Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 20:00
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
General
-
Target
tmp.exe
-
Size
538KB
-
MD5
c0138bfa58d20206600eaf1657f95f75
-
SHA1
fa232e4df93c81093044ff552381d41ebcc5f443
-
SHA256
79e6aa9fb18847e4c5b5e00dd742b3b00057d20bbede37f1c8740b21666b44e1
-
SHA512
082a20109057787fdb3d8bfa5607e379c4d803d862367078e24a40018c3a6ed4fa3c09ce0c95152a169cfa98f2348c47e20af1cbf4b69dd164fcc6b9a80040bd
Malware Config
Extracted
formbook
4.1
bk19
parkersuite.com
quanzhujs.com
ofourfuture.com
palazzonutraceuticals.com
xowshfv.top
casinoguide.bet
kangdurian.com
luxurymainewaterfront.com
sdjyyy.com
uglymugvs.com
lawncaregeni.com
simproful.net
upskirts-tube.com
taiylormade.com
okyxx1k4w.digital
shop-marvel.direct
tecdiario.com
click2claim.xyz
2dot2dot.space
gercektarih.online
gyovanaellen.com
sparkcreativesolution.com
i689.xyz
dawnrogerslaw.com
kahiankahibattein.online
jinsuncrafts.com
6l4ji5.xyz
greatfortuneindonesia.com
algosino.space
renewyougetaways.com
lifeoffem.com
dcorate.life
guomeiyishu.com
trendwebz.com
supportwildz.com
plazapaisa.com
championwordtoknow-today.info
china-visa-online.com
ftxtoken.world
tokmanloveincoma.xyz
vibesrackett.info
commodities-market.com
se-promo.com
thingstodoincumrbia.com
montfort.store
csmim.com
ncmlef.com
surveygalaxyusa.com
wxpf.space
funnygirlz.xyz
cludecreamcoin.xyz
jtexpressgroup.com
82900580.com
osteriacorsetti1921.com
bejamus.xyz
watclov.xyz
muscle-slave.club
cylgjyx.com
gestionesya.online
gardenerofedenfarms.com
bylolo.com
m-maket.com
cathetustec.info
newopenings4.com
rund8.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1328-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1328-64-0x000000000041F0D0-mapping.dmp formbook behavioral1/memory/1328-70-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/936-74-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook behavioral1/memory/936-78-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1888 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmp.exetmp.exemstsc.exedescription pid process target process PID 1948 set thread context of 1328 1948 tmp.exe tmp.exe PID 1328 set thread context of 1256 1328 tmp.exe Explorer.EXE PID 936 set thread context of 1256 936 mstsc.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
tmp.exetmp.exemstsc.exepid process 1948 tmp.exe 1328 tmp.exe 1328 tmp.exe 936 mstsc.exe 936 mstsc.exe 936 mstsc.exe 936 mstsc.exe 936 mstsc.exe 936 mstsc.exe 936 mstsc.exe 936 mstsc.exe 936 mstsc.exe 936 mstsc.exe 936 mstsc.exe 936 mstsc.exe 936 mstsc.exe 936 mstsc.exe 936 mstsc.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
tmp.exemstsc.exepid process 1328 tmp.exe 1328 tmp.exe 1328 tmp.exe 936 mstsc.exe 936 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
tmp.exetmp.exemstsc.exedescription pid process Token: SeDebugPrivilege 1948 tmp.exe Token: SeDebugPrivilege 1328 tmp.exe Token: SeDebugPrivilege 936 mstsc.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
tmp.exeExplorer.EXEmstsc.exedescription pid process target process PID 1948 wrote to memory of 1160 1948 tmp.exe tmp.exe PID 1948 wrote to memory of 1160 1948 tmp.exe tmp.exe PID 1948 wrote to memory of 1160 1948 tmp.exe tmp.exe PID 1948 wrote to memory of 1160 1948 tmp.exe tmp.exe PID 1948 wrote to memory of 1328 1948 tmp.exe tmp.exe PID 1948 wrote to memory of 1328 1948 tmp.exe tmp.exe PID 1948 wrote to memory of 1328 1948 tmp.exe tmp.exe PID 1948 wrote to memory of 1328 1948 tmp.exe tmp.exe PID 1948 wrote to memory of 1328 1948 tmp.exe tmp.exe PID 1948 wrote to memory of 1328 1948 tmp.exe tmp.exe PID 1948 wrote to memory of 1328 1948 tmp.exe tmp.exe PID 1256 wrote to memory of 936 1256 Explorer.EXE mstsc.exe PID 1256 wrote to memory of 936 1256 Explorer.EXE mstsc.exe PID 1256 wrote to memory of 936 1256 Explorer.EXE mstsc.exe PID 1256 wrote to memory of 936 1256 Explorer.EXE mstsc.exe PID 936 wrote to memory of 1888 936 mstsc.exe cmd.exe PID 936 wrote to memory of 1888 936 mstsc.exe cmd.exe PID 936 wrote to memory of 1888 936 mstsc.exe cmd.exe PID 936 wrote to memory of 1888 936 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/936-73-0x00000000005D0000-0x00000000006D4000-memory.dmpFilesize
1.0MB
-
memory/936-74-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB
-
memory/936-78-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB
-
memory/936-69-0x0000000000000000-mapping.dmp
-
memory/936-76-0x0000000001F10000-0x0000000001FA3000-memory.dmpFilesize
588KB
-
memory/936-75-0x0000000002040000-0x0000000002343000-memory.dmpFilesize
3.0MB
-
memory/1256-68-0x0000000006D00000-0x0000000006EA9000-memory.dmpFilesize
1.7MB
-
memory/1256-77-0x0000000004050000-0x000000000410A000-memory.dmpFilesize
744KB
-
memory/1256-79-0x0000000004050000-0x000000000410A000-memory.dmpFilesize
744KB
-
memory/1328-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1328-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1328-64-0x000000000041F0D0-mapping.dmp
-
memory/1328-66-0x0000000000990000-0x0000000000C93000-memory.dmpFilesize
3.0MB
-
memory/1328-67-0x00000000001D0000-0x00000000001E4000-memory.dmpFilesize
80KB
-
memory/1328-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1328-70-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1888-72-0x0000000000000000-mapping.dmp
-
memory/1948-54-0x0000000000120000-0x00000000001AC000-memory.dmpFilesize
560KB
-
memory/1948-59-0x0000000001EF0000-0x0000000001F24000-memory.dmpFilesize
208KB
-
memory/1948-58-0x0000000004FB0000-0x000000000501C000-memory.dmpFilesize
432KB
-
memory/1948-57-0x0000000000380000-0x000000000038A000-memory.dmpFilesize
40KB
-
memory/1948-56-0x0000000000330000-0x000000000034C000-memory.dmpFilesize
112KB
-
memory/1948-55-0x00000000754A1000-0x00000000754A3000-memory.dmpFilesize
8KB