Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
06-07-2022 07:15
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
General
-
Target
tmp.exe
-
Size
536KB
-
MD5
9e70e8a4f264cc5ef9c7cc2c0977ce7f
-
SHA1
2fdade7cace270aacb774b1079c99f80110da9e1
-
SHA256
712d9e2373914cd9231c6c55a5d919efa6df53194b2c06b03695501dde071760
-
SHA512
278b3662e35ee839e197c218e22b32e3f9885b53004dbde163d3e86e91a6e6abbeff9afc4e444181c16b0e75d2b274639870bcafb7b43a9568c88116be66d0da
Malware Config
Extracted
formbook
4.1
m56u
tercantiq.com
fortvillechicken.net
spiritsandtheb.com
alliant-inc.biz
yh1902.com
xiaodewenhua.net
cityjobs.xyz
seniorlivingwisconsin.com
piadagrilla.com
truistfinancebank.online
nft-fashionlover.com
hangmandownload.com
chun888.xyz
lemonviral.com
getagrip.network
daniellepinnock.info
chiswickstudios.com
essayservicee.com
bharatpragatifoundation.com
800vn.com
leslieskraftboutique.com
massimusdescanso.com
bastadidiabete.com
tufkase.com
fifyx.xyz
xn--hausarzt-lneburg-szb.com
healthcarecheap.com
minshangjt.com
therapistorangecounty.com
thehappyfinn.com
cannalytics-test.com
thejunglees.com
hotel-tuerkiye.com
80at39.com
elsiemckellar.com
jia-he.net
www-kerassentials.com
sang-pakar.xyz
bivirtual.com
ventul.online
mikateknik.xyz
comparazionequote.net
suffolkpolefitness.com
395136.com
kui88.xyz
keohps.com
laketarponresort.com
betaal.fyi
ekascollection.com
rawreporter.com
regionhere.xyz
theartistknownaskayla.com
bobbihub.com
ezviz.xyz
kiffiybeauty.com
mocthaotay.com
glacies-financial.com
altamahalife.com
jodeeluna.com
familylabsummit.com
oufsfaooqp.com
famaciaonlineveterinaria.com
jadooresurfb.info
yansonlineshop.com
pielearn.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2032-135-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2032-141-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1952-144-0x0000000000840000-0x000000000086F000-memory.dmp formbook behavioral2/memory/1952-148-0x0000000000840000-0x000000000086F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmp.exetmp.execscript.exedescription pid process target process PID 3684 set thread context of 2032 3684 tmp.exe tmp.exe PID 2032 set thread context of 2896 2032 tmp.exe Explorer.EXE PID 1952 set thread context of 2896 1952 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
tmp.execscript.exepid process 2032 tmp.exe 2032 tmp.exe 2032 tmp.exe 2032 tmp.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe 1952 cscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2896 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
tmp.execscript.exepid process 2032 tmp.exe 2032 tmp.exe 2032 tmp.exe 1952 cscript.exe 1952 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tmp.execscript.exedescription pid process Token: SeDebugPrivilege 2032 tmp.exe Token: SeDebugPrivilege 1952 cscript.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
tmp.exeExplorer.EXEcscript.exedescription pid process target process PID 3684 wrote to memory of 2032 3684 tmp.exe tmp.exe PID 3684 wrote to memory of 2032 3684 tmp.exe tmp.exe PID 3684 wrote to memory of 2032 3684 tmp.exe tmp.exe PID 3684 wrote to memory of 2032 3684 tmp.exe tmp.exe PID 3684 wrote to memory of 2032 3684 tmp.exe tmp.exe PID 3684 wrote to memory of 2032 3684 tmp.exe tmp.exe PID 2896 wrote to memory of 1952 2896 Explorer.EXE cscript.exe PID 2896 wrote to memory of 1952 2896 Explorer.EXE cscript.exe PID 2896 wrote to memory of 1952 2896 Explorer.EXE cscript.exe PID 1952 wrote to memory of 4460 1952 cscript.exe cmd.exe PID 1952 wrote to memory of 4460 1952 cscript.exe cmd.exe PID 1952 wrote to memory of 4460 1952 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1952-140-0x0000000000000000-mapping.dmp
-
memory/1952-148-0x0000000000840000-0x000000000086F000-memory.dmpFilesize
188KB
-
memory/1952-146-0x00000000029C0000-0x0000000002A53000-memory.dmpFilesize
588KB
-
memory/1952-145-0x0000000002B90000-0x0000000002EDA000-memory.dmpFilesize
3.3MB
-
memory/1952-144-0x0000000000840000-0x000000000086F000-memory.dmpFilesize
188KB
-
memory/1952-143-0x0000000000950000-0x0000000000977000-memory.dmpFilesize
156KB
-
memory/2032-134-0x0000000000000000-mapping.dmp
-
memory/2032-138-0x0000000001580000-0x0000000001594000-memory.dmpFilesize
80KB
-
memory/2032-137-0x00000000015A0000-0x00000000018EA000-memory.dmpFilesize
3.3MB
-
memory/2032-141-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2032-135-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2896-139-0x00000000080D0000-0x0000000008251000-memory.dmpFilesize
1.5MB
-
memory/2896-147-0x0000000008670000-0x00000000087DF000-memory.dmpFilesize
1.4MB
-
memory/2896-149-0x0000000008670000-0x00000000087DF000-memory.dmpFilesize
1.4MB
-
memory/3684-130-0x0000000000950000-0x00000000009DA000-memory.dmpFilesize
552KB
-
memory/3684-133-0x000000000B4E0000-0x000000000B57C000-memory.dmpFilesize
624KB
-
memory/3684-132-0x0000000007A00000-0x0000000007A92000-memory.dmpFilesize
584KB
-
memory/3684-131-0x0000000007EC0000-0x0000000008464000-memory.dmpFilesize
5.6MB
-
memory/4460-142-0x0000000000000000-mapping.dmp