.com
hellonighbourgameees.com
displayonline-france.com
cait-compare.com
aprenderoratoria.com
stehtisch24.com
cocktailandcocktalk.com
hybridtablesaw.com
ynnkfs.com
capitolman.com
xccomm.com
dannyhustle.com
9jiuhao.com
ossigenopoliatomicoliquido.biz
casayards.com
hotelmesonreal.com
lffcfftl.com
raiserobo.com
ssav33.com
oceanicmarinerisks.com
star-fairtrading.com
universecoolest.com
www8557v.com
reparaciones-ordenadores.com
residenteyecarepa.com
x-hom.com
finestsalon.com
xn--n8jydrczh8g7f7a7lp527d.com
dallasfortworthseopro.com
talentsplanner.com
gdmen.com
life-insurer-zone.live
tunnelrobot.com
vietnamexport.net
inlishui.site
inaneufeld.com
sleepingsling.com
huaian.ltd
iluxol.com
mahavirjwellersnoida.com
fastaskme.men
rsinsur.com
datingevo.com
bringmesomething.online
banjiasanti.com
zhixinchain.net
medifloors.com
tromagy.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2020-60-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/2020-61-0x000000000041E370-mapping.dmp formbook behavioral1/memory/2020-66-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/908-72-0x0000000000100000-0x000000000012D000-memory.dmp formbook -
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
Processes:
resource yara_rule behavioral1/memory/1084-56-0x0000000000730000-0x000000000076A000-memory.dmp rezer0 -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
systray.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run systray.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XZ7DU85H52 = "C:\\Program Files (x86)\\Ufrdh6ti\\taskhost1b6hzl5.exe" systray.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1072 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Salary.exeSalary.exesystray.exedescription pid process target process PID 1084 set thread context of 2020 1084 Salary.exe Salary.exe PID 2020 set thread context of 1280 2020 Salary.exe Explorer.EXE PID 2020 set thread context of 1280 2020 Salary.exe Explorer.EXE PID 908 set thread context of 1280 908 systray.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
systray.exedescription ioc process File opened for modification C:\Program Files (x86)\Ufrdh6ti\taskhost1b6hzl5.exe systray.exe -
Processes:
systray.exedescription ioc process Key created \Registry\User\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 systray.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
Salary.exeSalary.exesystray.exepid process 1084 Salary.exe 2020 Salary.exe 2020 Salary.exe 2020 Salary.exe 908 systray.exe 908 systray.exe 908 systray.exe 908 systray.exe 908 systray.exe 908 systray.exe 908 systray.exe 908 systray.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Salary.exesystray.exepid process 2020 Salary.exe 2020 Salary.exe 2020 Salary.exe 2020 Salary.exe 908 systray.exe 908 systray.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Salary.exeSalary.exesystray.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1084 Salary.exe Token: SeDebugPrivilege 2020 Salary.exe Token: SeDebugPrivilege 908 systray.exe Token: SeShutdownPrivilege 1280 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE 1280 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE 1280 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
Salary.exeExplorer.EXEsystray.exedescription pid process target process PID 1084 wrote to memory of 2016 1084 Salary.exe Salary.exe PID 1084 wrote to memory of 2016 1084 Salary.exe Salary.exe PID 1084 wrote to memory of 2016 1084 Salary.exe Salary.exe PID 1084 wrote to memory of 2016 1084 Salary.exe Salary.exe PID 1084 wrote to memory of 2020 1084 Salary.exe Salary.exe PID 1084 wrote to memory of 2020 1084 Salary.exe Salary.exe PID 1084 wrote to memory of 2020 1084 Salary.exe Salary.exe PID 1084 wrote to memory of 2020 1084 Salary.exe Salary.exe PID 1084 wrote to memory of 2020 1084 Salary.exe Salary.exe PID 1084 wrote to memory of 2020 1084 Salary.exe Salary.exe PID 1084 wrote to memory of 2020 1084 Salary.exe Salary.exe PID 1280 wrote to memory of 908 1280 Explorer.EXE systray.exe PID 1280 wrote to memory of 908 1280 Explorer.EXE systray.exe PID 1280 wrote to memory of 908 1280 Explorer.EXE systray.exe PID 1280 wrote to memory of 908 1280 Explorer.EXE systray.exe PID 908 wrote to memory of 1072 908 systray.exe cmd.exe PID 908 wrote to memory of 1072 908 systray.exe cmd.exe PID 908 wrote to memory of 1072 908 systray.exe cmd.exe PID 908 wrote to memory of 1072 908 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Salary.exe"C:\Users\Admin\AppData\Local\Temp\Salary.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Salary.exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Salary.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Salary.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/908-74-0x0000000000840000-0x00000000008D3000-memory.dmpFilesize
588KB
-
memory/908-76-0x0000000075FC1000-0x0000000075FC3000-memory.dmpFilesize
8KB
-
memory/908-69-0x0000000000000000-mapping.dmp
-
memory/908-73-0x0000000001ED0000-0x00000000021D3000-memory.dmpFilesize
3.0MB
-
memory/908-72-0x0000000000100000-0x000000000012D000-memory.dmpFilesize
180KB
-
memory/908-71-0x0000000000AC0000-0x0000000000AC5000-memory.dmpFilesize
20KB
-
memory/1072-70-0x0000000000000000-mapping.dmp
-
memory/1084-55-0x0000000000260000-0x0000000000270000-memory.dmpFilesize
64KB
-
memory/1084-56-0x0000000000730000-0x000000000076A000-memory.dmpFilesize
232KB
-
memory/1084-54-0x0000000000200000-0x0000000000252000-memory.dmpFilesize
328KB
-
memory/1280-75-0x0000000006AE0000-0x0000000006C21000-memory.dmpFilesize
1.3MB
-
memory/1280-65-0x00000000049B0000-0x0000000004A6D000-memory.dmpFilesize
756KB
-
memory/1280-68-0x0000000004DA0000-0x0000000004E5A000-memory.dmpFilesize
744KB
-
memory/2020-60-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2020-67-0x00000000001E0000-0x00000000001F4000-memory.dmpFilesize
80KB
-
memory/2020-66-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2020-64-0x0000000000190000-0x00000000001A4000-memory.dmpFilesize
80KB
-
memory/2020-63-0x00000000009C0000-0x0000000000CC3000-memory.dmpFilesize
3.0MB
-
memory/2020-61-0x000000000041E370-mapping.dmp
-
memory/2020-58-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2020-57-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB