Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:33
Static task
static1
Behavioral task
behavioral1
Sample
BANK_STA.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
BANK_STA.exe
Resource
win10v2004-20220414-en
General
-
Target
BANK_STA.exe
-
Size
339KB
-
MD5
c9b0c4cb22b9f6ca2ba4e65a6ddd3f85
-
SHA1
1db3cc412c6785f5380dc3dd62d8532b6e306ef6
-
SHA256
2fdf0daf15395bf89c3baab2efff427dd7026ba306bb5c77c5f5598f5c6eb30f
-
SHA512
28e7992983db2edea83b57af7e3c1848ccc46ef71db3cf1ba250eba3199cea219df2899090b175f944d7315b949fbe1e876a02690bdf607aba1788a8e9f65f74
Malware Config
Extracted
formbook
3.9
hsk
fastcarsforless.com
motmx.info
mail-identity.info
eurovision360.com
hongmuchuanqi.com
ekamente.com
lifestylechristianityfilms.com
garsongroup.com
vykupujeme-knihy.info
mosqueswatch.com
eiyaw.info
multiexample.win
fastkart.net
thebestviva.com
resellers-store.com
dominobets.com
cluemagz.com
aleshianicole.com
craftsmandeadmiration.com
flossiecrums.com
testvmsep07frad.net
besthairsaloninliberty.com
bluelovecuracao.com
zhifufarm.com
rapa.ltd
roofabovemyhead.com
fasttracklead.com
anoithealth.com
producovendo.com
itervato.com
safaritasarim.com
miano.ink
thebusinessbookcase.com
jingmingeye.com
sailchain.com
asafrica.com
ordufatsadenizcilik.com
dermaepic.com
www44334008.com
hahnbros.net
train-time.com
icc-cricket-worldcup-2019.com
ly0186.com
juristour.info
positivezen.com
equifaxclassactionsuit.com
moviehdwatch.net
femgamer.com
letsgetstartup.com
ubmspain.com
musangz.info
lifestyleoutlaws.com
casagrupo.com
jtswildlifecameras.com
dtbjy.com
thanhphatphat.com
godhatesgod.com
myvirtual8.com
neutral.reviews
blitzmarketing.net
danredznak.com
foca1-po1nt.com
alwayskissingstudios.com
bigfinehive.com
ulxery.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/672-69-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/672-70-0x000000000041B680-mapping.dmp formbook behavioral1/memory/672-73-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/1068-80-0x0000000000080000-0x00000000000AA000-memory.dmp formbook -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
chkdsk.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run chkdsk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\J8TPYLN8OVE = "C:\\Program Files (x86)\\Jnz7\\gdinbitefpx.exe" chkdsk.exe -
Executes dropped EXE 3 IoCs
Processes:
BANK_STA.exeBANK_STA.exeBANK_STA.exepid process 1780 BANK_STA.exe 528 BANK_STA.exe 672 BANK_STA.exe -
Loads dropped DLL 3 IoCs
Processes:
BANK_STA.exepid process 1800 BANK_STA.exe 1800 BANK_STA.exe 1800 BANK_STA.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
BANK_STA.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Run = "\"C:\\Users\\Admin\\AppData\\Local\\Run.exe\"" BANK_STA.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
BANK_STA.exeBANK_STA.exechkdsk.exedescription pid process target process PID 1800 set thread context of 672 1800 BANK_STA.exe BANK_STA.exe PID 672 set thread context of 1288 672 BANK_STA.exe Explorer.EXE PID 1068 set thread context of 1288 1068 chkdsk.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
chkdsk.exedescription ioc process File opened for modification C:\Program Files (x86)\Jnz7\gdinbitefpx.exe chkdsk.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Processes:
chkdsk.exedescription ioc process Key created \Registry\User\S-1-5-21-1819626980-2277161760-1023733287-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 39 IoCs
Processes:
BANK_STA.exeBANK_STA.exechkdsk.exepid process 1800 BANK_STA.exe 1800 BANK_STA.exe 1800 BANK_STA.exe 1800 BANK_STA.exe 1800 BANK_STA.exe 1800 BANK_STA.exe 1800 BANK_STA.exe 1800 BANK_STA.exe 1800 BANK_STA.exe 1800 BANK_STA.exe 1800 BANK_STA.exe 1800 BANK_STA.exe 1800 BANK_STA.exe 1800 BANK_STA.exe 1800 BANK_STA.exe 1800 BANK_STA.exe 1800 BANK_STA.exe 1800 BANK_STA.exe 1800 BANK_STA.exe 1800 BANK_STA.exe 1800 BANK_STA.exe 1800 BANK_STA.exe 1800 BANK_STA.exe 672 BANK_STA.exe 672 BANK_STA.exe 1068 chkdsk.exe 1068 chkdsk.exe 1068 chkdsk.exe 1068 chkdsk.exe 1068 chkdsk.exe 1068 chkdsk.exe 1068 chkdsk.exe 1068 chkdsk.exe 1068 chkdsk.exe 1068 chkdsk.exe 1068 chkdsk.exe 1068 chkdsk.exe 1068 chkdsk.exe 1068 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
BANK_STA.exechkdsk.exepid process 672 BANK_STA.exe 672 BANK_STA.exe 672 BANK_STA.exe 1068 chkdsk.exe 1068 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
BANK_STA.exeBANK_STA.exechkdsk.exedescription pid process Token: SeDebugPrivilege 1800 BANK_STA.exe Token: SeDebugPrivilege 672 BANK_STA.exe Token: SeDebugPrivilege 1068 chkdsk.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1288 Explorer.EXE 1288 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1288 Explorer.EXE 1288 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
BANK_STA.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1800 wrote to memory of 1780 1800 BANK_STA.exe BANK_STA.exe PID 1800 wrote to memory of 1780 1800 BANK_STA.exe BANK_STA.exe PID 1800 wrote to memory of 1780 1800 BANK_STA.exe BANK_STA.exe PID 1800 wrote to memory of 1780 1800 BANK_STA.exe BANK_STA.exe PID 1800 wrote to memory of 528 1800 BANK_STA.exe BANK_STA.exe PID 1800 wrote to memory of 528 1800 BANK_STA.exe BANK_STA.exe PID 1800 wrote to memory of 528 1800 BANK_STA.exe BANK_STA.exe PID 1800 wrote to memory of 528 1800 BANK_STA.exe BANK_STA.exe PID 1800 wrote to memory of 672 1800 BANK_STA.exe BANK_STA.exe PID 1800 wrote to memory of 672 1800 BANK_STA.exe BANK_STA.exe PID 1800 wrote to memory of 672 1800 BANK_STA.exe BANK_STA.exe PID 1800 wrote to memory of 672 1800 BANK_STA.exe BANK_STA.exe PID 1800 wrote to memory of 672 1800 BANK_STA.exe BANK_STA.exe PID 1800 wrote to memory of 672 1800 BANK_STA.exe BANK_STA.exe PID 1800 wrote to memory of 672 1800 BANK_STA.exe BANK_STA.exe PID 1288 wrote to memory of 1068 1288 Explorer.EXE chkdsk.exe PID 1288 wrote to memory of 1068 1288 Explorer.EXE chkdsk.exe PID 1288 wrote to memory of 1068 1288 Explorer.EXE chkdsk.exe PID 1288 wrote to memory of 1068 1288 Explorer.EXE chkdsk.exe PID 1068 wrote to memory of 976 1068 chkdsk.exe cmd.exe PID 1068 wrote to memory of 976 1068 chkdsk.exe cmd.exe PID 1068 wrote to memory of 976 1068 chkdsk.exe cmd.exe PID 1068 wrote to memory of 976 1068 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BANK_STA.exe"C:\Users\Admin\AppData\Local\Temp\BANK_STA.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BANK_STA.exe"C:\Users\Admin\AppData\Local\Temp\BANK_STA.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\BANK_STA.exe"C:\Users\Admin\AppData\Local\Temp\BANK_STA.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\BANK_STA.exe"C:\Users\Admin\AppData\Local\Temp\BANK_STA.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\BANK_STA.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\BANK_STA.exeFilesize
339KB
MD5c9b0c4cb22b9f6ca2ba4e65a6ddd3f85
SHA11db3cc412c6785f5380dc3dd62d8532b6e306ef6
SHA2562fdf0daf15395bf89c3baab2efff427dd7026ba306bb5c77c5f5598f5c6eb30f
SHA51228e7992983db2edea83b57af7e3c1848ccc46ef71db3cf1ba250eba3199cea219df2899090b175f944d7315b949fbe1e876a02690bdf607aba1788a8e9f65f74
-
C:\Users\Admin\AppData\Local\Temp\BANK_STA.exeFilesize
339KB
MD5c9b0c4cb22b9f6ca2ba4e65a6ddd3f85
SHA11db3cc412c6785f5380dc3dd62d8532b6e306ef6
SHA2562fdf0daf15395bf89c3baab2efff427dd7026ba306bb5c77c5f5598f5c6eb30f
SHA51228e7992983db2edea83b57af7e3c1848ccc46ef71db3cf1ba250eba3199cea219df2899090b175f944d7315b949fbe1e876a02690bdf607aba1788a8e9f65f74
-
C:\Users\Admin\AppData\Local\Temp\BANK_STA.exeFilesize
339KB
MD5c9b0c4cb22b9f6ca2ba4e65a6ddd3f85
SHA11db3cc412c6785f5380dc3dd62d8532b6e306ef6
SHA2562fdf0daf15395bf89c3baab2efff427dd7026ba306bb5c77c5f5598f5c6eb30f
SHA51228e7992983db2edea83b57af7e3c1848ccc46ef71db3cf1ba250eba3199cea219df2899090b175f944d7315b949fbe1e876a02690bdf607aba1788a8e9f65f74
-
\Users\Admin\AppData\Local\Temp\BANK_STA.exeFilesize
339KB
MD5c9b0c4cb22b9f6ca2ba4e65a6ddd3f85
SHA11db3cc412c6785f5380dc3dd62d8532b6e306ef6
SHA2562fdf0daf15395bf89c3baab2efff427dd7026ba306bb5c77c5f5598f5c6eb30f
SHA51228e7992983db2edea83b57af7e3c1848ccc46ef71db3cf1ba250eba3199cea219df2899090b175f944d7315b949fbe1e876a02690bdf607aba1788a8e9f65f74
-
\Users\Admin\AppData\Local\Temp\BANK_STA.exeFilesize
339KB
MD5c9b0c4cb22b9f6ca2ba4e65a6ddd3f85
SHA11db3cc412c6785f5380dc3dd62d8532b6e306ef6
SHA2562fdf0daf15395bf89c3baab2efff427dd7026ba306bb5c77c5f5598f5c6eb30f
SHA51228e7992983db2edea83b57af7e3c1848ccc46ef71db3cf1ba250eba3199cea219df2899090b175f944d7315b949fbe1e876a02690bdf607aba1788a8e9f65f74
-
\Users\Admin\AppData\Local\Temp\BANK_STA.exeFilesize
339KB
MD5c9b0c4cb22b9f6ca2ba4e65a6ddd3f85
SHA11db3cc412c6785f5380dc3dd62d8532b6e306ef6
SHA2562fdf0daf15395bf89c3baab2efff427dd7026ba306bb5c77c5f5598f5c6eb30f
SHA51228e7992983db2edea83b57af7e3c1848ccc46ef71db3cf1ba250eba3199cea219df2899090b175f944d7315b949fbe1e876a02690bdf607aba1788a8e9f65f74
-
memory/672-69-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/672-73-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/672-75-0x00000000002A0000-0x00000000002B4000-memory.dmpFilesize
80KB
-
memory/672-74-0x0000000000920000-0x0000000000C23000-memory.dmpFilesize
3.0MB
-
memory/672-70-0x000000000041B680-mapping.dmp
-
memory/672-67-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/672-66-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/976-78-0x0000000000000000-mapping.dmp
-
memory/1068-77-0x0000000000000000-mapping.dmp
-
memory/1068-82-0x0000000000A30000-0x0000000000AC3000-memory.dmpFilesize
588KB
-
memory/1068-81-0x0000000002160000-0x0000000002463000-memory.dmpFilesize
3.0MB
-
memory/1068-80-0x0000000000080000-0x00000000000AA000-memory.dmpFilesize
168KB
-
memory/1068-79-0x0000000000D50000-0x0000000000D57000-memory.dmpFilesize
28KB
-
memory/1288-83-0x00000000068F0000-0x00000000069D8000-memory.dmpFilesize
928KB
-
memory/1288-76-0x0000000004F40000-0x00000000050A5000-memory.dmpFilesize
1.4MB
-
memory/1800-55-0x0000000074E91000-0x0000000074E93000-memory.dmpFilesize
8KB
-
memory/1800-59-0x0000000000580000-0x0000000000596000-memory.dmpFilesize
88KB
-
memory/1800-58-0x0000000000430000-0x0000000000446000-memory.dmpFilesize
88KB
-
memory/1800-60-0x0000000000650000-0x0000000000658000-memory.dmpFilesize
32KB
-
memory/1800-56-0x0000000000260000-0x0000000000268000-memory.dmpFilesize
32KB
-
memory/1800-57-0x0000000000450000-0x0000000000490000-memory.dmpFilesize
256KB
-
memory/1800-54-0x00000000008C0000-0x000000000091C000-memory.dmpFilesize
368KB