Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:41
Static task
static1
Behavioral task
behavioral1
Sample
430917.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
430917.exe
Resource
win10v2004-20220414-en
General
-
Target
430917.exe
-
Size
330KB
-
MD5
e194989989a1a67a7734611823a1524f
-
SHA1
bcffc771e7e2f343a007e9a60da71a1e342d691e
-
SHA256
06ae29042dd19e5cc3e287eafcb47a934aba12b9c3d4224d31f64a700b1b77ca
-
SHA512
76641f8ed4a09ee40f233f8ba537a8841e6b8cd5f0d7b16a8efcc9154dcc868a05fe72a4f219c948f70fc153ead56da52fb13492c5cad1cba59798171a5637d8
Malware Config
Extracted
formbook
3.9
s5l
greenstock.info
laurajaneaesthetics.com
817comm.com
dbprimery.com
slzu-vxtx9.biz
covetpro.com
50.ink
weick.email
88717888.com
tongyue0423.com
anchorsky.com
horapatarot.com
cadillacforless.com
primesupplyvintage.com
torchinstant.win
thebrandishere.com
www-69677.com
savestj.com
tommydad.com
xigjailbreak.com
contulinemotieeszere.info
virtualrealitydomainnames.com
oldschoolrentalcars.com
zerosumtoken.info
facingrods.com
bagodawatch.com
theecostone.com
fireangelstech.com
lendingnetworksmail.com
apartemenbegawan.com
oniapparel.com
sanjeevkumarvestige.com
jiqywrrcmyudxaydrw.com
ptt-store.com
affilifaq.net
eyezonsite.com
youreadorkable.com
eh-sc.com
diariodasnoticias.com
bcqts.com
9a176.com
triplicesports.com
thetravelguideindia.com
frottolesignoraggio.info
swiftlogistics-service.com
36lk.info
webuyoldmotorcycles.com
mikedtoyota.com
honghuyangguang.com
soft-bits.com
twheb.com
poshchain.com
socialgeeknwa.com
alltexvets.com
coscolg.com
theflyingwolves.com
stonebridgeiwm.info
requestforcollect.com
weatherdeep.com
webxhard.com
six.ltd
belamargarida.com
eskisehirkahvefestivali.com
sf8803.com
hearxy.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/828-63-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/828-64-0x000000000041B6E0-mapping.dmp formbook behavioral1/memory/828-66-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/1756-76-0x0000000000080000-0x00000000000AA000-memory.dmp formbook -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
help.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\YNUTDNC0H = "C:\\Program Files (x86)\\Tkjkdu\\vga_lgd.exe" help.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run help.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1748 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
430917.exe430917.exehelp.exedescription pid process target process PID 2040 set thread context of 828 2040 430917.exe 430917.exe PID 828 set thread context of 1248 828 430917.exe Explorer.EXE PID 828 set thread context of 1248 828 430917.exe Explorer.EXE PID 1756 set thread context of 1248 1756 help.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
help.exedescription ioc process File opened for modification C:\Program Files (x86)\Tkjkdu\vga_lgd.exe help.exe -
Processes:
help.exedescription ioc process Key created \Registry\User\S-1-5-21-790309383-526510583-3802439154-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 help.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
430917.exe430917.exehelp.exepid process 2040 430917.exe 2040 430917.exe 2040 430917.exe 2040 430917.exe 2040 430917.exe 2040 430917.exe 2040 430917.exe 2040 430917.exe 2040 430917.exe 2040 430917.exe 828 430917.exe 828 430917.exe 828 430917.exe 1756 help.exe 1756 help.exe 1756 help.exe 1756 help.exe 1756 help.exe 1756 help.exe 1756 help.exe 1756 help.exe 1756 help.exe 1756 help.exe 1756 help.exe 1756 help.exe 1756 help.exe 1756 help.exe 1756 help.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
430917.exehelp.exepid process 828 430917.exe 828 430917.exe 828 430917.exe 828 430917.exe 1756 help.exe 1756 help.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
430917.exe430917.exehelp.exedescription pid process Token: SeDebugPrivilege 2040 430917.exe Token: SeDebugPrivilege 828 430917.exe Token: SeDebugPrivilege 1756 help.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
