Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
07-07-2022 15:51
Static task
static1
General
-
Target
0b576117983f942d005bd209239752290a0f97a9b0be5326f4f2d76c8ee416e0.exe
-
Size
1.0MB
-
MD5
4942c83e6f8149c8ee9765f3c2b27bc7
-
SHA1
caf483ee54b09acc8b18a298ba42283260906687
-
SHA256
0b576117983f942d005bd209239752290a0f97a9b0be5326f4f2d76c8ee416e0
-
SHA512
4033e41aa44513ad425f7e6f0256a28f0a15b7419e7adf45edca82baf5894a0819b57521e9366273ef333d7fdbc154482efa36a9a6e06dddbf7119ffa2485383
Malware Config
Extracted
formbook
4.1
po23
jacknull.xyz
commonellc.com
topnotchconstructor.com
thescienceofrecruiting.com
bellydancer.company
iforyo.com
hotgirlsseeking24.online
pelleycivil.com
plumblersnearme.com
helpfundabortionohio.com
wineandview.com
youfather.xyz
xsjxly.com
bnfconsults.com
apeholder.com
oldbutterflyevict.space
nara-happylife.com
frontmountedattachments.com
polizzastore.com
bettor-weather.com
vivisportshoes.com
vpsyxney.com
metaphysicalbiohacker.com
web-kontor-hamburg.com
419car.com
o-vertbastiais.com
handsofchia.com
sherispeakssocial.com
idola88.win
layeredbylayne.com
makoto-car.com
bufordsinglestoryhomeslist.com
grow-wings.net
honey-clothing.net
houseofdavidonline.com
aaahp.xyz
20gotas.com
hdamxpj.com
redirect53v.direct
gctomoney.com
dgluxuries.com
023xqbj.com
exulthome.com
chuanghuisz.net
sarvesh.land
squadly.net
universityofwinchester.com
rainbowranchojai.com
hookcrafty.com
jesusdosreis.com
grumfez.online
xaruilan.com
reindeer-exist.com
scarecrowdriver.com
mindamics.com
aqgree.com
fcsbssb.com
hautewired.com
shareingale.com
saborrumbero.com
virtualmichigan.xyz
meranti.pro
cavarma.com
liamhold.com
uscreditgroup.xyz
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2288-263-0x0000000000000000-mapping.dmp formbook behavioral1/memory/2288-309-0x0000000010410000-0x000000001043F000-memory.dmp formbook behavioral1/memory/3832-369-0x0000000000450000-0x000000000047F000-memory.dmp formbook behavioral1/memory/3832-374-0x0000000000450000-0x000000000047F000-memory.dmp formbook -
Suspicious use of SetThreadContext 2 IoCs
Processes:
logagent.exemstsc.exedescription pid process target process PID 2288 set thread context of 1848 2288 logagent.exe Explorer.EXE PID 3832 set thread context of 1848 3832 mstsc.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
logagent.exemstsc.exepid process 2288 logagent.exe 2288 logagent.exe 2288 logagent.exe 2288 logagent.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe 3832 mstsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1848 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
logagent.exemstsc.exepid process 2288 logagent.exe 2288 logagent.exe 2288 logagent.exe 3832 mstsc.exe 3832 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
logagent.exemstsc.exedescription pid process Token: SeDebugPrivilege 2288 logagent.exe Token: SeDebugPrivilege 3832 mstsc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
0b576117983f942d005bd209239752290a0f97a9b0be5326f4f2d76c8ee416e0.exeExplorer.EXEmstsc.exedescription pid process target process PID 1196 wrote to memory of 2288 1196 0b576117983f942d005bd209239752290a0f97a9b0be5326f4f2d76c8ee416e0.exe logagent.exe PID 1196 wrote to memory of 2288 1196 0b576117983f942d005bd209239752290a0f97a9b0be5326f4f2d76c8ee416e0.exe logagent.exe PID 1196 wrote to memory of 2288 1196 0b576117983f942d005bd209239752290a0f97a9b0be5326f4f2d76c8ee416e0.exe logagent.exe PID 1196 wrote to memory of 2288 1196 0b576117983f942d005bd209239752290a0f97a9b0be5326f4f2d76c8ee416e0.exe logagent.exe PID 1196 wrote to memory of 2288 1196 0b576117983f942d005bd209239752290a0f97a9b0be5326f4f2d76c8ee416e0.exe logagent.exe PID 1196 wrote to memory of 2288 1196 0b576117983f942d005bd209239752290a0f97a9b0be5326f4f2d76c8ee416e0.exe logagent.exe PID 1848 wrote to memory of 3832 1848 Explorer.EXE mstsc.exe PID 1848 wrote to memory of 3832 1848 Explorer.EXE mstsc.exe PID 1848 wrote to memory of 3832 1848 Explorer.EXE mstsc.exe PID 3832 wrote to memory of 3388 3832 mstsc.exe cmd.exe PID 3832 wrote to memory of 3388 3832 mstsc.exe cmd.exe PID 3832 wrote to memory of 3388 3832 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0b576117983f942d005bd209239752290a0f97a9b0be5326f4f2d76c8ee416e0.exe"C:\Users\Admin\AppData\Local\Temp\0b576117983f942d005bd209239752290a0f97a9b0be5326f4f2d76c8ee416e0.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\logagent.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1196-157-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-155-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-119-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-120-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-121-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-122-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-123-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-124-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-125-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-126-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-127-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-128-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-130-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-129-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-131-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-132-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-134-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-133-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-135-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-136-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-137-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-138-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-139-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-140-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-141-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-142-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-143-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-145-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-144-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-146-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-147-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-148-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-149-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-150-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-151-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-152-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-153-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-154-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-161-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-156-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-118-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-158-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-159-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-160-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-117-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-162-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-163-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-164-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-165-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-166-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-167-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-168-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-169-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-170-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-171-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-172-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-173-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-174-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-175-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-176-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-177-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-178-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-179-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1196-181-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/1848-312-0x0000000005D60000-0x0000000005EB4000-memory.dmpFilesize
1.3MB
-
memory/1848-376-0x0000000004AE0000-0x0000000004C2C000-memory.dmpFilesize
1.3MB
-
memory/1848-373-0x0000000004AE0000-0x0000000004C2C000-memory.dmpFilesize
1.3MB
-
memory/1848-371-0x0000000005D60000-0x0000000005EB4000-memory.dmpFilesize
1.3MB
-
memory/2288-263-0x0000000000000000-mapping.dmp
-
memory/2288-309-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/2288-311-0x0000000000F40000-0x00000000010D6000-memory.dmpFilesize
1.6MB
-
memory/2288-310-0x00000000047C0000-0x0000000004AE0000-memory.dmpFilesize
3.1MB
-
memory/3388-362-0x0000000000000000-mapping.dmp
-
memory/3832-313-0x0000000000000000-mapping.dmp
-
memory/3832-367-0x00000000013A0000-0x000000000169C000-memory.dmpFilesize
3.0MB
-
memory/3832-369-0x0000000000450000-0x000000000047F000-memory.dmpFilesize
188KB
-
memory/3832-370-0x0000000004AA0000-0x0000000004DC0000-memory.dmpFilesize
3.1MB
-
memory/3832-372-0x0000000000D80000-0x0000000000F15000-memory.dmpFilesize
1.6MB
-
memory/3832-374-0x0000000000450000-0x000000000047F000-memory.dmpFilesize
188KB
-
memory/3832-375-0x0000000000D80000-0x0000000000F15000-memory.dmpFilesize
1.6MB