Analysis
-
max time kernel
148s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2022 16:32
Static task
static1
Behavioral task
behavioral1
Sample
5814e53e67e68d674db42f492fb1265b2fa65c70f31d706e38ef65b3bf3c8769.exe
Resource
win7-20220718-en
General
-
Target
5814e53e67e68d674db42f492fb1265b2fa65c70f31d706e38ef65b3bf3c8769.exe
-
Size
212KB
-
MD5
0d6ae9500984c013e717fac3aa020e0f
-
SHA1
d87df965c6ae2e75380d6752dc0030fc7b891a1d
-
SHA256
5814e53e67e68d674db42f492fb1265b2fa65c70f31d706e38ef65b3bf3c8769
-
SHA512
e23dcd8c19590785409c789c47fb4a69e51dde2534f739a635b8b5b23f73705a42dbc6ef8dfaa336c1fad01d7355e4755717e5fba52f970fda5542356dd95dcf
Malware Config
Extracted
formbook
3.8
sh
studiogoparty.com
furi-mold.com
cdicoun-tombola.info
elizabethlhall.com
nakayama-hanasai.com
9910pe.com
iraqbreakingnews.com
91fyy.com
intersafetyland.com
dddadditive.com
gewuan.net
ikwxanxb.click
shenghangdianzi.com
nuskinmemory.com
sonrel-julie.com
rapidlegalcenter.com
jcldsp.com
dibamoviez.net
sochuan66.com
platformoneclothing.com
vandenbergpol.com
farmagf.com
xn--sjq656oa.net
bostonrefinanceboard.com
dannymetal.email
rcnxg.info
miaoshahui.net
sianakuwait.com
soundsquaremusic.com
liputan66.com
office365esafety.group
bolababy.net
saltiestoftheearth.com
goculer.com
mindbodysoulfoodie.com
tamsueva.info
givingartgallery.com
onlinestore.ninja
sanftemassagen.com
lafourmibatisseuse.com
200767.top
christina-kenel.com
burocratastijuana.com
herosofharvey.com
libelle-le.com
zecstb.men
jxkysd.com
yejiajun.com
social123marketing.com
simplelifeorganic.com
tjkaizhen.com
estableg.info
cyrilportmann.com
ntstiffins.com
717385y.info
ellamcd.com
cnxt.social
iotaagriculture.com
frankpilates.net
flytart.com
watch-zone.tech
yigitay.net
bubbleshootgames.com
cosmiceggpack.com
drylipc.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4816-142-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/4816-148-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/4732-152-0x0000000000390000-0x00000000003BA000-memory.dmp formbook behavioral2/memory/4732-155-0x0000000000390000-0x00000000003BA000-memory.dmp formbook -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
help.exedescription ioc process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run help.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MBADHTDX-27 = "C:\\Program Files (x86)\\Wdhldyf\\r4khzllfi.exe" help.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
5814e53e67e68d674db42f492fb1265b2fa65c70f31d706e38ef65b3bf3c8769.exevbc.exehelp.exedescription pid process target process PID 2136 set thread context of 4816 2136 5814e53e67e68d674db42f492fb1265b2fa65c70f31d706e38ef65b3bf3c8769.exe vbc.exe PID 4816 set thread context of 820 4816 vbc.exe Explorer.EXE PID 4732 set thread context of 820 4732 help.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
help.exedescription ioc process File opened for modification C:\Program Files (x86)\Wdhldyf\r4khzllfi.exe help.exe -
Processes:
help.exedescription ioc process Key created \Registry\User\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 help.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
5814e53e67e68d674db42f492fb1265b2fa65c70f31d706e38ef65b3bf3c8769.exevbc.exehelp.exepid process 2136 5814e53e67e68d674db42f492fb1265b2fa65c70f31d706e38ef65b3bf3c8769.exe 2136 5814e53e67e68d674db42f492fb1265b2fa65c70f31d706e38ef65b3bf3c8769.exe 4816 vbc.exe 4816 vbc.exe 4816 vbc.exe 4816 vbc.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe 4732 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 820 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exehelp.exepid process 4816 vbc.exe 4816 vbc.exe 4816 vbc.exe 4732 help.exe 4732 help.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
5814e53e67e68d674db42f492fb1265b2fa65c70f31d706e38ef65b3bf3c8769.exevbc.exehelp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 2136 5814e53e67e68d674db42f492fb1265b2fa65c70f31d706e38ef65b3bf3c8769.exe Token: SeDebugPrivilege 4816 vbc.exe Token: SeDebugPrivilege 4732 help.exe Token: SeShutdownPrivilege 820 Explorer.EXE Token: SeCreatePagefilePrivilege 820 Explorer.EXE Token: SeShutdownPrivilege 820 Explorer.EXE Token: SeCreatePagefilePrivilege 820 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
5814e53e67e68d674db42f492fb1265b2fa65c70f31d706e38ef65b3bf3c8769.execsc.exeExplorer.EXEhelp.exedescription pid process target process PID 2136 wrote to memory of 1340 2136 5814e53e67e68d674db42f492fb1265b2fa65c70f31d706e38ef65b3bf3c8769.exe csc.exe PID 2136 wrote to memory of 1340 2136 5814e53e67e68d674db42f492fb1265b2fa65c70f31d706e38ef65b3bf3c8769.exe csc.exe PID 2136 wrote to memory of 1340 2136 5814e53e67e68d674db42f492fb1265b2fa65c70f31d706e38ef65b3bf3c8769.exe csc.exe PID 1340 wrote to memory of 4036 1340 csc.exe cvtres.exe PID 1340 wrote to memory of 4036 1340 csc.exe cvtres.exe PID 1340 wrote to memory of 4036 1340 csc.exe cvtres.exe PID 2136 wrote to memory of 4816 2136 5814e53e67e68d674db42f492fb1265b2fa65c70f31d706e38ef65b3bf3c8769.exe vbc.exe PID 2136 wrote to memory of 4816 2136 5814e53e67e68d674db42f492fb1265b2fa65c70f31d706e38ef65b3bf3c8769.exe vbc.exe PID 2136 wrote to memory of 4816 2136 5814e53e67e68d674db42f492fb1265b2fa65c70f31d706e38ef65b3bf3c8769.exe vbc.exe PID 2136 wrote to memory of 4816 2136 5814e53e67e68d674db42f492fb1265b2fa65c70f31d706e38ef65b3bf3c8769.exe vbc.exe PID 2136 wrote to memory of 4816 2136 5814e53e67e68d674db42f492fb1265b2fa65c70f31d706e38ef65b3bf3c8769.exe vbc.exe PID 2136 wrote to memory of 4816 2136 5814e53e67e68d674db42f492fb1265b2fa65c70f31d706e38ef65b3bf3c8769.exe vbc.exe PID 820 wrote to memory of 4732 820 Explorer.EXE help.exe PID 820 wrote to memory of 4732 820 Explorer.EXE help.exe PID 820 wrote to memory of 4732 820 Explorer.EXE help.exe PID 4732 wrote to memory of 4776 4732 help.exe cmd.exe PID 4732 wrote to memory of 4776 4732 help.exe cmd.exe PID 4732 wrote to memory of 4776 4732 help.exe cmd.exe PID 4732 wrote to memory of 4432 4732 help.exe cmd.exe PID 4732 wrote to memory of 4432 4732 help.exe cmd.exe PID 4732 wrote to memory of 4432 4732 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5814e53e67e68d674db42f492fb1265b2fa65c70f31d706e38ef65b3bf3c8769.exe"C:\Users\Admin\AppData\Local\Temp\5814e53e67e68d674db42f492fb1265b2fa65c70f31d706e38ef65b3bf3c8769.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rm3mzuw0\rm3mzuw0.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD297.tmp" "c:\Users\Admin\AppData\Local\Temp\rm3mzuw0\CSCB443FDB3EC5B4ED2B2DB391E4B32ABF.TMP"4⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DB1Filesize
40KB
MD5b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
C:\Users\Admin\AppData\Local\Temp\RESD297.tmpFilesize
1KB
MD5600536d04ed52849b2ea533713e25241
SHA100fd8dd61c66bfae141c24adc194153c23b3e6c7
SHA256b09835ec059430c60b4c24f76238dcc75e587f4d29d00c2340742fee20275d4c
SHA51256126940da1b0c9f6f6c7c7ab9944449b55f4284b237574cf937e8dccf8d0cd02832380cf7f5118e2f04509cb7d3ba7b1773eea26bae73794c91ac26acf9baab
-
C:\Users\Admin\AppData\Local\Temp\rm3mzuw0\rm3mzuw0.dllFilesize
6KB
MD5fc29fb84db380065a9ab4d3dac4f860d
SHA13df5e594747c3ad9ac374e47cba315ce02ddde08
SHA2561898e545b233862ce5b5018b527f995b274a1e89bb37bc76d840dea21e6ef98e
SHA512ca10af89c4dd03956638f56743ddb85ef436d85abe6bfe3aebca0fa67cb7e9bb7d5d4515c2c86cf5a041dbd1803cfd203998e60f2402140a19aad41eca1a2e12
-
C:\Users\Admin\AppData\Local\Temp\rm3mzuw0\rm3mzuw0.pdbFilesize
15KB
MD5b2b69764aff691a1df53d2bc363e00f0
SHA13880ae64a8a59078162659c2d8208e7599a1c65e
