Analysis
-
max time kernel
163s -
max time network
169s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:43
Static task
static1
Behavioral task
behavioral1
Sample
DHLAWB TRACKING DETAILS..exe
Resource
win7-20220414-en
General
-
Target
DHLAWB TRACKING DETAILS..exe
-
Size
300KB
-
MD5
04b64453c95193d6cebe5b7d00915d75
-
SHA1
4ab5e5fd31ab5d071ab09d8543ebe9551f63b2b1
-
SHA256
967a6989b7dedfe073c92760bb62a30fa4348109a839d987fe9a0bce6d1d5f2d
-
SHA512
ad1ab62df00b201d0893a001cc0d789b1b6a8c32a849d69fdc7620f3e2aedca426ba434386fcc513c0cf13eab66a1a0ebc5c146c33d7e2b1699367853414b3c0
Malware Config
Extracted
formbook
3.9
eb96
mcoutinhoparedes.seat
assestsmagazine.com
giveaway-4skaters.win
upgradetolifestyle.com
imagingnetworkri.net
51wwjf.com
hypstop.com
xn--aupetitsoindescurs-8jd.com
zhijipifu.com
lfqbzx.com
xn--fiqxlo3jzoe6w0e.com
ayhalo.com
rendcarparts.net
speekeesy.com
chillwalle.com
nama-no.com
spidermonkeytattoos.net
leaderhebei.com
syspatch.net
indigrup.com
thereallywildstudio.com
skyland-art.com
apptoparty.info
201680.top
vandoliacpa.com
xmowed.info
streamagazine.com
yeah.agency
daanquan.site
justhanging.online
emdrgeorgetowntx.com
powerprotect1523.win
darmoe.com
aqualityfilter.com
huangchunlan.com
cheqiangwei.net
scottdewaard.net
startnewonlinelife.live
nodustisamust.com
homeconfiguration.com
beelovedchild.com
test-domain-2017.com
kivanccocuk.com
themaritimekrabi.com
bandungkitchen.com
voiceologylabs.com
origamistube.com
gregoryjohnstonstudio.com
beglutan.com
bathhardwoodflooring.com
caliagro.com
celtic-san.com
vorenuo.com
mentalfa.com
nationalelectrocare.com
hoolded.com
trustprosusa.com
1af3ty.accountant
criativafm105.com
conneted.com
jiuzhanglianghua.com
petimoklub.com
2kaiser-electronics.net
backpackjp.win
mansiobok3.info
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1360-60-0x000000000041B6F0-mapping.dmp formbook behavioral1/memory/1360-59-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/1360-62-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/952-69-0x00000000000C0000-0x00000000000EA000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 240 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
chkdsk.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run chkdsk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JPALGHXX0L = "C:\\Program Files (x86)\\Mzv1pnz\\winf0j8u8e8.exe" chkdsk.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
DHLAWB TRACKING DETAILS..exeDHLAWB TRACKING DETAILS..exechkdsk.exedescription pid process target process PID 976 set thread context of 1360 976 DHLAWB TRACKING DETAILS..exe DHLAWB TRACKING DETAILS..exe PID 1360 set thread context of 1232 1360 DHLAWB TRACKING DETAILS..exe Explorer.EXE PID 952 set thread context of 1232 952 chkdsk.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
chkdsk.exedescription ioc process File opened for modification C:\Program Files (x86)\Mzv1pnz\winf0j8u8e8.exe chkdsk.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Processes:
chkdsk.exedescription ioc process Key created \Registry\User\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
DHLAWB TRACKING DETAILS..exeDHLAWB TRACKING DETAILS..exechkdsk.exepid process 976 DHLAWB TRACKING DETAILS..exe 976 DHLAWB TRACKING DETAILS..exe 1360 DHLAWB TRACKING DETAILS..exe 1360 DHLAWB TRACKING DETAILS..exe 952 chkdsk.exe 952 chkdsk.exe 952 chkdsk.exe 952 chkdsk.exe 952 chkdsk.exe 952 chkdsk.exe 952 chkdsk.exe 952 chkdsk.exe 952 chkdsk.exe 952 chkdsk.exe 952 chkdsk.exe 952 chkdsk.exe 952 chkdsk.exe 952 chkdsk.exe 952 chkdsk.exe 952 chkdsk.exe 952 chkdsk.exe 952 chkdsk.exe 952 chkdsk.exe 952 chkdsk.exe 952 chkdsk.exe 952 chkdsk.exe 952 chkdsk.exe 952 chkdsk.exe 952 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
DHLAWB TRACKING DETAILS..exechkdsk.exepid process 1360 DHLAWB TRACKING DETAILS..exe 1360 DHLAWB TRACKING DETAILS..exe 1360 DHLAWB TRACKING DETAILS..exe 952 chkdsk.exe 952 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
DHLAWB TRACKING DETAILS..exeDHLAWB TRACKING DETAILS..exechkdsk.exedescription pid process Token: SeDebugPrivilege 976 DHLAWB TRACKING DETAILS..exe Token: SeDebugPrivilege 1360 DHLAWB TRACKING DETAILS..exe Token: SeDebugPrivilege 952 chkdsk.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1232 Explorer.EXE 1232 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1232 Explorer.EXE 1232 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
DHLAWB TRACKING DETAILS..exeExplorer.EXEchkdsk.exedescription pid process target process PID 976 wrote to memory of 1360 976 DHLAWB TRACKING DETAILS..exe DHLAWB TRACKING DETAILS..exe PID 976 wrote to memory of 1360 976 DHLAWB TRACKING DETAILS..exe DHLAWB TRACKING DETAILS..exe PID 976 wrote to memory of 1360 976 DHLAWB TRACKING DETAILS..exe DHLAWB TRACKING DETAILS..exe PID 976 wrote to memory of 1360 976 DHLAWB TRACKING DETAILS..exe DHLAWB TRACKING DETAILS..exe PID 976 wrote to memory of 1360 976 DHLAWB TRACKING DETAILS..exe DHLAWB TRACKING DETAILS..exe PID 976 wrote to memory of 1360 976 DHLAWB TRACKING DETAILS..exe DHLAWB TRACKING DETAILS..exe PID 976 wrote to memory of 1360 976 DHLAWB TRACKING DETAILS..exe DHLAWB TRACKING DETAILS..exe PID 1232 wrote to memory of 952 1232 Explorer.EXE chkdsk.exe PID 1232 wrote to memory of 952 1232 Explorer.EXE chkdsk.exe PID 1232 wrote to memory of 952 1232 Explorer.EXE chkdsk.exe PID 1232 wrote to memory of 952 1232 Explorer.EXE chkdsk.exe PID 952 wrote to memory of 240 952 chkdsk.exe cmd.exe PID 952 wrote to memory of 240 952 chkdsk.exe cmd.exe PID 952 wrote to memory of 240 952 chkdsk.exe cmd.exe PID 952 wrote to memory of 240 952 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHLAWB TRACKING DETAILS..exe"C:\Users\Admin\AppData\Local\Temp\DHLAWB TRACKING DETAILS..exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHLAWB TRACKING DETAILS..exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DHLAWB TRACKING DETAILS..exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\95A926UA\95Alogim.jpegFilesize
62KB
MD5b90251bf9c34ae7ff6fdd07cc985f132
SHA116b6aa4bf492224371b66d93cd087742c31e30e5
SHA2560ae7b1b811c3eeea9c917a1024cca6923fa54a4c73e1739e9d6c7c35d9c9fc6c
SHA512dc133c320f9330ad6a576271fc84806e9414dc7bfc712e57929b30fbb63763ad3100fb10352ce6d199bd00af22d6d8cd5a18a8eeee0b7ed702d8cc60035fcb44
-
C:\Users\Admin\AppData\Roaming\95A926UA\95Alogri.iniFilesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\95A926UA\95Alogrv.iniFilesize
40B
MD5ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf
-
memory/240-67-0x0000000000000000-mapping.dmp
-
memory/952-71-0x0000000001E80000-0x0000000001F13000-memory.dmpFilesize
588KB
-
memory/952-69-0x00000000000C0000-0x00000000000EA000-memory.dmpFilesize
168KB
-
memory/952-66-0x0000000000000000-mapping.dmp
-
memory/952-70-0x0000000002040000-0x0000000002343000-memory.dmpFilesize
3.0MB
-
memory/952-68-0x0000000000380000-0x0000000000387000-memory.dmpFilesize
28KB
-
memory/976-55-0x0000000074E00000-0x00000000753AB000-memory.dmpFilesize
5.7MB
-
memory/976-54-0x00000000759F1000-0x00000000759F3000-memory.dmpFilesize
8KB
-
memory/1232-65-0x0000000005EF0000-0x0000000005FD6000-memory.dmpFilesize
920KB
-
memory/1232-72-0x0000000004340000-0x00000000043FC000-memory.dmpFilesize
752KB
-
memory/1360-64-0x0000000000280000-0x0000000000294000-memory.dmpFilesize
80KB
-
memory/1360-57-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1360-63-0x0000000000BE0000-0x0000000000EE3000-memory.dmpFilesize
3.0MB
-
memory/1360-56-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1360-59-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1360-60-0x000000000041B6F0-mapping.dmp
-
memory/1360-62-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB