Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2022 03:39
Static task
static1
Behavioral task
behavioral1
Sample
5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe
Resource
win7-20220718-en
General
-
Target
5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe
-
Size
305KB
-
MD5
ffa3fb48a339894ea095d4daf804011c
-
SHA1
1d9466444dad77922aec5a800fef77b83b715c18
-
SHA256
5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8
-
SHA512
6327a1b44a08446a6d21a5357d833187fc575bbf570f3e324c27f8545a2f458c4fa057b88b1a0dae5fcfee0c9852f94615b011fdb5341afaab6dcde55e6bc05e
Malware Config
Extracted
formbook
3.8
hx237
repuestosmamparaselsur.com
sakai-yukiko.com
getdistrict.com
hideinplainflight.info
yamaer.com
hoosholic-boy.com
thecopenhagencopywriter.com
ledressingdescompulsives.com
xn--h3t926bkqa394a.com
nvcxr.com
zhangbin2016.com
ajsfibresolutions.net
229riverbendlane.com
gnimble.com
pichacola.com
kochang.online
fishonfellowship.com
mandarinassinpepitas.com
drinkopr.win
silverm.cloud
rentalcoins.info
facepayfor.com
justbyoubeayutiful.com
grandgentlemen.com
nyss6ttyn3.online
bjoraclewdp.com
chairrole.site
huclub.com
e2mw.com
ya298.com
momoe365.com
printsites.info
neeqly.com
banque-societegeneralefr.net
colmund.com
baronlaw.net
wafigraphy.com
etherclan.com
saps-enterprise.com
xinfushunddc.com
tv16760.info
783bet.com
yongtai308.com
julianabass.site
czxyws.com
zjgewy.com
ytbaoyu.com
manbet086.com
pixelpandemic.com
dreamdentistrytx.com
brjx668.com
hyhdtjm.com
bumijawa.online
testbestdeal2.com
bodychange21.com
dg6yg1bp4.online
iiird.com
luckywechat.com
businesns.com
xn--2j1b67o19hn8l.net
veqwxx.info
cicekbi.net
iphone-10.repair
thorsthunderhq.com
aibbybrown-music.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2344-142-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/2344-150-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/4764-152-0x00000000001B0000-0x00000000001DA000-memory.dmp formbook behavioral2/memory/4764-157-0x00000000001B0000-0x00000000001DA000-memory.dmp formbook -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
cscript.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\JDRPJFAH1 = "C:\\Program Files (x86)\\Huj9l\\8pwtsvghh.exe" cscript.exe -
Executes dropped EXE 3 IoCs
Processes:
cnxuoiren.execnxuoiren.execnxuoiren.exepid process 3688 cnxuoiren.exe 2648 cnxuoiren.exe 2344 cnxuoiren.exe -
Drops startup file 2 IoCs
Processes:
5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exe 5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exe 5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cnxuoirenmcxcz = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\cnxuoirenmcxcz.txt | cmd" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
cnxuoiren.execnxuoiren.execscript.exedescription pid process target process PID 3688 set thread context of 2344 3688 cnxuoiren.exe cnxuoiren.exe PID 2344 set thread context of 2308 2344 cnxuoiren.exe Explorer.EXE PID 4764 set thread context of 2308 4764 cscript.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
cscript.exedescription ioc process File opened for modification C:\Program Files (x86)\Huj9l\8pwtsvghh.exe cscript.exe -
Processes:
cscript.exedescription ioc process Key created \Registry\User\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cscript.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.execnxuoiren.execnxuoiren.execscript.exepid process 4288 5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe 4288 5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe 3688 cnxuoiren.exe 3688 cnxuoiren.exe 2344 cnxuoiren.exe 2344 cnxuoiren.exe 2344 cnxuoiren.exe 2344 cnxuoiren.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe 4764 cscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2308 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