SHA256d82ef6ae67e56189415e2b8d8bb805a728a83759a1e71206f77b865aaebd1792
SHA512c5f03f8e7f8376c878d8962e370ccfa33dd1295f98eeba4c2836f4512e1d19c5ea8e8c7dcf0303cecd11c62c0418ede127d931f26e67e20b363f595d49870382
-
C:\Users\Admin\AppData\Roaming\5Q6010RE\5Q6logim.jpegFilesize
80KB
MD5582bb1021f6065ed6b87f012b578dc20
SHA103401dfb0b3a9b07213db99f0fdec790d8c79d38
SHA25679fe2f97046d43593877cb106145395323b76f76cc75579a855e1c04401a9870
SHA5120d5a2b33253b338d9ec3db255a5ae06fd613a4b1078de197d51c57a3baeec9648ccced5fce4b0e50f6b64aa2d01520b24787fbd53df0f9326af31f0e43e34bcc
-
C:\Users\Admin\AppData\Roaming\5Q6010RE\5Q6logrg.iniFilesize
38B
MD54aadf49fed30e4c9b3fe4a3dd6445ebe
SHA11e332822167c6f351b99615eada2c30a538ff037
SHA25675034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56
SHA512eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945
-
C:\Users\Admin\AppData\Roaming\5Q6010RE\5Q6logri.iniFilesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\5Q6010RE\5Q6logrv.iniFilesize
872B
MD5bbc41c78bae6c71e63cb544a6a284d94
SHA133f2c1d9fa0e9c99b80bc2500621e95af38b1f9a
SHA256ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb
SHA5120aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4
-
\??\c:\Users\Admin\AppData\Local\Temp\rm3mzuw0\CSCB443FDB3EC5B4ED2B2DB391E4B32ABF.TMPFilesize
1KB
MD5b8ff0997ae57f54de0c45f056b490af6
SHA145abe494e10b1026c396de68604e653c8626bd2e
SHA256946672c3e2bd32e970c3685a2ff08dcccae9dde560e7f78a93add86f3e67545e
SHA5124f91e97ce7cdefed6de38201598dd264904714753c6d7f418c3c4f7b45946862c7e95930d1390aa3259102b30a5b160314888b4cde921d3ed05e98f6ea863914
-
\??\c:\Users\Admin\AppData\Local\Temp\rm3mzuw0\rm3mzuw0.0.csFilesize
2KB
MD5421361a3d045f5360f16aa4c0c7c03c3
SHA1cb476e91cd6e5e0c19a3523579ebbcefc15b306f
SHA256282195a76f75c630af8034d6059dc421f05e2aa6d27b25ce2bb0ea4a7d9bd08b
SHA512232179493833a5251412533d571e2919792e895341c7bed9f93802b9563e441ee1b657b676db432960d17ae397baad09134da3b1ddb57ee346faca176b563164
-
\??\c:\Users\Admin\AppData\Local\Temp\rm3mzuw0\rm3mzuw0.cmdlineFilesize
248B
MD5e7ab4cf5795a47507a68accdd7fb0802
SHA1c701c75e86c5793d4a8020dfe0f7ac0de1c984e2
SHA256bb022ea79e5bda06ad39de9d6df2888b03e647e36c128727ecd3ec7934619f02
SHA5121a71d2756700677a0f640f60b11e19cd3df7a5775732457929e955961341808cb7f18da1d762aeecb61accdbe20826b7f4ef51ab9215ac0143e795abdf72bd2f
-
memory/820-146-0x0000000008010000-0x0000000008176000-memory.dmpFilesize
1.4MB
-
memory/820-154-0x0000000008270000-0x0000000008392000-memory.dmpFilesize
1.1MB
-
memory/820-156-0x0000000008270000-0x0000000008392000-memory.dmpFilesize
1.1MB
-
memory/1340-131-0x0000000000000000-mapping.dmp
-
memory/2136-140-0x0000000005630000-0x00000000056CC000-memory.dmpFilesize
624KB
-
memory/2136-139-0x0000000004EC0000-0x0000000004F52000-memory.dmpFilesize
584KB
-
memory/2136-130-0x0000000000630000-0x000000000066A000-memory.dmpFilesize
232KB
-
memory/4036-134-0x0000000000000000-mapping.dmp
-
memory/4432-157-0x0000000000000000-mapping.dmp
-
memory/4732-147-0x0000000000000000-mapping.dmp
-
memory/4732-152-0x0000000000390000-0x00000000003BA000-memory.dmpFilesize
168KB
-
memory/4732-153-0x0000000000C90000-0x0000000000D23000-memory.dmpFilesize
588KB
-
memory/4732-151-0x0000000000440000-0x0000000000447000-memory.dmpFilesize
28KB
-
memory/4732-155-0x0000000000390000-0x00000000003BA000-memory.dmpFilesize
168KB
-
memory/4732-150-0x0000000000E30000-0x000000000117A000-memory.dmpFilesize
3.3MB
-
memory/4776-149-0x0000000000000000-mapping.dmp
-
memory/4816-148-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/4816-145-0x00000000009F0000-0x0000000000A04000-memory.dmpFilesize
80KB
-
memory/4816-144-0x0000000000A50000-0x0000000000D9A000-memory.dmpFilesize
3.3MB
-
memory/4816-142-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/4816-141-0x0000000000000000-mapping.dmp