Analysis
-
max time kernel
148s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220722-en -
resource tags
arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2022 02:59
Static task
static1
Behavioral task
behavioral1
Sample
PO3117_002422.exe
Resource
win7-20220718-en
General
-
Target
PO3117_002422.exe
-
Size
11KB
-
MD5
a870810c6219011f00d22b6881c322b7
-
SHA1
3569ca5bd8eb29b3fdaa5fbf2209ea69d38428fc
-
SHA256
996e0d318e87eec169553d7a73048312946a95d9f07cb6f7ac01227955ad619c
-
SHA512
0a95e3cbb62f387fd078dc3c81cb944bde566baecb14642f580249cb4a054e2b5e024103150552636f8f2a030a00927ce425f8da2d9ce492bcbc466db09605f7
Malware Config
Extracted
formbook
4.1
df48
tinder.pw
flowersfoodsbrands.net
broadbandbangalore.com
wittyhealthy.com
mediking.online
pounchbowl.com
gridkart.com
mobrtho.com
starlinerecruitment.com
ernieswinesandliquors.com
dsbvgf.com
messiahbaptist.church
sumsandals.com
familieheineken.online
fikifika.com
beg.wtf
euroconsult.net
radiologist24.com
fuji-privatevilla.com
flemming.store
simplymanaged.rentals
pnsrjp.com
platinumedicaladmin.com
walleti.tech
sayingcoxy.com
flowersfooods.net
forekshesabiolustur.com
wesvon.online
symphonycontest.com
startup-int.com
xn--evgvenliksistemleri-79b.com
thevirtualghost.com
bjjdating.com
gaff.pet
xenoinvest.com
manpowernews.net
psychedelicexpertshop.com
blackrockf.com
seacliffdogwalking.com
bapakmu21.com
bldgops.com
finestbrieftoperceivetoday.info
trizzle.xyz
youeve.com
hikachika.com
utahprabrasileiros.com
dwez.net
hotelpatasycolas.com
trapanibedbreakfast.com
customerchoicehomes.com
openup.design
muwilp.com
digitslot777.net
torrestreet.com
lowerrates.site
shema.pro
musicbylionel.com
mixasia.net
rupting.com
idol-d.com
fbinternettrackingettlement.com
vernonriverchurch.net
kaseybabe.com
dowupkeep.com
bmtd.net
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1868-138-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1868-140-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/540-146-0x0000000000540000-0x000000000056F000-memory.dmp formbook behavioral2/memory/540-149-0x0000000000540000-0x000000000056F000-memory.dmp formbook -
Drops startup file 2 IoCs
Processes:
PO3117_002422.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO3117_002422.exe PO3117_002422.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO3117_002422.exe PO3117_002422.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO3117_002422.exePO3117_002422.exeNETSTAT.EXEdescription pid process target process PID 4320 set thread context of 1868 4320 PO3117_002422.exe PO3117_002422.exe PID 1868 set thread context of 2232 1868 PO3117_002422.exe Explorer.EXE PID 540 set thread context of 2232 540 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 540 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
PO3117_002422.exePO3117_002422.exeNETSTAT.EXEpid process 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 4320 PO3117_002422.exe 1868 PO3117_002422.exe 1868 PO3117_002422.exe 1868 PO3117_002422.exe 1868 PO3117_002422.exe 540 NETSTAT.EXE 540 NETSTAT.EXE 540 NETSTAT.EXE 540 NETSTAT.EXE 540 NETSTAT.EXE 540 NETSTAT.EXE 540 NETSTAT.EXE 540 NETSTAT.EXE 540 NETSTAT.EXE 540 NETSTAT.EXE 540 NETSTAT.EXE 540 NETSTAT.EXE 540 NETSTAT.EXE 540 NETSTAT.EXE 540 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2232 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PO3117_002422.exeNETSTAT.EXEpid process 1868 PO3117_002422.exe 1868 PO3117_002422.exe 1868 PO3117_002422.exe 540 NETSTAT.EXE 540 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PO3117_002422.exePO3117_002422.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 4320 PO3117_002422.exe Token: SeDebugPrivilege 1868 PO3117_002422.exe Token: SeDebugPrivilege 540 NETSTAT.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PO3117_002422.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 4320 wrote to memory of 1868 4320 PO3117_002422.exe PO3117_002422.exe PID 4320 wrote to memory of 1868 4320 PO3117_002422.exe PO3117_002422.exe PID 4320 wrote to memory of 1868 4320 PO3117_002422.exe PO3117_002422.exe PID 4320 wrote to memory of 1868 4320 PO3117_002422.exe PO3117_002422.exe PID 4320 wrote to memory of 1868 4320 PO3117_002422.exe PO3117_002422.exe PID 4320 wrote to memory of 1868 4320 PO3117_002422.exe PO3117_002422.exe PID 2232 wrote to memory of 540 2232 Explorer.EXE NETSTAT.EXE PID 2232 wrote to memory of 540 2232 Explorer.EXE NETSTAT.EXE PID 2232 wrote to memory of 540 2232 Explorer.EXE NETSTAT.EXE PID 540 wrote to memory of 5072 540 NETSTAT.EXE cmd.exe PID 540 wrote to memory of 5072 540 NETSTAT.EXE cmd.exe PID 540 wrote to memory of 5072 540 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\PO3117_002422.exe"C:\Users\Admin\AppData\Local\Temp\PO3117_002422.exe"2⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\PO3117_002422.exe"C:\Users\Admin\AppData\Local\Temp\PO3117_002422.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1868 -
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO3117_002422.exe"3⤵PID:5072
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/540-144-0x0000000000000000-mapping.dmp
-
memory/540-150-0x0000000000C80000-0x0000000000D13000-memory.dmpFilesize
588KB
-
memory/540-149-0x0000000000540000-0x000000000056F000-memory.dmpFilesize
188KB
-
memory/540-147-0x0000000000EE0000-0x000000000122A000-memory.dmpFilesize
3.3MB
-
memory/540-146-0x0000000000540000-0x000000000056F000-memory.dmpFilesize
188KB
-
memory/540-145-0x0000000000510000-0x000000000051B000-memory.dmpFilesize
44KB
-
memory/1868-137-0x0000000000000000-mapping.dmp
-
memory/1868-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1868-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1868-141-0x00000000011C0000-0x000000000150A000-memory.dmpFilesize
3.3MB
-
memory/1868-142-0x0000000001190000-0x00000000011A4000-memory.dmpFilesize
80KB
-
memory/2232-143-0x0000000008D20000-0x0000000008E5A000-memory.dmpFilesize
1.2MB
-
memory/2232-151-0x0000000008F00000-0x0000000009058000-memory.dmpFilesize
1.3MB
-
memory/2232-152-0x0000000008F00000-0x0000000009058000-memory.dmpFilesize
1.3MB
-
memory/4320-132-0x0000000000F80000-0x0000000000F8A000-memory.dmpFilesize
40KB
-
memory/4320-136-0x0000000006FD0000-0x0000000007036000-memory.dmpFilesize
408KB
-
memory/4320-135-0x0000000006F30000-0x0000000006FCC000-memory.dmpFilesize
624KB
-
memory/4320-134-0x0000000005940000-0x00000000059D2000-memory.dmpFilesize
584KB
-
memory/4320-133-0x0000000005E50000-0x00000000063F4000-memory.dmpFilesize
5.6MB
-
memory/5072-148-0x0000000000000000-mapping.dmp