Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
06-07-2022 20:00
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
General
-
Target
tmp.exe
-
Size
538KB
-
MD5
c0138bfa58d20206600eaf1657f95f75
-
SHA1
fa232e4df93c81093044ff552381d41ebcc5f443
-
SHA256
79e6aa9fb18847e4c5b5e00dd742b3b00057d20bbede37f1c8740b21666b44e1
-
SHA512
082a20109057787fdb3d8bfa5607e379c4d803d862367078e24a40018c3a6ed4fa3c09ce0c95152a169cfa98f2348c47e20af1cbf4b69dd164fcc6b9a80040bd
Malware Config
Extracted
formbook
4.1
bk19
parkersuite.com
quanzhujs.com
ofourfuture.com
palazzonutraceuticals.com
xowshfv.top
casinoguide.bet
kangdurian.com
luxurymainewaterfront.com
sdjyyy.com
uglymugvs.com
lawncaregeni.com
simproful.net
upskirts-tube.com
taiylormade.com
okyxx1k4w.digital
shop-marvel.direct
tecdiario.com
click2claim.xyz
2dot2dot.space
gercektarih.online
gyovanaellen.com
sparkcreativesolution.com
i689.xyz
dawnrogerslaw.com
kahiankahibattein.online
jinsuncrafts.com
6l4ji5.xyz
greatfortuneindonesia.com
algosino.space
renewyougetaways.com
lifeoffem.com
dcorate.life
guomeiyishu.com
trendwebz.com
supportwildz.com
plazapaisa.com
championwordtoknow-today.info
china-visa-online.com
ftxtoken.world
tokmanloveincoma.xyz
vibesrackett.info
commodities-market.com
se-promo.com
thingstodoincumrbia.com
montfort.store
csmim.com
ncmlef.com
surveygalaxyusa.com
wxpf.space
funnygirlz.xyz
cludecreamcoin.xyz
jtexpressgroup.com
82900580.com
osteriacorsetti1921.com
bejamus.xyz
watclov.xyz
muscle-slave.club
cylgjyx.com
gestionesya.online
gardenerofedenfarms.com
bylolo.com
m-maket.com
cathetustec.info
newopenings4.com
rund8.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4980-137-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4980-139-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4964-145-0x0000000000690000-0x00000000006BF000-memory.dmp formbook behavioral2/memory/4964-148-0x0000000000690000-0x00000000006BF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmp.exetmp.exewlanext.exedescription pid process target process PID 2300 set thread context of 4980 2300 tmp.exe tmp.exe PID 4980 set thread context of 3144 4980 tmp.exe Explorer.EXE PID 4964 set thread context of 3144 4964 wlanext.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
tmp.exetmp.exewlanext.exepid process 2300 tmp.exe 2300 tmp.exe 4980 tmp.exe 4980 tmp.exe 4980 tmp.exe 4980 tmp.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe 4964 wlanext.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3144 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
tmp.exewlanext.exepid process 4980 tmp.exe 4980 tmp.exe 4980 tmp.exe 4964 wlanext.exe 4964 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
tmp.exetmp.exewlanext.exedescription pid process Token: SeDebugPrivilege 2300 tmp.exe Token: SeDebugPrivilege 4980 tmp.exe Token: SeDebugPrivilege 4964 wlanext.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
tmp.exeExplorer.EXEwlanext.exedescription pid process target process PID 2300 wrote to memory of 4504 2300 tmp.exe tmp.exe PID 2300 wrote to memory of 4504 2300 tmp.exe tmp.exe PID 2300 wrote to memory of 4504 2300 tmp.exe tmp.exe PID 2300 wrote to memory of 4980 2300 tmp.exe tmp.exe PID 2300 wrote to memory of 4980 2300 tmp.exe tmp.exe PID 2300 wrote to memory of 4980 2300 tmp.exe tmp.exe PID 2300 wrote to memory of 4980 2300 tmp.exe tmp.exe PID 2300 wrote to memory of 4980 2300 tmp.exe tmp.exe PID 2300 wrote to memory of 4980 2300 tmp.exe tmp.exe PID 3144 wrote to memory of 4964 3144 Explorer.EXE wlanext.exe PID 3144 wrote to memory of 4964 3144 Explorer.EXE wlanext.exe PID 3144 wrote to memory of 4964 3144 Explorer.EXE wlanext.exe PID 4964 wrote to memory of 4256 4964 wlanext.exe cmd.exe PID 4964 wrote to memory of 4256 4964 wlanext.exe cmd.exe PID 4964 wrote to memory of 4256 4964 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2300-131-0x0000000005850000-0x0000000005DF4000-memory.dmpFilesize
5.6MB
-
memory/2300-132-0x0000000005340000-0x00000000053D2000-memory.dmpFilesize
584KB
-
memory/2300-133-0x00000000052C0000-0x00000000052CA000-memory.dmpFilesize
40KB
-
memory/2300-134-0x0000000008C90000-0x0000000008D2C000-memory.dmpFilesize
624KB
-
memory/2300-130-0x0000000000890000-0x000000000091C000-memory.dmpFilesize
560KB
-
memory/3144-142-0x0000000002600000-0x0000000002771000-memory.dmpFilesize
1.4MB
-
memory/3144-151-0x0000000002780000-0x000000000286B000-memory.dmpFilesize
940KB
-
memory/3144-150-0x0000000002780000-0x000000000286B000-memory.dmpFilesize
940KB
-
memory/4256-146-0x0000000000000000-mapping.dmp
-
memory/4504-135-0x0000000000000000-mapping.dmp
-
memory/4964-143-0x0000000000000000-mapping.dmp
-
memory/4964-145-0x0000000000690000-0x00000000006BF000-memory.dmpFilesize
188KB
-
memory/4964-144-0x0000000000200000-0x0000000000217000-memory.dmpFilesize
92KB
-
memory/4964-147-0x0000000000D10000-0x000000000105A000-memory.dmpFilesize
3.3MB
-
memory/4964-148-0x0000000000690000-0x00000000006BF000-memory.dmpFilesize
188KB
-
memory/4964-149-0x0000000000C50000-0x0000000000CE3000-memory.dmpFilesize
588KB
-
memory/4980-141-0x0000000001290000-0x00000000012A4000-memory.dmpFilesize
80KB
-
memory/4980-140-0x00000000012F0000-0x000000000163A000-memory.dmpFilesize
3.3MB
-
memory/4980-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4980-137-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4980-136-0x0000000000000000-mapping.dmp