Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
08-08-2022 09:23
Static task
static1
Behavioral task
behavioral1
Sample
Re,best offer.exe
Resource
win7-20220718-en
General
-
Target
Re,best offer.exe
-
Size
973KB
-
MD5
c7f79795432fc3467aadeb0f6f736d1f
-
SHA1
3deaba5114fc244750f4af2fd6b218f96bdb5cf3
-
SHA256
bd29947fc88d96b3f5b2982d67f1d5df99aad570ce86b87ed91103b8f43c3b8f
-
SHA512
f46283bd9dc71b44c7a094f151319a03f30e9b503dfc5ef02855ccedcd1cacd8e1f110daa73f83c9218be1152a2e42826861ab18253b6d7b8b771ea86c723702
Malware Config
Extracted
formbook
4.1
ng04
tevimaq.com
easterspecialtystore.com
smartlever.tech
10312.uk
tanjawiharbi.co.uk
471338.com
horusventure.com
empress-care.com
sinrian.com
465951.com
aemsti.com
nxcourier.com
stargatefarms.com
lalyquainvestment.com
dailysportsadvice.com
justlistmoore.com
stoneonroll.online
tatianakolomiets.com
barcodebbm.com
protectorship.world
datingventure.info
aurora-body.com
sohomusicclub.com
postapudding.co.uk
mps-24.store
fengjianghu.com
fenostoreshop.site
julietterosebarney.com
1a-datenschutz.com
yejinxia.com
firstmortgagedebt.com
greengood.store
skynet-one.net
allianthrs.com
centralflfc.com
46caminosobrante.com
informatique07.com
keebu.net
gamebe.store
nicestartech.top
smbxd.com
dyadent.store
xiangmeihao.com
exac7.com
vesiensuojelu.com
youhaometal.com
jiewo.top
xmfaucet.com
avocadotaco.com
nicelove.online
beautytimelashesnails.com
domainand.site
tlqf.net
mentionevery.online
jeuxjetx.fr
device-track.co
re364t6.top
teamlepleiadi.com
againsubpackaddr.com
blemchi.xyz
yxzhcpa.com
cycle-xchange.store
medimattress.info
cosme-mochi.net
wekurd.com
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2016-64-0x000000000041F020-mapping.dmp formbook behavioral1/memory/2016-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2016-67-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1984-74-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook behavioral1/memory/1984-79-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 388 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Re,best offer.exeRe,best offer.execmstp.exedescription pid process target process PID 860 set thread context of 2016 860 Re,best offer.exe Re,best offer.exe PID 2016 set thread context of 1292 2016 Re,best offer.exe Explorer.EXE PID 1984 set thread context of 1292 1984 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
Re,best offer.execmstp.exepid process 2016 Re,best offer.exe 2016 Re,best offer.exe 1984 cmstp.exe 1984 cmstp.exe 1984 cmstp.exe 1984 cmstp.exe 1984 cmstp.exe 1984 cmstp.exe 1984 cmstp.exe 1984 cmstp.exe 1984 cmstp.exe 1984 cmstp.exe 1984 cmstp.exe 1984 cmstp.exe 1984 cmstp.exe 1984 cmstp.exe 1984 cmstp.exe 1984 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Re,best offer.execmstp.exepid process 2016 Re,best offer.exe 2016 Re,best offer.exe 2016 Re,best offer.exe 1984 cmstp.exe 1984 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Re,best offer.execmstp.exedescription pid process Token: SeDebugPrivilege 2016 Re,best offer.exe Token: SeDebugPrivilege 1984 cmstp.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
Re,best offer.exeExplorer.EXEpid process 860 Re,best offer.exe 1292 Explorer.EXE 1292 Explorer.EXE -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
Re,best offer.exeExplorer.EXEpid process 860 Re,best offer.exe 1292 Explorer.EXE 1292 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Re,best offer.exeExplorer.EXEcmstp.exedescription pid process target process PID 860 wrote to memory of 2016 860 Re,best offer.exe Re,best offer.exe PID 860 wrote to memory of 2016 860 Re,best offer.exe Re,best offer.exe PID 860 wrote to memory of 2016 860 Re,best offer.exe Re,best offer.exe PID 860 wrote to memory of 2016 860 Re,best offer.exe Re,best offer.exe PID 860 wrote to memory of 2016 860 Re,best offer.exe Re,best offer.exe PID 860 wrote to memory of 2016 860 Re,best offer.exe Re,best offer.exe PID 860 wrote to memory of 2016 860 Re,best offer.exe Re,best offer.exe PID 1292 wrote to memory of 1984 1292 Explorer.EXE cmstp.exe PID 1292 wrote to memory of 1984 1292 Explorer.EXE cmstp.exe PID 1292 wrote to memory of 1984 1292 Explorer.EXE cmstp.exe PID 1292 wrote to memory of 1984 1292 Explorer.EXE cmstp.exe PID 1292 wrote to memory of 1984 1292 Explorer.EXE cmstp.exe PID 1292 wrote to memory of 1984 1292 Explorer.EXE cmstp.exe PID 1292 wrote to memory of 1984 1292 Explorer.EXE cmstp.exe PID 1984 wrote to memory of 388 1984 cmstp.exe cmd.exe PID 1984 wrote to memory of 388 1984 cmstp.exe cmd.exe PID 1984 wrote to memory of 388 1984 cmstp.exe cmd.exe PID 1984 wrote to memory of 388 1984 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Re,best offer.exe"C:\Users\Admin\AppData\Local\Temp\Re,best offer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Re,best offer.exe"C:\Users\Admin\AppData\Local\Temp\Re,best offer.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Re,best offer.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/388-72-0x0000000000000000-mapping.dmp
-
memory/860-55-0x0000000076681000-0x0000000076683000-memory.dmpFilesize
8KB
-
memory/860-56-0x0000000000670000-0x0000000000690000-memory.dmpFilesize
128KB
-
memory/860-57-0x0000000000620000-0x000000000062C000-memory.dmpFilesize
48KB
-
memory/860-58-0x0000000005C70000-0x0000000005CE4000-memory.dmpFilesize
464KB
-
memory/860-59-0x00000000046A0000-0x00000000046D4000-memory.dmpFilesize
208KB
-
memory/860-54-0x0000000000ED0000-0x0000000000FC8000-memory.dmpFilesize
992KB
-
memory/1292-69-0x0000000004C10000-0x0000000004CF0000-memory.dmpFilesize
896KB
-
memory/1292-80-0x0000000004E20000-0x0000000004EF9000-memory.dmpFilesize
868KB
-
memory/1292-78-0x0000000004C10000-0x0000000004CF0000-memory.dmpFilesize
896KB
-
memory/1292-77-0x0000000004E20000-0x0000000004EF9000-memory.dmpFilesize
868KB
-
memory/1984-79-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB
-
memory/1984-75-0x0000000001F00000-0x0000000002203000-memory.dmpFilesize
3.0MB
-
memory/1984-76-0x0000000001E10000-0x0000000001EA4000-memory.dmpFilesize
592KB
-
memory/1984-70-0x0000000000000000-mapping.dmp
-
memory/1984-74-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB
-
memory/1984-73-0x0000000000250000-0x0000000000268000-memory.dmpFilesize
96KB
-
memory/2016-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2016-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2016-68-0x0000000000180000-0x0000000000195000-memory.dmpFilesize
84KB
-
memory/2016-66-0x00000000009C0000-0x0000000000CC3000-memory.dmpFilesize
3.0MB
-
memory/2016-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2016-64-0x000000000041F020-mapping.dmp
-
memory/2016-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB