Analysis
-
max time kernel
148s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-07-2022 14:32
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7-20220414-en
General
-
Target
vbc.exe
-
Size
545KB
-
MD5
02a99e9171b3118afeddaa1e051ce765
-
SHA1
46ef8e1d17b9b7743a025d9e08fc357fd0c0abe4
-
SHA256
40ed94480e803c385fd0def0efcba1c9f5e6e52056a5793fdac140066a410eb2
-
SHA512
2e0e74ba6b3d335c892ad22a3e57c41fd8a934663efc0fa7698ac113990742f3b61cd552decf828d10fc51acbea3794759e73e93e5ede04e897ab326b022761f
Malware Config
Extracted
formbook
4.1
p63n
personalrecargas-arg.com
headsetaccessories.xyz
sunriseboutique21.com
ubeafrika.com
shopnyoot.com
driverksa.info
ilikespeedracer.net
akdambakdam.com
bethe1responder.com
gfhd.online
n9bot.site
hstyz.com
buyresellerdomain.com
matoaciganjur.com
mainlineb.com
q385-yogen.net
squamation.top
thebeardedcrow.com
cannaverse.xyz
cracksoftpc.net
hertok.online
mopygames.com
certifiedtechdirect.mobi
kahramanmarasgayrimenkul.com
wormbooklibrary.com
advisernutrition.info
frldsend.space
cavoc.xyz
hinsbrookbank.com
beertime.xyz
dollarvigilante247.com
veriprofessional.online
dresstheblacksheep.com
bunchichi.info
psyiqhpxrjwsmve.com
jelloartisan.com
hbqygl.com
klariondesigns.com
brightmindsahead.community
oliverpeoplesmalaysia.com
bidentist.xyz
ayurvedicyoggram.com
nataliestrachey.club
marktplatz-mannheim.com
newwebsitee.com
97089e.com
nikeboy1001.xyz
americanase.com
webster-sports.com
medivirtus.com
mdyy30.xyz
churchill.beauty
jacdia.com
sdlkrth.xyz
jun88k.net
tjetrainline.com
catscheck.com
lkfs.media
ggbcc.net
ytbwgeerw.space
marketingent.xyz
carollourieri.com
kawakamiph.com
topframelessglass.com
rainwaterbotanicals.store
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1548-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1548-64-0x000000000041F1D0-mapping.dmp formbook behavioral1/memory/1548-66-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1524-73-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/1524-77-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.exechkdsk.exedescription pid process target process PID 1612 set thread context of 1548 1612 vbc.exe vbc.exe PID 1548 set thread context of 1268 1548 vbc.exe Explorer.EXE PID 1524 set thread context of 1268 1524 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
vbc.exevbc.exechkdsk.exepid process 1612 vbc.exe 1612 vbc.exe 1548 vbc.exe 1548 vbc.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exechkdsk.exepid process 1548 vbc.exe 1548 vbc.exe 1548 vbc.exe 1524 chkdsk.exe 1524 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vbc.exevbc.exechkdsk.exedescription pid process Token: SeDebugPrivilege 1612 vbc.exe Token: SeDebugPrivilege 1548 vbc.exe Token: SeDebugPrivilege 1524 chkdsk.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
vbc.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1612 wrote to memory of 1736 1612 vbc.exe vbc.exe PID 1612 wrote to memory of 1736 1612 vbc.exe vbc.exe PID 1612 wrote to memory of 1736 1612 vbc.exe vbc.exe PID 1612 wrote to memory of 1736 1612 vbc.exe vbc.exe PID 1612 wrote to memory of 316 1612 vbc.exe vbc.exe PID 1612 wrote to memory of 316 1612 vbc.exe vbc.exe PID 1612 wrote to memory of 316 1612 vbc.exe vbc.exe PID 1612 wrote to memory of 316 1612 vbc.exe vbc.exe PID 1612 wrote to memory of 1548 1612 vbc.exe vbc.exe PID 1612 wrote to memory of 1548 1612 vbc.exe vbc.exe PID 1612 wrote to memory of 1548 1612 vbc.exe vbc.exe PID 1612 wrote to memory of 1548 1612 vbc.exe vbc.exe PID 1612 wrote to memory of 1548 1612 vbc.exe vbc.exe PID 1612 wrote to memory of 1548 1612 vbc.exe vbc.exe PID 1612 wrote to memory of 1548 1612 vbc.exe vbc.exe PID 1268 wrote to memory of 1524 1268 Explorer.EXE chkdsk.exe PID 1268 wrote to memory of 1524 1268 Explorer.EXE chkdsk.exe PID 1268 wrote to memory of 1524 1268 Explorer.EXE chkdsk.exe PID 1268 wrote to memory of 1524 1268 Explorer.EXE chkdsk.exe PID 1524 wrote to memory of 472 1524 chkdsk.exe cmd.exe PID 1524 wrote to memory of 472 1524 chkdsk.exe cmd.exe PID 1524 wrote to memory of 472 1524 chkdsk.exe cmd.exe PID 1524 wrote to memory of 472 1524 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/472-71-0x0000000000000000-mapping.dmp
-
memory/1268-69-0x00000000063C0000-0x0000000006546000-memory.dmpFilesize
1.5MB
-
memory/1268-78-0x0000000004D50000-0x0000000004DF3000-memory.dmpFilesize
652KB
-
memory/1268-76-0x0000000004D50000-0x0000000004DF3000-memory.dmpFilesize
652KB
-
memory/1524-77-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1524-75-0x0000000000A80000-0x0000000000B14000-memory.dmpFilesize
592KB
-
memory/1524-74-0x0000000002140000-0x0000000002443000-memory.dmpFilesize
3.0MB
-
memory/1524-73-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1524-72-0x0000000000BA0000-0x0000000000BA7000-memory.dmpFilesize
28KB
-
memory/1524-70-0x0000000000000000-mapping.dmp
-
memory/1548-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1548-67-0x0000000000A20000-0x0000000000D23000-memory.dmpFilesize
3.0MB
-
memory/1548-68-0x0000000000630000-0x0000000000645000-memory.dmpFilesize
84KB
-
memory/1548-64-0x000000000041F1D0-mapping.dmp
-
memory/1548-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1548-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1548-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1612-54-0x00000000001D0000-0x000000000025E000-memory.dmpFilesize
568KB
-
memory/1612-59-0x00000000006E0000-0x0000000000714000-memory.dmpFilesize
208KB
-
memory/1612-58-0x0000000005AC0000-0x0000000005B2C000-memory.dmpFilesize
432KB
-
memory/1612-57-0x00000000004E0000-0x00000000004EA000-memory.dmpFilesize
40KB
-
memory/1612-56-0x00000000003A0000-0x00000000003BC000-memory.dmpFilesize
112KB
-
memory/1612-55-0x0000000076531000-0x0000000076533000-memory.dmpFilesize
8KB