430917.exe430917.exehelp.exedescription pid process target process PID 2040 wrote to memory of 804 2040 430917.exe 430917.exe PID 2040 wrote to memory of 804 2040 430917.exe 430917.exe PID 2040 wrote to memory of 804 2040 430917.exe 430917.exe PID 2040 wrote to memory of 804 2040 430917.exe 430917.exe PID 2040 wrote to memory of 1336 2040 430917.exe 430917.exe PID 2040 wrote to memory of 1336 2040 430917.exe 430917.exe PID 2040 wrote to memory of 1336 2040 430917.exe 430917.exe PID 2040 wrote to memory of 1336 2040 430917.exe 430917.exe PID 2040 wrote to memory of 828 2040 430917.exe 430917.exe PID 2040 wrote to memory of 828 2040 430917.exe 430917.exe PID 2040 wrote to memory of 828 2040 430917.exe 430917.exe PID 2040 wrote to memory of 828 2040 430917.exe 430917.exe PID 2040 wrote to memory of 828 2040 430917.exe 430917.exe PID 2040 wrote to memory of 828 2040 430917.exe 430917.exe PID 2040 wrote to memory of 828 2040 430917.exe 430917.exe PID 828 wrote to memory of 1756 828 430917.exe help.exe PID 828 wrote to memory of 1756 828 430917.exe help.exe PID 828 wrote to memory of 1756 828 430917.exe help.exe PID 828 wrote to memory of 1756 828 430917.exe help.exe PID 1756 wrote to memory of 1748 1756 help.exe cmd.exe PID 1756 wrote to memory of 1748 1756 help.exe cmd.exe PID 1756 wrote to memory of 1748 1756 help.exe cmd.exe PID 1756 wrote to memory of 1748 1756 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\430917.exe"C:\Users\Admin\AppData\Local\Temp\430917.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\430917.exe"C:\Users\Admin\AppData\Local\Temp\430917.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\430917.exe"C:\Users\Admin\AppData\Local\Temp\430917.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\430917.exe"C:\Users\Admin\AppData\Local\Temp\430917.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"4⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\430917.exe"5⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\JN052U35\JN0logim.jpegFilesize
73KB
MD593f77c205a531f435d913c259575a317
SHA169ae8713d88969208ec8e3563e386b6008256ce2
SHA25607e58ed2222f6f0e425b91c430d6f00ad9c681e2259e52a422516e855ecb87ea
SHA51235b6f280ea6dab55a84848a730ef8e66397a09cab786c16748198e8ba7d8421a27e3368df4362af5f7f9e08de10d4e167b081c5b9843e3aec4a73ed729db1b9f
-
C:\Users\Admin\AppData\Roaming\JN052U35\JN0logri.iniFilesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\JN052U35\JN0logrv.iniFilesize
40B
MD5ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf
-
memory/828-68-0x00000000003E0000-0x00000000003F4000-memory.dmpFilesize
80KB
-
memory/828-71-0x0000000000560000-0x0000000000574000-memory.dmpFilesize
80KB
-
memory/828-67-0x0000000000B70000-0x0000000000E73000-memory.dmpFilesize
3.0MB
-
memory/828-60-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/828-61-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/828-63-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/828-64-0x000000000041B6E0-mapping.dmp
-
memory/828-66-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1248-72-0x0000000006CF0000-0x0000000006E58000-memory.dmpFilesize
1.4MB
-
memory/1248-79-0x00000000060E0000-0x00000000061FF000-memory.dmpFilesize
1.1MB
-
memory/1248-69-0x0000000006360000-0x000000000645E000-memory.dmpFilesize
1016KB
-
memory/1748-74-0x0000000000000000-mapping.dmp
-
memory/1756-77-0x0000000000790000-0x0000000000A93000-memory.dmpFilesize
3.0MB
-
memory/1756-73-0x0000000000000000-mapping.dmp
-
memory/1756-75-0x00000000002E0000-0x00000000002E6000-memory.dmpFilesize
24KB
-
memory/1756-76-0x0000000000080000-0x00000000000AA000-memory.dmpFilesize
168KB
-
memory/1756-78-0x0000000000500000-0x0000000000593000-memory.dmpFilesize
588KB
-
memory/2040-58-0x00000000003A0000-0x00000000003B6000-memory.dmpFilesize
88KB
-
memory/2040-59-0x00000000004B0000-0x00000000004B8000-memory.dmpFilesize
32KB
-
memory/2040-54-0x0000000000980000-0x00000000009D8000-memory.dmpFilesize
352KB
-
memory/2040-57-0x0000000000250000-0x0000000000288000-memory.dmpFilesize
224KB
-
memory/2040-56-0x00000000001F0000-0x00000000001F8000-memory.dmpFilesize
32KB
-
memory/2040-55-0x0000000076261000-0x0000000076263000-memory.dmpFilesize
8KB