Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 13:43
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
General
-
Target
tmp.exe
-
Size
770KB
-
MD5
4f4ffe55d08d242d9b54ec21f01549de
-
SHA1
4792ee54fadeeb6bc8a26982b1bfc8fa58cd1d66
-
SHA256
27d5408961dba9baf42c42b2574c863ccf523ee98fb0648559b733dd52fb37dc
-
SHA512
ffa14345a9791fac0a0fafd3ddb3fac8912f098615bdd1b7a287109eb2a223044c8180f4321218202b2ad06015d33936d610abe57336c7c9cfcd278d0e26b9fa
Malware Config
Extracted
formbook
4.1
s0s2
stripe-forecast.com
perfectingnextstage.com
primarole.com
nonnydesigns.com
wordsofweightandlevity.com
mafleursam.com
hardwarepicker.tech
minex-intl.com
thenextbigtech.net
rabeproject.com
sticktogracestudio.com
releve.space
readoku.net
carings.net
nasdaq-ex.store
au-techng.com
thethoughtgenius.com
how-to-learn-languages.net
kitabisabelanja.com
awndka.xyz
bretholdings.com
boscue.com
titantechmail.com
jadacomercializadora.com
shirtgse.online
derechoromano.com
yatirimtamam.com
gektolicompany.xyz
skyglowtech.com
67f5ead1a275.info
emnopgroup.com
lermontov.online
roshmary.com
goodandperfectgift.com
landliner.taxi
bhui7.com
barq-id.com
thevirtualcafe.net
176bwcx.com
zorbaplus.com
zzbb8899.xyz
magictvshow.com
serengetifadhions.com
ryzcn.com
amsordglobal.com
biznes-poznan24.xyz
globalepic10x.com
carrotshelter.com
keiwaseitai.online
energyecuador.net
kinsgtonbrass.com
cankaoao.com
mybullion.net
zjzcmy.net
businedstrack.com
mayipaimai.com
minijob-duesseldorf.net
gcpropolis.com
liwoo.top
glitzye.com
doca29.site
joselynbaezs.com
purchase614210.com
wojiayouxuan.com
dailycuatudong.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1308-62-0x000000000041F110-mapping.dmp formbook behavioral1/memory/1308-61-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1308-64-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1836-71-0x0000000000070000-0x000000000009F000-memory.dmp formbook behavioral1/memory/1836-76-0x0000000000070000-0x000000000009F000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
wscript.exeflow pid process 12 1836 wscript.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1932 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmp.exetmp.exewscript.exedescription pid process target process PID 1416 set thread context of 1308 1416 tmp.exe tmp.exe PID 1308 set thread context of 1220 1308 tmp.exe Explorer.EXE PID 1836 set thread context of 1220 1836 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
tmp.exetmp.exewscript.exepid process 1416 tmp.exe 1416 tmp.exe 1416 tmp.exe 1416 tmp.exe 1416 tmp.exe 1416 tmp.exe 1416 tmp.exe 1308 tmp.exe 1308 tmp.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
tmp.exewscript.exepid process 1308 tmp.exe 1308 tmp.exe 1308 tmp.exe 1836 wscript.exe 1836 wscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
tmp.exetmp.exewscript.exedescription pid process Token: SeDebugPrivilege 1416 tmp.exe Token: SeDebugPrivilege 1308 tmp.exe Token: SeDebugPrivilege 1836 wscript.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
tmp.exeExplorer.EXEwscript.exedescription pid process target process PID 1416 wrote to memory of 1308 1416 tmp.exe tmp.exe PID 1416 wrote to memory of 1308 1416 tmp.exe tmp.exe PID 1416 wrote to memory of 1308 1416 tmp.exe tmp.exe PID 1416 wrote to memory of 1308 1416 tmp.exe tmp.exe PID 1416 wrote to memory of 1308 1416 tmp.exe tmp.exe PID 1416 wrote to memory of 1308 1416 tmp.exe tmp.exe PID 1416 wrote to memory of 1308 1416 tmp.exe tmp.exe PID 1220 wrote to memory of 1836 1220 Explorer.EXE wscript.exe PID 1220 wrote to memory of 1836 1220 Explorer.EXE wscript.exe PID 1220 wrote to memory of 1836 1220 Explorer.EXE wscript.exe PID 1220 wrote to memory of 1836 1220 Explorer.EXE wscript.exe PID 1836 wrote to memory of 1932 1836 wscript.exe cmd.exe PID 1836 wrote to memory of 1932 1836 wscript.exe cmd.exe PID 1836 wrote to memory of 1932 1836 wscript.exe cmd.exe PID 1836 wrote to memory of 1932 1836 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1220-67-0x0000000004020000-0x0000000004160000-memory.dmpFilesize
1.2MB
-
memory/1220-77-0x0000000004BD0000-0x0000000004C8C000-memory.dmpFilesize
752KB
-
memory/1220-75-0x0000000004020000-0x0000000004160000-memory.dmpFilesize
1.2MB
-
memory/1220-74-0x0000000004BD0000-0x0000000004C8C000-memory.dmpFilesize
752KB
-
memory/1308-66-0x0000000000270000-0x0000000000284000-memory.dmpFilesize
80KB
-
memory/1308-59-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1308-62-0x000000000041F110-mapping.dmp
-
memory/1308-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1308-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1308-58-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1308-65-0x0000000000BA0000-0x0000000000EA3000-memory.dmpFilesize
3.0MB
-
memory/1416-54-0x0000000000AD0000-0x0000000000B98000-memory.dmpFilesize
800KB
-
memory/1416-55-0x0000000000440000-0x0000000000456000-memory.dmpFilesize
88KB
-
memory/1416-56-0x0000000008350000-0x00000000083BE000-memory.dmpFilesize
440KB
-
memory/1416-57-0x0000000004920000-0x0000000004954000-memory.dmpFilesize
208KB
-
memory/1836-73-0x00000000004C0000-0x0000000000553000-memory.dmpFilesize
588KB
-
memory/1836-71-0x0000000000070000-0x000000000009F000-memory.dmpFilesize
188KB
-
memory/1836-72-0x00000000021C0000-0x00000000024C3000-memory.dmpFilesize
3.0MB
-
memory/1836-70-0x0000000000D90000-0x0000000000DB6000-memory.dmpFilesize
152KB
-
memory/1836-76-0x0000000000070000-0x000000000009F000-memory.dmpFilesize
188KB
-
memory/1836-68-0x0000000000000000-mapping.dmp
-
memory/1836-78-0x00000000764C1000-0x00000000764C3000-memory.dmpFilesize
8KB
-
memory/1932-69-0x0000000000000000-mapping.dmp