Analysis
-
max time kernel
146s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 13:29
Static task
static1
Behavioral task
behavioral1
Sample
Irrazvdr.exe
Resource
win7-20220414-en
General
-
Target
Irrazvdr.exe
-
Size
54KB
-
MD5
cedb27004e2fbaf88af7850aaf5133b0
-
SHA1
1ea8386b3a52bb32ae24f41ba0ef4f912eada74c
-
SHA256
2cbb67b48b3162ce44c224d9230d58a4263e71a50ca82673477d2e14f7ae2087
-
SHA512
3dd1a35ab8d59db4b933190906e9d039459c8d7e39849819d6ba9ac214f57f826bf6ab3342f132971b104016779035704efb1dd5e000af1419e83a0060a79521
Malware Config
Extracted
formbook
4.1
ca27
sefacoin.com
rightvisionsecuritysystems.com
jthousing1509.com
bj-sfxh.com
fansdy.com
waltit.com
kgaelhp.icu
latil.sa.com
ethmerger.com
theunimarkgroup.com
51anb.com
betsinatra.com
asd3wuh.icu
vinissimo3gwen.xyz
supernewshub.site
asfq4ev.icu
nftstoremarketing.com
blondefitgal.com
zmsoftware-co.com
beedotech.net
u9baoku.com
mmzaixianluobbyykk520.net
ciplasterrepair.com
kadantasarim.site
spacexunit.com
tkdown.net
ronandrumm.com
beeg.run
tunatak.site
funroomintentionhall.com
sskylar.com
rutoai.online
dex-offering.space
herbspeedycolorcream.com
kgs117p.icu
hupengfang.com
inferiorstudio.com
comfortableundies.com
asscuxt.icu
yhqt.art
kgr8yq8.icu
metalsroot.com
diarioliga.com
sense8candles.xyz
ebonysexdreams.com
siawase11.com
kg3nx4p.icu
coinbaseclasaction.com
exee.fr
njcjpx.com
news-journals.com
sdil.online
junction55.com
asq42hg.icu
mars.care
jeanbezy.com
uponmeat.com
eq5sense.com
gelinator.com
drcarlosarica.com
123sgw.com
productos-mascotas.com
simplylocals.store
klandesphoto.com
calebdowdy.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/588-61-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/588-62-0x000000000041F060-mapping.dmp formbook behavioral1/memory/588-67-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/588-71-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1872-74-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/1872-78-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Irrazvdr.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ozqvf = "\"C:\\Users\\Admin\\AppData\\Roaming\\Ovjur\\Ozqvf.exe\"" Irrazvdr.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Irrazvdr.exeInstallUtil.exesystray.exedescription pid process target process PID 1836 set thread context of 588 1836 Irrazvdr.exe InstallUtil.exe PID 588 set thread context of 1264 588 InstallUtil.exe Explorer.EXE PID 588 set thread context of 1264 588 InstallUtil.exe Explorer.EXE PID 1872 set thread context of 1264 1872 systray.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
Irrazvdr.exeInstallUtil.exesystray.exepid process 1836 Irrazvdr.exe 588 InstallUtil.exe 588 InstallUtil.exe 588 InstallUtil.exe 1872 systray.exe 1872 systray.exe 1872 systray.exe 1872 systray.exe 1872 systray.exe 1872 systray.exe 1872 systray.exe 1872 systray.exe 1872 systray.exe 1872 systray.exe 1872 systray.exe 1872 systray.exe 1872 systray.exe 1872 systray.exe 1872 systray.exe 1872 systray.exe 1872 systray.exe 1872 systray.exe 1872 systray.exe 1872 systray.exe 1872 systray.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
InstallUtil.exesystray.exepid process 588 InstallUtil.exe 588 InstallUtil.exe 588 InstallUtil.exe 588 InstallUtil.exe 1872 systray.exe 1872 systray.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Irrazvdr.exeInstallUtil.exesystray.exedescription pid process Token: SeDebugPrivilege 1836 Irrazvdr.exe Token: SeDebugPrivilege 588 InstallUtil.exe Token: SeDebugPrivilege 1872 systray.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Irrazvdr.exeInstallUtil.exesystray.exedescription pid process target process PID 1836 wrote to memory of 588 1836 Irrazvdr.exe InstallUtil.exe PID 1836 wrote to memory of 588 1836 Irrazvdr.exe InstallUtil.exe PID 1836 wrote to memory of 588 1836 Irrazvdr.exe InstallUtil.exe PID 1836 wrote to memory of 588 1836 Irrazvdr.exe InstallUtil.exe PID 1836 wrote to memory of 588 1836 Irrazvdr.exe InstallUtil.exe PID 1836 wrote to memory of 588 1836 Irrazvdr.exe InstallUtil.exe PID 1836 wrote to memory of 588 1836 Irrazvdr.exe InstallUtil.exe PID 1836 wrote to memory of 588 1836 Irrazvdr.exe InstallUtil.exe PID 1836 wrote to memory of 588 1836 Irrazvdr.exe InstallUtil.exe PID 1836 wrote to memory of 588 1836 Irrazvdr.exe InstallUtil.exe PID 588 wrote to memory of 1872 588 InstallUtil.exe systray.exe PID 588 wrote to memory of 1872 588 InstallUtil.exe systray.exe PID 588 wrote to memory of 1872 588 InstallUtil.exe systray.exe PID 588 wrote to memory of 1872 588 InstallUtil.exe systray.exe PID 1872 wrote to memory of 1792 1872 systray.exe cmd.exe PID 1872 wrote to memory of 1792 1872 systray.exe cmd.exe PID 1872 wrote to memory of 1792 1872 systray.exe cmd.exe PID 1872 wrote to memory of 1792 1872 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\Irrazvdr.exe"C:\Users\Admin\AppData\Local\Temp\Irrazvdr.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/588-68-0x00000000001F0000-0x0000000000205000-memory.dmpFilesize
84KB
-
memory/588-65-0x0000000000160000-0x0000000000175000-memory.dmpFilesize
84KB
-
memory/588-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/588-71-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/588-58-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/588-59-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/588-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/588-62-0x000000000041F060-mapping.dmp
-
memory/588-64-0x00000000008F0000-0x0000000000BF3000-memory.dmpFilesize
3.0MB
-
memory/1264-77-0x0000000003E20000-0x0000000003EDA000-memory.dmpFilesize
744KB
-
memory/1264-69-0x0000000004FD0000-0x0000000005100000-memory.dmpFilesize
1.2MB
-
memory/1264-66-0x0000000004E20000-0x0000000004FC2000-memory.dmpFilesize
1.6MB
-
memory/1264-79-0x0000000003E20000-0x0000000003EDA000-memory.dmpFilesize
744KB
-
memory/1792-72-0x0000000000000000-mapping.dmp
-
memory/1836-54-0x0000000000090000-0x00000000000A2000-memory.dmpFilesize
72KB
-
memory/1836-57-0x0000000004AD0000-0x0000000004B1C000-memory.dmpFilesize
304KB
-
memory/1836-56-0x0000000004E10000-0x0000000004EB6000-memory.dmpFilesize
664KB
-
memory/1836-55-0x0000000074F91000-0x0000000074F93000-memory.dmpFilesize
8KB
-
memory/1872-70-0x0000000000000000-mapping.dmp
-
memory/1872-73-0x0000000000E10000-0x0000000000E15000-memory.dmpFilesize
20KB
-
memory/1872-74-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1872-75-0x0000000002220000-0x0000000002523000-memory.dmpFilesize
3.0MB
-
memory/1872-76-0x0000000000960000-0x00000000009F4000-memory.dmpFilesize
592KB
-
memory/1872-78-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB