Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
27-05-2022 17:09
Static task
static1
Behavioral task
behavioral1
Sample
05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe
Resource
win7-20220414-en
General
-
Target
05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe
-
Size
463KB
-
MD5
9841dbf9dfa221a4e050db3e92689bc9
-
SHA1
6948e9499fc0bfa41a72107b1fc58b15a9e40f63
-
SHA256
05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0
-
SHA512
c1791b418fbc55d00006f01a9b1dfba21dfed3fc4bb5b25f05a55c02e4c3af435a284979f186ec095bfc4e1d2717c0686d2e9b7a938be6ecf567cfd3e1517298
Malware Config
Extracted
formbook
3.8
h35
maraudersinc.com
liebianwangluo.com
visit-australia.info
machiyane-kasukabe.com
hafizclub.com
merkburn.net
favoritetraffic2updating.win
adrian-oeser.net
nkshopdomaincpplt234.info
imperiodofutebol.com
welometocaloundra.com
thehealthypose.com
squalloptna.com
bobknowsbest.com
damgproperties.com
wastemastershire.co.uk
swacballet.com
japanbreakingnews.com
bjufaa.info
aryakuza.com
ericbellband.com
undecrypt.com
printrade.win
stfuxxxx.com
xn--m7rv64cc7d7q1an8c.com
aeints.net
agrotecsol.com
rntme.com
dqdrpmm.com
inseedbrand.com
0x1tenmoney.men
khudothidongvan2.com
newcasinouk.com
avocatdedieu.com
cagewo.com
tmay.ltd
35s4.review
blipeducated.com
businesscoveragetop.online
syxjsn.com
commspacein.com
johns.zone
cj336.com
mario-vestec.com
saviorpalliative.info
motherloderiches.com
socialworld.site
yongshiquan.com
listingbussiness.com
irritablebowelsyndromeip.com
brazoriacountynavy.info
greencoffeebeans.store
kk6z.com
blacktaxi.online
homeremedyforum.com
khujn.com
pipeai.com
www502789.com
bbz168.com
copydinner.win
wwwdld005.com
forumin3d.net
bacarragroup.com
sarandipiagaldar.com
dotcex.com
Signatures
-
Formbook Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2004-69-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/2004-70-0x000000000041B5F0-mapping.dmp formbook behavioral1/memory/2004-82-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/764-85-0x0000000000080000-0x00000000000AA000-memory.dmp formbook behavioral1/memory/764-90-0x0000000000080000-0x00000000000AA000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exeRegAsm.exechkdsk.exedescription pid process target process PID 1984 set thread context of 2004 1984 05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe RegAsm.exe PID 2004 set thread context of 1380 2004 RegAsm.exe Explorer.EXE PID 764 set thread context of 1380 764 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
RegAsm.exechkdsk.exepid process 2004 RegAsm.exe 2004 RegAsm.exe 764 chkdsk.exe 764 chkdsk.exe 764 chkdsk.exe 764 chkdsk.exe 764 chkdsk.exe 764 chkdsk.exe 764 chkdsk.exe 764 chkdsk.exe 764 chkdsk.exe 764 chkdsk.exe 764 chkdsk.exe 764 chkdsk.exe 764 chkdsk.exe 764 chkdsk.exe 764 chkdsk.exe 764 chkdsk.exe 764 chkdsk.exe 764 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegAsm.exechkdsk.exepid process 2004 RegAsm.exe 2004 RegAsm.exe 2004 RegAsm.exe 764 chkdsk.exe 764 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exeRegAsm.exechkdsk.exedescription pid process Token: SeDebugPrivilege 1984 05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe Token: SeDebugPrivilege 2004 RegAsm.exe Token: SeDebugPrivilege 764 chkdsk.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1984 wrote to memory of 2004 1984 05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe RegAsm.exe PID 1984 wrote to memory of 2004 1984 05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe RegAsm.exe PID 1984 wrote to memory of 2004 1984 05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe RegAsm.exe PID 1984 wrote to memory of 2004 1984 05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe RegAsm.exe PID 1984 wrote to memory of 2004 1984 05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe RegAsm.exe PID 1984 wrote to memory of 2004 1984 05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe RegAsm.exe PID 1984 wrote to memory of 2004 1984 05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe RegAsm.exe PID 1984 wrote to memory of 2004 1984 05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe RegAsm.exe PID 1984 wrote to memory of 2004 1984 05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe RegAsm.exe PID 1984 wrote to memory of 2004 1984 05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe RegAsm.exe PID 1380 wrote to memory of 764 1380 Explorer.EXE chkdsk.exe PID 1380 wrote to memory of 764 1380 Explorer.EXE chkdsk.exe PID 1380 wrote to memory of 764 1380 Explorer.EXE chkdsk.exe PID 1380 wrote to memory of 764 1380 Explorer.EXE chkdsk.exe PID 764 wrote to memory of 888 764 chkdsk.exe cmd.exe PID 764 wrote to memory of 888 764 chkdsk.exe cmd.exe PID 764 wrote to memory of 888 764 chkdsk.exe cmd.exe PID 764 wrote to memory of 888 764 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe"C:\Users\Admin\AppData\Local\Temp\05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/764-90-0x0000000000080000-0x00000000000AA000-memory.dmpFilesize
168KB
-
memory/764-87-0x0000000001E20000-0x0000000001EB3000-memory.dmpFilesize
588KB
-
memory/764-86-0x0000000001FD0000-0x00000000022D3000-memory.dmpFilesize
3.0MB
-
memory/764-85-0x0000000000080000-0x00000000000AA000-memory.dmpFilesize
168KB
-
memory/764-84-0x0000000000120000-0x0000000000127000-memory.dmpFilesize
28KB
-
memory/764-81-0x0000000000000000-mapping.dmp
-
memory/888-83-0x0000000000000000-mapping.dmp
-
memory/1380-79-0x0000000004160000-0x0000000004237000-memory.dmpFilesize
860KB
-
memory/1380-91-0x00000000049C0000-0x0000000004A68000-memory.dmpFilesize
672KB
-
memory/1380-89-0x0000000004160000-0x0000000004237000-memory.dmpFilesize
860KB
-
memory/1380-88-0x00000000049C0000-0x0000000004A68000-memory.dmpFilesize
672KB
-
memory/1984-63-0x0000000000250000-0x0000000000270000-memory.dmpFilesize
128KB
-
memory/1984-65-0x00000000729C0000-0x0000000073D4F000-memory.dmpFilesize
19.6MB
-
memory/1984-67-0x0000000070AB0000-0x0000000071290000-memory.dmpFilesize
7.9MB
-
memory/1984-68-0x0000000070190000-0x0000000070361000-memory.dmpFilesize
1.8MB
-
memory/1984-55-0x00000000729C0000-0x0000000073D4F000-memory.dmpFilesize
19.6MB
-
memory/1984-57-0x0000000071FB0000-0x00000000729C0000-memory.dmpFilesize
10.1MB
-
memory/1984-72-0x00000000729C0000-0x0000000073D4F000-memory.dmpFilesize
19.6MB
-
memory/1984-73-0x0000000070AB0000-0x0000000071290000-memory.dmpFilesize
7.9MB
-
memory/1984-74-0x0000000074620000-0x00000000747B4000-memory.dmpFilesize
1.6MB
-
memory/1984-75-0x0000000071290000-0x0000000071FAD000-memory.dmpFilesize
13.1MB
-
memory/1984-56-0x00000000753C1000-0x00000000753C3000-memory.dmpFilesize
8KB
-
memory/1984-78-0x0000000071FB0000-0x00000000729C0000-memory.dmpFilesize
10.1MB
-
memory/1984-58-0x0000000074620000-0x00000000747B4000-memory.dmpFilesize
1.6MB
-
memory/1984-66-0x0000000074620000-0x00000000747B4000-memory.dmpFilesize
1.6MB
-
memory/1984-64-0x0000000071FB0000-0x00000000729C0000-memory.dmpFilesize
10.1MB
-
memory/1984-59-0x0000000071290000-0x0000000071FAD000-memory.dmpFilesize
13.1MB
-
memory/1984-54-0x00000000012D0000-0x000000000134A000-memory.dmpFilesize
488KB
-
memory/1984-62-0x0000000070AB0000-0x0000000071290000-memory.dmpFilesize
7.9MB
-
memory/1984-61-0x0000000070370000-0x0000000070AAE000-memory.dmpFilesize
7.2MB
-
memory/1984-60-0x0000000074520000-0x000000007461C000-memory.dmpFilesize
1008KB
-
memory/2004-82-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2004-80-0x0000000000190000-0x00000000001A4000-memory.dmpFilesize
80KB
-
memory/2004-76-0x00000000024A0000-0x00000000027A3000-memory.dmpFilesize
3.0MB
-
memory/2004-70-0x000000000041B5F0-mapping.dmp
-
memory/2004-69-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB