Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
18-08-2022 21:24
Static task
static1
Behavioral task
behavioral1
Sample
Re,best offer.exe
Resource
win7-20220812-en
General
-
Target
Re,best offer.exe
-
Size
973KB
-
MD5
c7f79795432fc3467aadeb0f6f736d1f
-
SHA1
3deaba5114fc244750f4af2fd6b218f96bdb5cf3
-
SHA256
bd29947fc88d96b3f5b2982d67f1d5df99aad570ce86b87ed91103b8f43c3b8f
-
SHA512
f46283bd9dc71b44c7a094f151319a03f30e9b503dfc5ef02855ccedcd1cacd8e1f110daa73f83c9218be1152a2e42826861ab18253b6d7b8b771ea86c723702
Malware Config
Extracted
formbook
4.1
ng04
tevimaq.com
easterspecialtystore.com
smartlever.tech
10312.uk
tanjawiharbi.co.uk
471338.com
horusventure.com
empress-care.com
sinrian.com
465951.com
aemsti.com
nxcourier.com
stargatefarms.com
lalyquainvestment.com
dailysportsadvice.com
justlistmoore.com
stoneonroll.online
tatianakolomiets.com
barcodebbm.com
protectorship.world
datingventure.info
aurora-body.com
sohomusicclub.com
postapudding.co.uk
mps-24.store
fengjianghu.com
fenostoreshop.site
julietterosebarney.com
1a-datenschutz.com
yejinxia.com
firstmortgagedebt.com
greengood.store
skynet-one.net
allianthrs.com
centralflfc.com
46caminosobrante.com
informatique07.com
keebu.net
gamebe.store
nicestartech.top
smbxd.com
dyadent.store
xiangmeihao.com
exac7.com
vesiensuojelu.com
youhaometal.com
jiewo.top
xmfaucet.com
avocadotaco.com
nicelove.online
beautytimelashesnails.com
domainand.site
tlqf.net
mentionevery.online
jeuxjetx.fr
device-track.co
re364t6.top
teamlepleiadi.com
againsubpackaddr.com
blemchi.xyz
yxzhcpa.com
cycle-xchange.store
medimattress.info
cosme-mochi.net
wekurd.com
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/980-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/980-64-0x000000000041F020-mapping.dmp formbook behavioral1/memory/980-71-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1508-74-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/1508-78-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 916 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Re,best offer.exeRe,best offer.exeNETSTAT.EXEdescription pid process target process PID 576 set thread context of 980 576 Re,best offer.exe Re,best offer.exe PID 980 set thread context of 1384 980 Re,best offer.exe Explorer.EXE PID 1508 set thread context of 1384 1508 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 1508 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
Re,best offer.exeNETSTAT.EXEpid process 980 Re,best offer.exe 980 Re,best offer.exe 1508 NETSTAT.EXE 1508 NETSTAT.EXE 1508 NETSTAT.EXE 1508 NETSTAT.EXE 1508 NETSTAT.EXE 1508 NETSTAT.EXE 1508 NETSTAT.EXE 1508 NETSTAT.EXE 1508 NETSTAT.EXE 1508 NETSTAT.EXE 1508 NETSTAT.EXE 1508 NETSTAT.EXE 1508 NETSTAT.EXE 1508 NETSTAT.EXE 1508 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Re,best offer.exeNETSTAT.EXEpid process 980 Re,best offer.exe 980 Re,best offer.exe 980 Re,best offer.exe 1508 NETSTAT.EXE 1508 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Re,best offer.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 980 Re,best offer.exe Token: SeDebugPrivilege 1508 NETSTAT.EXE -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
Re,best offer.exeExplorer.EXEpid process 576 Re,best offer.exe 1384 Explorer.EXE 1384 Explorer.EXE -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
Re,best offer.exeExplorer.EXEpid process 576 Re,best offer.exe 1384 Explorer.EXE 1384 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Re,best offer.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 576 wrote to memory of 980 576 Re,best offer.exe Re,best offer.exe PID 576 wrote to memory of 980 576 Re,best offer.exe Re,best offer.exe PID 576 wrote to memory of 980 576 Re,best offer.exe Re,best offer.exe PID 576 wrote to memory of 980 576 Re,best offer.exe Re,best offer.exe PID 576 wrote to memory of 980 576 Re,best offer.exe Re,best offer.exe PID 576 wrote to memory of 980 576 Re,best offer.exe Re,best offer.exe PID 576 wrote to memory of 980 576 Re,best offer.exe Re,best offer.exe PID 1384 wrote to memory of 1508 1384 Explorer.EXE NETSTAT.EXE PID 1384 wrote to memory of 1508 1384 Explorer.EXE NETSTAT.EXE PID 1384 wrote to memory of 1508 1384 Explorer.EXE NETSTAT.EXE PID 1384 wrote to memory of 1508 1384 Explorer.EXE NETSTAT.EXE PID 1508 wrote to memory of 916 1508 NETSTAT.EXE cmd.exe PID 1508 wrote to memory of 916 1508 NETSTAT.EXE cmd.exe PID 1508 wrote to memory of 916 1508 NETSTAT.EXE cmd.exe PID 1508 wrote to memory of 916 1508 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\Re,best offer.exe"C:\Users\Admin\AppData\Local\Temp\Re,best offer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\Re,best offer.exe"C:\Users\Admin\AppData\Local\Temp\Re,best offer.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:980 -
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Re,best offer.exe"3⤵
- Deletes itself
PID:916
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/576-65-0x0000000004865000-0x0000000004876000-memory.dmpFilesize
68KB
-
memory/576-55-0x0000000075911000-0x0000000075913000-memory.dmpFilesize
8KB
-
memory/576-56-0x0000000000730000-0x0000000000750000-memory.dmpFilesize
128KB
-
memory/576-57-0x0000000000510000-0x000000000051C000-memory.dmpFilesize
48KB
-
memory/576-58-0x0000000005080000-0x00000000050F4000-memory.dmpFilesize
464KB
-
memory/576-59-0x0000000000B40000-0x0000000000B74000-memory.dmpFilesize
208KB
-
memory/576-54-0x0000000001010000-0x0000000001108000-memory.dmpFilesize
992KB
-
memory/916-72-0x0000000000000000-mapping.dmp
-
memory/980-68-0x0000000000140000-0x0000000000155000-memory.dmpFilesize
84KB
-
memory/980-71-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/980-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/980-67-0x0000000000770000-0x0000000000A73000-memory.dmpFilesize
3.0MB
-
memory/980-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/980-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/980-64-0x000000000041F020-mapping.dmp
-
memory/1384-69-0x0000000004CC0000-0x0000000004E47000-memory.dmpFilesize
1.5MB
-
memory/1384-77-0x0000000004910000-0x00000000049AA000-memory.dmpFilesize
616KB
-
memory/1384-79-0x0000000004910000-0x00000000049AA000-memory.dmpFilesize
616KB
-
memory/1508-70-0x0000000000000000-mapping.dmp
-
memory/1508-73-0x00000000002C0000-0x00000000002C9000-memory.dmpFilesize
36KB
-
memory/1508-75-0x0000000002250000-0x0000000002553000-memory.dmpFilesize
3.0MB
-
memory/1508-74-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1508-76-0x0000000001FD0000-0x0000000002064000-memory.dmpFilesize
592KB
-
memory/1508-78-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB