Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
29-06-2022 17:19
Static task
static1
Behavioral task
behavioral1
Sample
triage_dropped_file.exe
Resource
win7-20220414-en
General
-
Target
triage_dropped_file.exe
-
Size
704KB
-
MD5
6b25cd644f183af7c7447ba2d658e8c5
-
SHA1
b3fee68e0d04e03c34ba546bc714096d13641815
-
SHA256
7952c76d1d86927893a2ef8ca0a23bb1b45af38565f2ad9cea09a942bd5059f8
-
SHA512
877ca781d89283c5bf7e26e45dce561d52c7a580aa08b172313443681494bf2aa24664a42ca95b6d88e76b43196c51997509098dd0979459ebe9ff48a6f658a9
Malware Config
Extracted
formbook
4.1
m56u
tercantiq.com
fortvillechicken.net
spiritsandtheb.com
alliant-inc.biz
yh1902.com
xiaodewenhua.net
cityjobs.xyz
seniorlivingwisconsin.com
piadagrilla.com
truistfinancebank.online
nft-fashionlover.com
hangmandownload.com
chun888.xyz
lemonviral.com
getagrip.network
daniellepinnock.info
chiswickstudios.com
essayservicee.com
bharatpragatifoundation.com
800vn.com
leslieskraftboutique.com
massimusdescanso.com
bastadidiabete.com
tufkase.com
fifyx.xyz
xn--hausarzt-lneburg-szb.com
healthcarecheap.com
minshangjt.com
therapistorangecounty.com
thehappyfinn.com
cannalytics-test.com
thejunglees.com
hotel-tuerkiye.com
80at39.com
elsiemckellar.com
jia-he.net
www-kerassentials.com
sang-pakar.xyz
bivirtual.com
ventul.online
mikateknik.xyz
comparazionequote.net
suffolkpolefitness.com
395136.com
kui88.xyz
keohps.com
laketarponresort.com
betaal.fyi
ekascollection.com
rawreporter.com
regionhere.xyz
theartistknownaskayla.com
bobbihub.com
ezviz.xyz
kiffiybeauty.com
mocthaotay.com
glacies-financial.com
altamahalife.com
jodeeluna.com
familylabsummit.com
oufsfaooqp.com
famaciaonlineveterinaria.com
jadooresurfb.info
yansonlineshop.com
pielearn.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1448-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1448-64-0x000000000041F140-mapping.dmp formbook behavioral1/memory/1448-66-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1448-74-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1132-77-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/1132-81-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1220 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
triage_dropped_file.exetriage_dropped_file.exeNETSTAT.EXEdescription pid process target process PID 836 set thread context of 1448 836 triage_dropped_file.exe triage_dropped_file.exe PID 1448 set thread context of 1404 1448 triage_dropped_file.exe Explorer.EXE PID 1448 set thread context of 1404 1448 triage_dropped_file.exe Explorer.EXE PID 1132 set thread context of 1404 1132 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 1132 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
triage_dropped_file.exeNETSTAT.EXEpid process 1448 triage_dropped_file.exe 1448 triage_dropped_file.exe 1448 triage_dropped_file.exe 1132 NETSTAT.EXE 1132 NETSTAT.EXE 1132 NETSTAT.EXE 1132 NETSTAT.EXE 1132 NETSTAT.EXE 1132 NETSTAT.EXE 1132 NETSTAT.EXE 1132 NETSTAT.EXE 1132 NETSTAT.EXE 1132 NETSTAT.EXE 1132 NETSTAT.EXE 1132 NETSTAT.EXE 1132 NETSTAT.EXE 1132 NETSTAT.EXE 1132 NETSTAT.EXE 1132 NETSTAT.EXE 1132 NETSTAT.EXE 1132 NETSTAT.EXE 1132 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
triage_dropped_file.exeNETSTAT.EXEpid process 1448 triage_dropped_file.exe 1448 triage_dropped_file.exe 1448 triage_dropped_file.exe 1448 triage_dropped_file.exe 1132 NETSTAT.EXE 1132 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
triage_dropped_file.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 1448 triage_dropped_file.exe Token: SeDebugPrivilege 1132 NETSTAT.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1404 Explorer.EXE 1404 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1404 Explorer.EXE 1404 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
triage_dropped_file.exetriage_dropped_file.exeNETSTAT.EXEdescription pid process target process PID 836 wrote to memory of 1448 836 triage_dropped_file.exe triage_dropped_file.exe PID 836 wrote to memory of 1448 836 triage_dropped_file.exe triage_dropped_file.exe PID 836 wrote to memory of 1448 836 triage_dropped_file.exe triage_dropped_file.exe PID 836 wrote to memory of 1448 836 triage_dropped_file.exe triage_dropped_file.exe PID 836 wrote to memory of 1448 836 triage_dropped_file.exe triage_dropped_file.exe PID 836 wrote to memory of 1448 836 triage_dropped_file.exe triage_dropped_file.exe PID 836 wrote to memory of 1448 836 triage_dropped_file.exe triage_dropped_file.exe PID 1448 wrote to memory of 1132 1448 triage_dropped_file.exe NETSTAT.EXE PID 1448 wrote to memory of 1132 1448 triage_dropped_file.exe NETSTAT.EXE PID 1448 wrote to memory of 1132 1448 triage_dropped_file.exe NETSTAT.EXE PID 1448 wrote to memory of 1132 1448 triage_dropped_file.exe NETSTAT.EXE PID 1132 wrote to memory of 1220 1132 NETSTAT.EXE cmd.exe PID 1132 wrote to memory of 1220 1132 NETSTAT.EXE cmd.exe PID 1132 wrote to memory of 1220 1132 NETSTAT.EXE cmd.exe PID 1132 wrote to memory of 1220 1132 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"4⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"5⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/836-54-0x00000000002D0000-0x0000000000386000-memory.dmpFilesize
728KB
-
memory/836-55-0x0000000075721000-0x0000000075723000-memory.dmpFilesize
8KB
-
memory/836-56-0x00000000004F0000-0x0000000000506000-memory.dmpFilesize
88KB
-
memory/836-57-0x0000000000500000-0x000000000050A000-memory.dmpFilesize
40KB
-
memory/836-58-0x0000000005010000-0x000000000507C000-memory.dmpFilesize
432KB
-
memory/836-59-0x00000000020E0000-0x0000000002114000-memory.dmpFilesize
208KB
-
memory/1132-81-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1132-73-0x0000000000000000-mapping.dmp
-
memory/1132-79-0x0000000001F80000-0x0000000002013000-memory.dmpFilesize
588KB
-
memory/1132-77-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1132-78-0x0000000002250000-0x0000000002553000-memory.dmpFilesize
3.0MB
-
memory/1132-76-0x0000000000850000-0x0000000000859000-memory.dmpFilesize
36KB
-
memory/1220-75-0x0000000000000000-mapping.dmp
-
memory/1404-82-0x0000000006CF0000-0x0000000006DD3000-memory.dmpFilesize
908KB
-
memory/1404-80-0x0000000006CF0000-0x0000000006DD3000-memory.dmpFilesize
908KB
-
memory/1404-69-0x0000000004DD0000-0x0000000004F7A000-memory.dmpFilesize
1.7MB
-
memory/1404-72-0x0000000007720000-0x00000000078CB000-memory.dmpFilesize
1.7MB
-
memory/1448-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1448-74-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1448-71-0x0000000000250000-0x0000000000264000-memory.dmpFilesize
80KB
-
memory/1448-68-0x0000000000180000-0x0000000000194000-memory.dmpFilesize
80KB
-
memory/1448-67-0x00000000009E0000-0x0000000000CE3000-memory.dmpFilesize
3.0MB
-
memory/1448-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1448-64-0x000000000041F140-mapping.dmp
-
memory/1448-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1448-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB