Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
06-07-2022 13:43
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
General
-
Target
tmp.exe
-
Size
770KB
-
MD5
4f4ffe55d08d242d9b54ec21f01549de
-
SHA1
4792ee54fadeeb6bc8a26982b1bfc8fa58cd1d66
-
SHA256
27d5408961dba9baf42c42b2574c863ccf523ee98fb0648559b733dd52fb37dc
-
SHA512
ffa14345a9791fac0a0fafd3ddb3fac8912f098615bdd1b7a287109eb2a223044c8180f4321218202b2ad06015d33936d610abe57336c7c9cfcd278d0e26b9fa
Malware Config
Extracted
formbook
4.1
s0s2
stripe-forecast.com
perfectingnextstage.com
primarole.com
nonnydesigns.com
wordsofweightandlevity.com
mafleursam.com
hardwarepicker.tech
minex-intl.com
thenextbigtech.net
rabeproject.com
sticktogracestudio.com
releve.space
readoku.net
carings.net
nasdaq-ex.store
au-techng.com
thethoughtgenius.com
how-to-learn-languages.net
kitabisabelanja.com
awndka.xyz
bretholdings.com
boscue.com
titantechmail.com
jadacomercializadora.com
shirtgse.online
derechoromano.com
yatirimtamam.com
gektolicompany.xyz
skyglowtech.com
67f5ead1a275.info
emnopgroup.com
lermontov.online
roshmary.com
goodandperfectgift.com
landliner.taxi
bhui7.com
barq-id.com
thevirtualcafe.net
176bwcx.com
zorbaplus.com
zzbb8899.xyz
magictvshow.com
serengetifadhions.com
ryzcn.com
amsordglobal.com
biznes-poznan24.xyz
globalepic10x.com
carrotshelter.com
keiwaseitai.online
energyecuador.net
kinsgtonbrass.com
cankaoao.com
mybullion.net
zjzcmy.net
businedstrack.com
mayipaimai.com
minijob-duesseldorf.net
gcpropolis.com
liwoo.top
glitzye.com
doca29.site
joselynbaezs.com
purchase614210.com
wojiayouxuan.com
dailycuatudong.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4204-136-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4204-142-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2484-146-0x0000000000D70000-0x0000000000D9F000-memory.dmp formbook behavioral2/memory/2484-147-0x0000000000D70000-0x0000000000D9F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmp.exetmp.exesvchost.exedescription pid process target process PID 4968 set thread context of 4204 4968 tmp.exe tmp.exe PID 4204 set thread context of 2040 4204 tmp.exe Explorer.EXE PID 2484 set thread context of 2040 2484 svchost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
tmp.exetmp.exesvchost.exepid process 4968 tmp.exe 4968 tmp.exe 4968 tmp.exe 4968 tmp.exe 4968 tmp.exe 4968 tmp.exe 4968 tmp.exe 4968 tmp.exe 4968 tmp.exe 4968 tmp.exe 4204 tmp.exe 4204 tmp.exe 4204 tmp.exe 4204 tmp.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2040 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
tmp.exesvchost.exepid process 4204 tmp.exe 4204 tmp.exe 4204 tmp.exe 2484 svchost.exe 2484 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
tmp.exetmp.exesvchost.exedescription pid process Token: SeDebugPrivilege 4968 tmp.exe Token: SeDebugPrivilege 4204 tmp.exe Token: SeDebugPrivilege 2484 svchost.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
tmp.exeExplorer.EXEsvchost.exedescription pid process target process PID 4968 wrote to memory of 4204 4968 tmp.exe tmp.exe PID 4968 wrote to memory of 4204 4968 tmp.exe tmp.exe PID 4968 wrote to memory of 4204 4968 tmp.exe tmp.exe PID 4968 wrote to memory of 4204 4968 tmp.exe tmp.exe PID 4968 wrote to memory of 4204 4968 tmp.exe tmp.exe PID 4968 wrote to memory of 4204 4968 tmp.exe tmp.exe PID 2040 wrote to memory of 2484 2040 Explorer.EXE svchost.exe PID 2040 wrote to memory of 2484 2040 Explorer.EXE svchost.exe PID 2040 wrote to memory of 2484 2040 Explorer.EXE svchost.exe PID 2484 wrote to memory of 1188 2484 svchost.exe cmd.exe PID 2484 wrote to memory of 1188 2484 svchost.exe cmd.exe PID 2484 wrote to memory of 1188 2484 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1188-143-0x0000000000000000-mapping.dmp
-
memory/2040-140-0x00000000080B0000-0x0000000008215000-memory.dmpFilesize
1.4MB
-
memory/2040-150-0x00000000029C0000-0x0000000002A62000-memory.dmpFilesize
648KB
-
memory/2040-149-0x00000000029C0000-0x0000000002A62000-memory.dmpFilesize
648KB
-
memory/2484-145-0x0000000001A00000-0x0000000001D4A000-memory.dmpFilesize
3.3MB
-
memory/2484-141-0x0000000000000000-mapping.dmp
-
memory/2484-148-0x00000000018A0000-0x0000000001933000-memory.dmpFilesize
588KB
-
memory/2484-147-0x0000000000D70000-0x0000000000D9F000-memory.dmpFilesize
188KB
-
memory/2484-146-0x0000000000D70000-0x0000000000D9F000-memory.dmpFilesize
188KB
-
memory/2484-144-0x00000000002F0000-0x00000000002FE000-memory.dmpFilesize
56KB
-
memory/4204-142-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4204-135-0x0000000000000000-mapping.dmp
-
memory/4204-139-0x0000000001040000-0x0000000001054000-memory.dmpFilesize
80KB
-
memory/4204-138-0x0000000001080000-0x00000000013CA000-memory.dmpFilesize
3.3MB
-
memory/4204-136-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4968-133-0x0000000007790000-0x000000000779A000-memory.dmpFilesize
40KB
-
memory/4968-134-0x000000000B2F0000-0x000000000B38C000-memory.dmpFilesize
624KB
-
memory/4968-130-0x00000000003C0000-0x0000000000488000-memory.dmpFilesize
800KB
-
memory/4968-132-0x0000000007800000-0x0000000007892000-memory.dmpFilesize
584KB
-
memory/4968-131-0x0000000007C10000-0x00000000081B4000-memory.dmpFilesize
5.6MB