cnxuoiren.execscript.exepid process 2344 cnxuoiren.exe 2344 cnxuoiren.exe 2344 cnxuoiren.exe 4764 cscript.exe 4764 cscript.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.execnxuoiren.execnxuoiren.execscript.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4288 5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe Token: SeDebugPrivilege 3688 cnxuoiren.exe Token: SeDebugPrivilege 2344 cnxuoiren.exe Token: SeDebugPrivilege 4764 cscript.exe Token: SeShutdownPrivilege 2308 Explorer.EXE Token: SeCreatePagefilePrivilege 2308 Explorer.EXE Token: SeShutdownPrivilege 2308 Explorer.EXE Token: SeCreatePagefilePrivilege 2308 Explorer.EXE -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.execmd.execnxuoiren.execmd.exeExplorer.EXEcscript.exedescription pid process target process PID 4288 wrote to memory of 3648 4288 5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe cmd.exe PID 4288 wrote to memory of 3648 4288 5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe cmd.exe PID 4288 wrote to memory of 3648 4288 5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe cmd.exe PID 3648 wrote to memory of 3688 3648 cmd.exe cnxuoiren.exe PID 3648 wrote to memory of 3688 3648 cmd.exe cnxuoiren.exe PID 3648 wrote to memory of 3688 3648 cmd.exe cnxuoiren.exe PID 3688 wrote to memory of 3048 3688 cnxuoiren.exe cmd.exe PID 3688 wrote to memory of 3048 3688 cnxuoiren.exe cmd.exe PID 3688 wrote to memory of 3048 3688 cnxuoiren.exe cmd.exe PID 3048 wrote to memory of 3488 3048 cmd.exe reg.exe PID 3048 wrote to memory of 3488 3048 cmd.exe reg.exe PID 3048 wrote to memory of 3488 3048 cmd.exe reg.exe PID 3688 wrote to memory of 2648 3688 cnxuoiren.exe cnxuoiren.exe PID 3688 wrote to memory of 2648 3688 cnxuoiren.exe cnxuoiren.exe PID 3688 wrote to memory of 2648 3688 cnxuoiren.exe cnxuoiren.exe PID 3688 wrote to memory of 2344 3688 cnxuoiren.exe cnxuoiren.exe PID 3688 wrote to memory of 2344 3688 cnxuoiren.exe cnxuoiren.exe PID 3688 wrote to memory of 2344 3688 cnxuoiren.exe cnxuoiren.exe PID 3688 wrote to memory of 2344 3688 cnxuoiren.exe cnxuoiren.exe PID 3688 wrote to memory of 2344 3688 cnxuoiren.exe cnxuoiren.exe PID 3688 wrote to memory of 2344 3688 cnxuoiren.exe cnxuoiren.exe PID 2308 wrote to memory of 4764 2308 Explorer.EXE cscript.exe PID 2308 wrote to memory of 4764 2308 Explorer.EXE cscript.exe PID 2308 wrote to memory of 4764 2308 Explorer.EXE cscript.exe PID 4764 wrote to memory of 3992 4764 cscript.exe cmd.exe PID 4764 wrote to memory of 3992 4764 cscript.exe cmd.exe PID 4764 wrote to memory of 3992 4764 cscript.exe cmd.exe PID 4764 wrote to memory of 4300 4764 cscript.exe cmd.exe PID 4764 wrote to memory of 4300 4764 cscript.exe cmd.exe PID 4764 wrote to memory of 4300 4764 cscript.exe cmd.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
cscript.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cscript.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe"C:\Users\Admin\AppData\Local\Temp\5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8.exe"2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "cnxuoirenmcxcz" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\cnxuoirenmcxcz.txt" | cmd"6⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DB1Filesize
40KB
MD5b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
C:\Users\Admin\AppData\Roaming\82388PD5\823logim.jpegFilesize
81KB
MD59dc3ce0b18b7f18d4df70591b9d9034c
SHA1bcc3c9d9acd5b6770e06f903c77dd059fde695e6
SHA2568e30324785ff1774bdee2877e8119907f6aa827884a73a2f34b5526af2833f80
SHA5124575aa29138dae6bfb760e660f0e99804fb900d300c0b6555458a8052e0f3b19c55f0bc31bdce719daacffe8b2154de46ad310041c7299bcc493a69844b73c66
-
C:\Users\Admin\AppData\Roaming\82388PD5\823logrg.iniFilesize
38B
MD54aadf49fed30e4c9b3fe4a3dd6445ebe
SHA11e332822167c6f351b99615eada2c30a538ff037
SHA25675034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56
SHA512eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945
-
C:\Users\Admin\AppData\Roaming\82388PD5\823logri.iniFilesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\82388PD5\823logrv.iniFilesize
872B
MD5bbc41c78bae6c71e63cb544a6a284d94
SHA133f2c1d9fa0e9c99b80bc2500621e95af38b1f9a
SHA256ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb
SHA5120aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exeFilesize
305KB
MD5ffa3fb48a339894ea095d4daf804011c
SHA11d9466444dad77922aec5a800fef77b83b715c18
SHA2565987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8
SHA5126327a1b44a08446a6d21a5357d833187fc575bbf570f3e324c27f8545a2f458c4fa057b88b1a0dae5fcfee0c9852f94615b011fdb5341afaab6dcde55e6bc05e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exeFilesize
305KB
MD5ffa3fb48a339894ea095d4daf804011c
SHA11d9466444dad77922aec5a800fef77b83b715c18
SHA2565987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8
SHA5126327a1b44a08446a6d21a5357d833187fc575bbf570f3e324c27f8545a2f458c4fa057b88b1a0dae5fcfee0c9852f94615b011fdb5341afaab6dcde55e6bc05e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exeFilesize
305KB
MD5ffa3fb48a339894ea095d4daf804011c
SHA11d9466444dad77922aec5a800fef77b83b715c18
SHA2565987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8
SHA5126327a1b44a08446a6d21a5357d833187fc575bbf570f3e324c27f8545a2f458c4fa057b88b1a0dae5fcfee0c9852f94615b011fdb5341afaab6dcde55e6bc05e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cnxuoiren.exeFilesize
305KB
MD5ffa3fb48a339894ea095d4daf804011c
SHA11d9466444dad77922aec5a800fef77b83b715c18
SHA2565987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8
SHA5126327a1b44a08446a6d21a5357d833187fc575bbf570f3e324c27f8545a2f458c4fa057b88b1a0dae5fcfee0c9852f94615b011fdb5341afaab6dcde55e6bc05e
-
memory/2308-158-0x0000000008FA0000-0x000000000910C000-memory.dmpFilesize
1.4MB
-
memory/2308-148-0x0000000008A60000-0x0000000008BD6000-memory.dmpFilesize
1.5MB
-
memory/2308-156-0x0000000008FA0000-0x000000000910C000-memory.dmpFilesize
1.4MB
-
memory/2344-150-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2344-141-0x0000000000000000-mapping.dmp
-
memory/2344-142-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2344-146-0x0000000000FB0000-0x00000000012FA000-memory.dmpFilesize
3.3MB
-
memory/2344-147-0x0000000000E70000-0x0000000000E84000-memory.dmpFilesize
80KB
-
memory/2648-139-0x0000000000000000-mapping.dmp
-
memory/3048-137-0x0000000000000000-mapping.dmp
-
memory/3488-138-0x0000000000000000-mapping.dmp
-
memory/3648-130-0x0000000000000000-mapping.dmp
-
memory/3688-131-0x0000000000000000-mapping.dmp
-
memory/3688-136-0x00000000751D0000-0x0000000075781000-memory.dmpFilesize
5.7MB
-
memory/3688-144-0x00000000751D0000-0x0000000075781000-memory.dmpFilesize
5.7MB
-
memory/3992-153-0x0000000000000000-mapping.dmp
-
memory/4288-132-0x00000000751D0000-0x0000000075781000-memory.dmpFilesize
5.7MB
-
memory/4288-135-0x00000000751D0000-0x0000000075781000-memory.dmpFilesize
5.7MB
-
memory/4300-159-0x0000000000000000-mapping.dmp
-
memory/4764-154-0x0000000002500000-0x000000000284A000-memory.dmpFilesize
3.3MB
-
memory/4764-157-0x00000000001B0000-0x00000000001DA000-memory.dmpFilesize
168KB
-
memory/4764-149-0x0000000000000000-mapping.dmp
-
memory/4764-155-0x0000000002370000-0x0000000002403000-memory.dmpFilesize
588KB
-
memory/4764-151-0x0000000000500000-0x0000000000527000-memory.dmpFilesize
156KB
-
memory/4764-152-0x00000000001B0000-0x00000000001DA000-memory.dmpFilesize
168KB