Analysis
-
max time kernel
149s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 20:07
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
General
-
Target
tmp.exe
-
Size
538KB
-
MD5
c0138bfa58d20206600eaf1657f95f75
-
SHA1
fa232e4df93c81093044ff552381d41ebcc5f443
-
SHA256
79e6aa9fb18847e4c5b5e00dd742b3b00057d20bbede37f1c8740b21666b44e1
-
SHA512
082a20109057787fdb3d8bfa5607e379c4d803d862367078e24a40018c3a6ed4fa3c09ce0c95152a169cfa98f2348c47e20af1cbf4b69dd164fcc6b9a80040bd
Malware Config
Extracted
formbook
4.1
bk19
parkersuite.com
quanzhujs.com
ofourfuture.com
palazzonutraceuticals.com
xowshfv.top
casinoguide.bet
kangdurian.com
luxurymainewaterfront.com
sdjyyy.com
uglymugvs.com
lawncaregeni.com
simproful.net
upskirts-tube.com
taiylormade.com
okyxx1k4w.digital
shop-marvel.direct
tecdiario.com
click2claim.xyz
2dot2dot.space
gercektarih.online
gyovanaellen.com
sparkcreativesolution.com
i689.xyz
dawnrogerslaw.com
kahiankahibattein.online
jinsuncrafts.com
6l4ji5.xyz
greatfortuneindonesia.com
algosino.space
renewyougetaways.com
lifeoffem.com
dcorate.life
guomeiyishu.com
trendwebz.com
supportwildz.com
plazapaisa.com
championwordtoknow-today.info
china-visa-online.com
ftxtoken.world
tokmanloveincoma.xyz
vibesrackett.info
commodities-market.com
se-promo.com
thingstodoincumrbia.com
montfort.store
csmim.com
ncmlef.com
surveygalaxyusa.com
wxpf.space
funnygirlz.xyz
cludecreamcoin.xyz
jtexpressgroup.com
82900580.com
osteriacorsetti1921.com
bejamus.xyz
watclov.xyz
muscle-slave.club
cylgjyx.com
gestionesya.online
gardenerofedenfarms.com
bylolo.com
m-maket.com
cathetustec.info
newopenings4.com
rund8.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/628-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/628-64-0x000000000041F0D0-mapping.dmp formbook behavioral1/memory/628-69-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/628-73-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2032-77-0x00000000000F0000-0x000000000011F000-memory.dmp formbook behavioral1/memory/2032-81-0x00000000000F0000-0x000000000011F000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1884 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
tmp.exetmp.exemsiexec.exedescription pid process target process PID 1512 set thread context of 628 1512 tmp.exe tmp.exe PID 628 set thread context of 1420 628 tmp.exe Explorer.EXE PID 628 set thread context of 1420 628 tmp.exe Explorer.EXE PID 2032 set thread context of 1420 2032 msiexec.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
tmp.exemsiexec.exepid process 628 tmp.exe 628 tmp.exe 628 tmp.exe 2032 msiexec.exe 2032 msiexec.exe 2032 msiexec.exe 2032 msiexec.exe 2032 msiexec.exe 2032 msiexec.exe 2032 msiexec.exe 2032 msiexec.exe 2032 msiexec.exe 2032 msiexec.exe 2032 msiexec.exe 2032 msiexec.exe 2032 msiexec.exe 2032 msiexec.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
tmp.exemsiexec.exepid process 628 tmp.exe 628 tmp.exe 628 tmp.exe 628 tmp.exe 2032 msiexec.exe 2032 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tmp.exemsiexec.exedescription pid process Token: SeDebugPrivilege 628 tmp.exe Token: SeDebugPrivilege 2032 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1420 Explorer.EXE 1420 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1420 Explorer.EXE 1420 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
tmp.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1512 wrote to memory of 628 1512 tmp.exe tmp.exe PID 1512 wrote to memory of 628 1512 tmp.exe tmp.exe PID 1512 wrote to memory of 628 1512 tmp.exe tmp.exe PID 1512 wrote to memory of 628 1512 tmp.exe tmp.exe PID 1512 wrote to memory of 628 1512 tmp.exe tmp.exe PID 1512 wrote to memory of 628 1512 tmp.exe tmp.exe PID 1512 wrote to memory of 628 1512 tmp.exe tmp.exe PID 1420 wrote to memory of 2032 1420 Explorer.EXE msiexec.exe PID 1420 wrote to memory of 2032 1420 Explorer.EXE msiexec.exe PID 1420 wrote to memory of 2032 1420 Explorer.EXE msiexec.exe PID 1420 wrote to memory of 2032 1420 Explorer.EXE msiexec.exe PID 1420 wrote to memory of 2032 1420 Explorer.EXE msiexec.exe PID 1420 wrote to memory of 2032 1420 Explorer.EXE msiexec.exe PID 1420 wrote to memory of 2032 1420 Explorer.EXE msiexec.exe PID 2032 wrote to memory of 1884 2032 msiexec.exe cmd.exe PID 2032 wrote to memory of 1884 2032 msiexec.exe cmd.exe PID 2032 wrote to memory of 1884 2032 msiexec.exe cmd.exe PID 2032 wrote to memory of 1884 2032 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/628-64-0x000000000041F0D0-mapping.dmp
-
memory/628-73-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/628-70-0x0000000000470000-0x0000000000484000-memory.dmpFilesize
80KB
-
memory/628-69-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/628-67-0x0000000000430000-0x0000000000444000-memory.dmpFilesize
80KB
-
memory/628-66-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/628-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/628-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/628-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1420-68-0x0000000004A60000-0x0000000004B81000-memory.dmpFilesize
1.1MB
-
memory/1420-80-0x00000000071E0000-0x0000000007337000-memory.dmpFilesize
1.3MB
-
memory/1420-71-0x0000000007030000-0x00000000071D5000-memory.dmpFilesize
1.6MB
-
memory/1420-82-0x00000000071E0000-0x0000000007337000-memory.dmpFilesize
1.3MB
-
memory/1512-58-0x00000000059F0000-0x0000000005A5C000-memory.dmpFilesize
432KB
-
memory/1512-54-0x0000000001120000-0x00000000011AC000-memory.dmpFilesize
560KB
-
memory/1512-57-0x0000000000AA0000-0x0000000000AAA000-memory.dmpFilesize
40KB
-
memory/1512-56-0x0000000000980000-0x000000000099C000-memory.dmpFilesize
112KB
-
memory/1512-55-0x0000000076421000-0x0000000076423000-memory.dmpFilesize
8KB
-
memory/1512-59-0x0000000004DD0000-0x0000000004E04000-memory.dmpFilesize
208KB
-
memory/1884-75-0x0000000000000000-mapping.dmp
-
memory/2032-77-0x00000000000F0000-0x000000000011F000-memory.dmpFilesize
188KB
-
memory/2032-78-0x00000000021D0000-0x00000000024D3000-memory.dmpFilesize
3.0MB
-
memory/2032-79-0x0000000000A90000-0x0000000000B23000-memory.dmpFilesize
588KB
-
memory/2032-76-0x0000000000580000-0x0000000000594000-memory.dmpFilesize
80KB
-
memory/2032-81-0x00000000000F0000-0x000000000011F000-memory.dmpFilesize
188KB
-
memory/2032-72-0x0000000000000000-mapping.dmp