Analysis
-
max time kernel
187s -
max time network
184s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-06-2022 22:59
Static task
static1
Behavioral task
behavioral1
Sample
1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa.exe
Resource
win7-20220414-en
General
-
Target
1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa.exe
-
Size
213KB
-
MD5
1af681084e3d0b909e8ff56e4cee3c80
-
SHA1
fc8532c8feb0ce096e761020678744824dc1607c
-
SHA256
1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa
-
SHA512
b9d0d1cb4cf3ac31f0b5f772e8e7dcdd5c13b9410dc52d22dfa42c6d34f98b13582319688a52c3f85bc0d2f46782f621ded3cdd70be1401846b2fc2ee449e4bf
Malware Config
Extracted
formbook
3.8
sh
studiogoparty.com
furi-mold.com
cdicoun-tombola.info
elizabethlhall.com
nakayama-hanasai.com
9910pe.com
iraqbreakingnews.com
91fyy.com
intersafetyland.com
dddadditive.com
gewuan.net
ikwxanxb.click
shenghangdianzi.com
nuskinmemory.com
sonrel-julie.com
rapidlegalcenter.com
jcldsp.com
dibamoviez.net
sochuan66.com
platformoneclothing.com
vandenbergpol.com
farmagf.com
xn--sjq656oa.net
bostonrefinanceboard.com
dannymetal.email
rcnxg.info
miaoshahui.net
sianakuwait.com
soundsquaremusic.com
liputan66.com
office365esafety.group
bolababy.net
saltiestoftheearth.com
goculer.com
mindbodysoulfoodie.com
tamsueva.info
givingartgallery.com
onlinestore.ninja
sanftemassagen.com
lafourmibatisseuse.com
200767.top
christina-kenel.com
burocratastijuana.com
herosofharvey.com
libelle-le.com
zecstb.men
jxkysd.com
yejiajun.com
social123marketing.com
simplelifeorganic.com
tjkaizhen.com
estableg.info
cyrilportmann.com
ntstiffins.com
717385y.info
ellamcd.com
cnxt.social
iotaagriculture.com
frankpilates.net
flytart.com
watch-zone.tech
yigitay.net
bubbleshootgames.com
cosmiceggpack.com
drylipc.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1896-67-0x0000000000BD0000-0x0000000000BFA000-memory.dmp formbook behavioral1/memory/1800-72-0x000000000041B5F0-mapping.dmp formbook behavioral1/memory/1800-78-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/692-81-0x00000000000E0000-0x000000000010A000-memory.dmp formbook behavioral1/memory/692-86-0x00000000000E0000-0x000000000010A000-memory.dmp formbook -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
NETSTAT.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run NETSTAT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\JHD0H4187VE = "C:\\Program Files (x86)\\Drfi0if\\mfcdn6hz.exe" NETSTAT.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa.exevbc.exeNETSTAT.EXEdescription pid process target process PID 1896 set thread context of 1800 1896 1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa.exe vbc.exe PID 1800 set thread context of 1280 1800 vbc.exe Explorer.EXE PID 692 set thread context of 1280 692 NETSTAT.EXE Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
NETSTAT.EXEdescription ioc process File opened for modification C:\Program Files (x86)\Drfi0if\mfcdn6hz.exe NETSTAT.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 692 NETSTAT.EXE -
Processes:
NETSTAT.EXEdescription ioc process Key created \Registry\User\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa.exevbc.exeNETSTAT.EXEpid process 1896 1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa.exe 1896 1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa.exe 1800 vbc.exe 1800 vbc.exe 692 NETSTAT.EXE 692 NETSTAT.EXE 692 NETSTAT.EXE 692 NETSTAT.EXE 692 NETSTAT.EXE 692 NETSTAT.EXE 692 NETSTAT.EXE 692 NETSTAT.EXE 692 NETSTAT.EXE 692 NETSTAT.EXE 692 NETSTAT.EXE 692 NETSTAT.EXE 692 NETSTAT.EXE 692 NETSTAT.EXE 692 NETSTAT.EXE 692 NETSTAT.EXE 692 NETSTAT.EXE 692 NETSTAT.EXE 692 NETSTAT.EXE 692 NETSTAT.EXE 692 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exeNETSTAT.EXEpid process 1800 vbc.exe 1800 vbc.exe 1800 vbc.exe 692 NETSTAT.EXE 692 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa.exevbc.exeNETSTAT.EXEExplorer.EXEdescription pid process Token: SeDebugPrivilege 1896 1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa.exe Token: SeDebugPrivilege 1800 vbc.exe Token: SeDebugPrivilege 692 NETSTAT.EXE Token: SeShutdownPrivilege 1280 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE 1280 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE 1280 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa.execsc.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 1896 wrote to memory of 1984 1896 1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa.exe csc.exe PID 1896 wrote to memory of 1984 1896 1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa.exe csc.exe PID 1896 wrote to memory of 1984 1896 1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa.exe csc.exe PID 1896 wrote to memory of 1984 1896 1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa.exe csc.exe PID 1984 wrote to memory of 2028 1984 csc.exe cvtres.exe PID 1984 wrote to memory of 2028 1984 csc.exe cvtres.exe PID 1984 wrote to memory of 2028 1984 csc.exe cvtres.exe PID 1984 wrote to memory of 2028 1984 csc.exe cvtres.exe PID 1896 wrote to memory of 1800 1896 1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa.exe vbc.exe PID 1896 wrote to memory of 1800 1896 1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa.exe vbc.exe PID 1896 wrote to memory of 1800 1896 1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa.exe vbc.exe PID 1896 wrote to memory of 1800 1896 1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa.exe vbc.exe PID 1896 wrote to memory of 1800 1896 1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa.exe vbc.exe PID 1896 wrote to memory of 1800 1896 1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa.exe vbc.exe PID 1896 wrote to memory of 1800 1896 1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa.exe vbc.exe PID 1280 wrote to memory of 692 1280 Explorer.EXE NETSTAT.EXE PID 1280 wrote to memory of 692 1280 Explorer.EXE NETSTAT.EXE PID 1280 wrote to memory of 692 1280 Explorer.EXE NETSTAT.EXE PID 1280 wrote to memory of 692 1280 Explorer.EXE NETSTAT.EXE PID 692 wrote to memory of 584 692 NETSTAT.EXE cmd.exe PID 692 wrote to memory of 584 692 NETSTAT.EXE cmd.exe PID 692 wrote to memory of 584 692 NETSTAT.EXE cmd.exe PID 692 wrote to memory of 584 692 NETSTAT.EXE cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa.exe"C:\Users\Admin\AppData\Local\Temp\1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\szlo4t0f\szlo4t0f.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA786.tmp" "c:\Users\Admin\AppData\Local\Temp\szlo4t0f\CSC9D5F2A3BA4FF476AB787BC71262C7BD2.TMP"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Gathers network information
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RESA786.tmpFilesize
1KB
MD57ede7103d621df14410444de94a8c9f0
SHA1436d5295ec73d5ad9093b58d7a042369097a1d6b
SHA25627ef490c6138c5796403897902283c736dd4f1dc998e967668385070786a13d6
SHA5127d3034fb6ebc00b11e983b01fb67e6ab7558cc672b8b7a05b8c1be5642682672fd46cd525432e897126cba0a5aecff6aebdf4a97c0fee24dd1d2be3604c4a08b
-
C:\Users\Admin\AppData\Local\Temp\szlo4t0f\szlo4t0f.dllFilesize
6KB
MD56f42214abb71f8658b53ce012696caf5
SHA1d70994e603ece2aa82e11279c234555891c8a1d3
SHA256ebb20e0ee25f967d35e25e120083582cdfc5489e988645649f15caaed90bf590
SHA512d5fb877e78c05a21de0ef02faa50c7e48bea9937ef10b3d1d833a60905fdc3b3decd969bc181f15a027b29472dab88bbcc1f29dec62c4cfb533c432a796ccf02
-
C:\Users\Admin\AppData\Local\Temp\szlo4t0f\szlo4t0f.pdbFilesize
15KB
MD5c97f91449fb85b0b6ab26c2d8fe98f65
SHA1784ea8e3528bfa287f51515eaeecd95807153075
SHA256782c895981ad8261e7aa4bf7da15af922bb921e30f85b1e75af0171bbbf3ebbd
SHA51262fa70f8b95e0ce45f26505873ec9a58ffc5c23339d1092698a48a39733ca9c1eb195990d1a134cc3027483ba4ddb07520bbb8860c99a4173dbc4d5cab15805e
-
C:\Users\Admin\AppData\Roaming\5Q6010RE\5Q6logim.jpegFilesize
46KB
MD533c9f5e461a03332a87b7b8f2dc1d0b0
SHA17fca5bb8f7977d7f6dbadb9e224c928d86a14d29
SHA256d116e607363d08694235f37f83fbddc6313575510036e2ffaf2a47ee5df047af
SHA5125b1cdcbc07e0dca4dde21790439414834894d4d4ff1cbbeebc6f4093a354e748ee0296c3022f93ffb920fb6a6c34b47867890715c6193386abd1a4c227fd66d1
-
C:\Users\Admin\AppData\Roaming\5Q6010RE\5Q6logri.iniFilesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\5Q6010RE\5Q6logrv.iniFilesize
40B
MD5ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf
-
\??\c:\Users\Admin\AppData\Local\Temp\szlo4t0f\CSC9D5F2A3BA4FF476AB787BC71262C7BD2.TMPFilesize
1KB
MD57c25f6ea846875b181560dd86fde02ab
SHA190dd8459d317917432a6a2634babfc5fff1676c2
SHA25607ffaf89b1af7ad2243ff2ca8d59d782fb869aa7d53f8e89e44421e6a4308ac1
SHA5127d32d4d0d1d9216a37727ee090b89cabeef168a0983c08352bb786525eaaf36d0bc2d73013dbc735ef6ac8bffe1f5dddfe1a8f8aa35bc49c33f2e59aafc81314
-
\??\c:\Users\Admin\AppData\Local\Temp\szlo4t0f\szlo4t0f.0.csFilesize
2KB
MD54b7bccbd0e3c7ad0e35494793d17069b
SHA14f12101636084c28935313568518f1292caae7ff
SHA25696cafa3320c3d870753c58b65fe3c05e2ffb343be959cfa316c4f6c34c4c60ea
SHA5124409b49e687fcd14a0457e3b9b422a34efe5e4c04d807f7156cb8b4f215b4f07537d134d48a168b766fdffbff5106f41e09585fe1eab86dfa2e894a2bf477de2
-
\??\c:\Users\Admin\AppData\Local\Temp\szlo4t0f\szlo4t0f.cmdlineFilesize
248B
MD55dd5b2f8427b0daa9590aa63ecb138dc
SHA1b9bffe098febdab86001000854207492124f12ea
SHA25696ecb6bf5a87e48db4e612928453316526b23d455462fee02961205540bacb46
SHA51205164935e5fddeca6fccba240f8eee139397046601c733798224bab6fa0161088e59f282de04c66b4c3704f2ef5515e1d8aed3ca7eefd0fe5c35a038a84d6e93
-
memory/584-79-0x0000000000000000-mapping.dmp
-
memory/692-80-0x0000000000A40000-0x0000000000A49000-memory.dmpFilesize
36KB
-
memory/692-77-0x0000000000000000-mapping.dmp
-
memory/692-86-0x00000000000E0000-0x000000000010A000-memory.dmpFilesize
168KB
-
memory/692-83-0x0000000000940000-0x00000000009D3000-memory.dmpFilesize
588KB
-
memory/692-82-0x00000000021F0000-0x00000000024F3000-memory.dmpFilesize
3.0MB
-
memory/692-81-0x00000000000E0000-0x000000000010A000-memory.dmpFilesize
168KB
-
memory/1280-87-0x00000000071D0000-0x000000000735D000-memory.dmpFilesize
1.6MB
-
memory/1280-85-0x0000000006AE0000-0x0000000006C6F000-memory.dmpFilesize
1.6MB
-
memory/1280-84-0x00000000071D0000-0x000000000735D000-memory.dmpFilesize
1.6MB
-
memory/1280-76-0x0000000006AE0000-0x0000000006C6F000-memory.dmpFilesize
1.6MB
-
memory/1800-72-0x000000000041B5F0-mapping.dmp
-
memory/1800-69-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1800-68-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1800-75-0x00000000002D0000-0x00000000002E4000-memory.dmpFilesize
80KB
-
memory/1800-78-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1800-74-0x0000000000930000-0x0000000000C33000-memory.dmpFilesize
3.0MB
-
memory/1896-54-0x0000000000FC0000-0x0000000000FFC000-memory.dmpFilesize
240KB
-
memory/1896-65-0x0000000000590000-0x000000000059C000-memory.dmpFilesize
48KB
-
memory/1896-64-0x00000000009F0000-0x0000000000A2A000-memory.dmpFilesize
232KB
-
memory/1896-67-0x0000000000BD0000-0x0000000000BFA000-memory.dmpFilesize
168KB
-
memory/1896-66-0x0000000075FC1000-0x0000000075FC3000-memory.dmpFilesize
8KB
-
memory/1896-63-0x00000000002F0000-0x00000000002F8000-memory.dmpFilesize
32KB
-
memory/1984-55-0x0000000000000000-mapping.dmp
-
memory/2028-58-0x0000000000000000-mapping.dmp