Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
06-07-2022 20:07
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
General
-
Target
tmp.exe
-
Size
538KB
-
MD5
c0138bfa58d20206600eaf1657f95f75
-
SHA1
fa232e4df93c81093044ff552381d41ebcc5f443
-
SHA256
79e6aa9fb18847e4c5b5e00dd742b3b00057d20bbede37f1c8740b21666b44e1
-
SHA512
082a20109057787fdb3d8bfa5607e379c4d803d862367078e24a40018c3a6ed4fa3c09ce0c95152a169cfa98f2348c47e20af1cbf4b69dd164fcc6b9a80040bd
Malware Config
Extracted
formbook
4.1
bk19
parkersuite.com
quanzhujs.com
ofourfuture.com
palazzonutraceuticals.com
xowshfv.top
casinoguide.bet
kangdurian.com
luxurymainewaterfront.com
sdjyyy.com
uglymugvs.com
lawncaregeni.com
simproful.net
upskirts-tube.com
taiylormade.com
okyxx1k4w.digital
shop-marvel.direct
tecdiario.com
click2claim.xyz
2dot2dot.space
gercektarih.online
gyovanaellen.com
sparkcreativesolution.com
i689.xyz
dawnrogerslaw.com
kahiankahibattein.online
jinsuncrafts.com
6l4ji5.xyz
greatfortuneindonesia.com
algosino.space
renewyougetaways.com
lifeoffem.com
dcorate.life
guomeiyishu.com
trendwebz.com
supportwildz.com
plazapaisa.com
championwordtoknow-today.info
china-visa-online.com
ftxtoken.world
tokmanloveincoma.xyz
vibesrackett.info
commodities-market.com
se-promo.com
thingstodoincumrbia.com
montfort.store
csmim.com
ncmlef.com
surveygalaxyusa.com
wxpf.space
funnygirlz.xyz
cludecreamcoin.xyz
jtexpressgroup.com
82900580.com
osteriacorsetti1921.com
bejamus.xyz
watclov.xyz
muscle-slave.club
cylgjyx.com
gestionesya.online
gardenerofedenfarms.com
bylolo.com
m-maket.com
cathetustec.info
newopenings4.com
rund8.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2696-136-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2696-138-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/5072-145-0x0000000001000000-0x000000000102F000-memory.dmp formbook behavioral2/memory/5072-149-0x0000000001000000-0x000000000102F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmp.exetmp.execmstp.exedescription pid process target process PID 1124 set thread context of 2696 1124 tmp.exe tmp.exe PID 2696 set thread context of 3132 2696 tmp.exe Explorer.EXE PID 5072 set thread context of 3132 5072 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
tmp.execmstp.exepid process 2696 tmp.exe 2696 tmp.exe 2696 tmp.exe 2696 tmp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe 5072 cmstp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3132 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
tmp.execmstp.exepid process 2696 tmp.exe 2696 tmp.exe 2696 tmp.exe 5072 cmstp.exe 5072 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tmp.execmstp.exedescription pid process Token: SeDebugPrivilege 2696 tmp.exe Token: SeDebugPrivilege 5072 cmstp.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
tmp.exeExplorer.EXEcmstp.exedescription pid process target process PID 1124 wrote to memory of 2696 1124 tmp.exe tmp.exe PID 1124 wrote to memory of 2696 1124 tmp.exe tmp.exe PID 1124 wrote to memory of 2696 1124 tmp.exe tmp.exe PID 1124 wrote to memory of 2696 1124 tmp.exe tmp.exe PID 1124 wrote to memory of 2696 1124 tmp.exe tmp.exe PID 1124 wrote to memory of 2696 1124 tmp.exe tmp.exe PID 3132 wrote to memory of 5072 3132 Explorer.EXE cmstp.exe PID 3132 wrote to memory of 5072 3132 Explorer.EXE cmstp.exe PID 3132 wrote to memory of 5072 3132 Explorer.EXE cmstp.exe PID 5072 wrote to memory of 2476 5072 cmstp.exe cmd.exe PID 5072 wrote to memory of 2476 5072 cmstp.exe cmd.exe PID 5072 wrote to memory of 2476 5072 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1124-131-0x00000000052F0000-0x0000000005894000-memory.dmpFilesize
5.6MB
-
memory/1124-132-0x0000000004E20000-0x0000000004EB2000-memory.dmpFilesize
584KB
-
memory/1124-133-0x0000000004E10000-0x0000000004E1A000-memory.dmpFilesize
40KB
-
memory/1124-134-0x00000000087D0000-0x000000000886C000-memory.dmpFilesize
624KB
-
memory/1124-130-0x00000000003E0000-0x000000000046C000-memory.dmpFilesize
560KB
-
memory/2476-143-0x0000000000000000-mapping.dmp
-
memory/2696-135-0x0000000000000000-mapping.dmp
-
memory/2696-136-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2696-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2696-139-0x0000000001880000-0x0000000001BCA000-memory.dmpFilesize
3.3MB
-
memory/2696-140-0x0000000001520000-0x0000000001534000-memory.dmpFilesize
80KB
-
memory/3132-141-0x00000000083F0000-0x000000000852E000-memory.dmpFilesize
1.2MB
-
memory/3132-148-0x0000000008860000-0x00000000089E8000-memory.dmpFilesize
1.5MB
-
memory/3132-150-0x0000000008860000-0x00000000089E8000-memory.dmpFilesize
1.5MB
-
memory/5072-142-0x0000000000000000-mapping.dmp
-
memory/5072-144-0x0000000000770000-0x0000000000786000-memory.dmpFilesize
88KB
-
memory/5072-145-0x0000000001000000-0x000000000102F000-memory.dmpFilesize
188KB
-
memory/5072-146-0x0000000002E70000-0x00000000031BA000-memory.dmpFilesize
3.3MB
-
memory/5072-147-0x0000000002D80000-0x0000000002E13000-memory.dmpFilesize
588KB
-
memory/5072-149-0x0000000001000000-0x000000000102F000-memory.dmpFilesize
188KB