Analysis
-
max time kernel
147s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 07:15
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
General
-
Target
tmp.exe
-
Size
536KB
-
MD5
9e70e8a4f264cc5ef9c7cc2c0977ce7f
-
SHA1
2fdade7cace270aacb774b1079c99f80110da9e1
-
SHA256
712d9e2373914cd9231c6c55a5d919efa6df53194b2c06b03695501dde071760
-
SHA512
278b3662e35ee839e197c218e22b32e3f9885b53004dbde163d3e86e91a6e6abbeff9afc4e444181c16b0e75d2b274639870bcafb7b43a9568c88116be66d0da
Malware Config
Extracted
formbook
4.1
m56u
tercantiq.com
fortvillechicken.net
spiritsandtheb.com
alliant-inc.biz
yh1902.com
xiaodewenhua.net
cityjobs.xyz
seniorlivingwisconsin.com
piadagrilla.com
truistfinancebank.online
nft-fashionlover.com
hangmandownload.com
chun888.xyz
lemonviral.com
getagrip.network
daniellepinnock.info
chiswickstudios.com
essayservicee.com
bharatpragatifoundation.com
800vn.com
leslieskraftboutique.com
massimusdescanso.com
bastadidiabete.com
tufkase.com
fifyx.xyz
xn--hausarzt-lneburg-szb.com
healthcarecheap.com
minshangjt.com
therapistorangecounty.com
thehappyfinn.com
cannalytics-test.com
thejunglees.com
hotel-tuerkiye.com
80at39.com
elsiemckellar.com
jia-he.net
www-kerassentials.com
sang-pakar.xyz
bivirtual.com
ventul.online
mikateknik.xyz
comparazionequote.net
suffolkpolefitness.com
395136.com
kui88.xyz
keohps.com
laketarponresort.com
betaal.fyi
ekascollection.com
rawreporter.com
regionhere.xyz
theartistknownaskayla.com
bobbihub.com
ezviz.xyz
kiffiybeauty.com
mocthaotay.com
glacies-financial.com
altamahalife.com
jodeeluna.com
familylabsummit.com
oufsfaooqp.com
famaciaonlineveterinaria.com
jadooresurfb.info
yansonlineshop.com
pielearn.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/952-64-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/952-65-0x000000000041F140-mapping.dmp formbook behavioral1/memory/952-68-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2044-75-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook behavioral1/memory/2044-78-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1180 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmp.exetmp.exewlanext.exedescription pid process target process PID 1792 set thread context of 952 1792 tmp.exe tmp.exe PID 952 set thread context of 1252 952 tmp.exe Explorer.EXE PID 2044 set thread context of 1252 2044 wlanext.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
tmp.exewlanext.exepid process 952 tmp.exe 952 tmp.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe 2044 wlanext.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
tmp.exewlanext.exepid process 952 tmp.exe 952 tmp.exe 952 tmp.exe 2044 wlanext.exe 2044 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tmp.exewlanext.exedescription pid process Token: SeDebugPrivilege 952 tmp.exe Token: SeDebugPrivilege 2044 wlanext.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1252 Explorer.EXE 1252 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1252 Explorer.EXE 1252 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
tmp.exeExplorer.EXEwlanext.exedescription pid process target process PID 1792 wrote to memory of 952 1792 tmp.exe tmp.exe PID 1792 wrote to memory of 952 1792 tmp.exe tmp.exe PID 1792 wrote to memory of 952 1792 tmp.exe tmp.exe PID 1792 wrote to memory of 952 1792 tmp.exe tmp.exe PID 1792 wrote to memory of 952 1792 tmp.exe tmp.exe PID 1792 wrote to memory of 952 1792 tmp.exe tmp.exe PID 1792 wrote to memory of 952 1792 tmp.exe tmp.exe PID 1252 wrote to memory of 2044 1252 Explorer.EXE wlanext.exe PID 1252 wrote to memory of 2044 1252 Explorer.EXE wlanext.exe PID 1252 wrote to memory of 2044 1252 Explorer.EXE wlanext.exe PID 1252 wrote to memory of 2044 1252 Explorer.EXE wlanext.exe PID 2044 wrote to memory of 1180 2044 wlanext.exe cmd.exe PID 2044 wrote to memory of 1180 2044 wlanext.exe cmd.exe PID 2044 wrote to memory of 1180 2044 wlanext.exe cmd.exe PID 2044 wrote to memory of 1180 2044 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/952-67-0x0000000000A00000-0x0000000000D03000-memory.dmpFilesize
3.0MB
-
memory/952-69-0x0000000000150000-0x0000000000164000-memory.dmpFilesize
80KB
-
memory/952-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/952-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/952-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/952-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/952-65-0x000000000041F140-mapping.dmp
-
memory/1180-72-0x0000000000000000-mapping.dmp
-
memory/1252-79-0x0000000005F90000-0x000000000608F000-memory.dmpFilesize
1020KB
-
memory/1252-77-0x0000000005F90000-0x000000000608F000-memory.dmpFilesize
1020KB
-
memory/1252-70-0x0000000004360000-0x0000000004439000-memory.dmpFilesize
868KB
-
memory/1792-60-0x0000000000E50000-0x0000000000E84000-memory.dmpFilesize
208KB
-
memory/1792-54-0x0000000000FB0000-0x000000000103A000-memory.dmpFilesize
552KB
-
memory/1792-59-0x0000000004710000-0x000000000477E000-memory.dmpFilesize
440KB
-
memory/1792-58-0x0000000000640000-0x000000000064A000-memory.dmpFilesize
40KB
-
memory/1792-57-0x0000000006FF5000-0x0000000007006000-memory.dmpFilesize
68KB
-
memory/1792-56-0x00000000003B0000-0x00000000003C6000-memory.dmpFilesize
88KB
-
memory/1792-55-0x0000000075451000-0x0000000075453000-memory.dmpFilesize
8KB
-
memory/2044-71-0x0000000000000000-mapping.dmp
-
memory/2044-73-0x0000000000BD0000-0x0000000000BE6000-memory.dmpFilesize
88KB
-
memory/2044-74-0x0000000001FF0000-0x00000000022F3000-memory.dmpFilesize
3.0MB
-
memory/2044-75-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB
-
memory/2044-76-0x0000000000920000-0x00000000009B3000-memory.dmpFilesize
588KB
-
memory/2044-78-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB