Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16/07/2023, 09:01
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230712-en
General
-
Target
tmp.exe
-
Size
255KB
-
MD5
5cad52271422b36941487ad44a7ade44
-
SHA1
0fa6ba3c9799301fcdb529abcb5d7098c5c3fdba
-
SHA256
0cffea5daeb941cc6235f4de2fe2ba348ff08742d196ffc68bc8d7f1109596fd
-
SHA512
b2a583bff19ace982d3f722c60d5331711a966b000f748e251b83f52eba32185f7469bcc4c0f298d7f0f3876518b0848410667067d2f3187b439a18a6ae192ab
-
SSDEEP
6144:RC2fT8maVl1F4rxzEc2qauQpeLXsS9ECZXQE3yH:pSv4rxwc2qweLXsSpX3yH
Malware Config
Extracted
formbook
4.1
ms14
adjoinstaff.online
kmmdznky.cfd
keyviewgroup.com
kidomarketing.com
jroxtqpq.cfd
jdevmx.com
genqaagz.cfd
1cdpwp.cfd
francegoldvip.com
2qy218.xyz
peterscanner.com
trullys.com
aniwatch.top
windyhillcnc.com
pokazhu.com
r74jsy.cfd
paulgadgets.com
lindanewtee.com
lasik-de-de-8808230.zone
critone.site
qwevqgjw.cfd
lojaasoriginais.online
pgtjirqx.cfd
ypasbfxplu.shop
kartixworld.com
s6uqzj.com
xigauij.cfd
arizonaadoptionagencies.com
wecanshipit.com
chiccakes.site
v3rqa4.cfd
clasmiv.xyz
kwhkqovf.cfd
metabolismchecker.click
lilith-con.com
porterhayranch.com
rikkun501.com
sxbhpysr.cfd
jc1014.com
4213z0.com
wshaizapp.site
3jij6e.cfd
weddingscork.com
zingyi.com
ixs0o9.com
tchyhg.com
printsplit.online
nihil.one
worthitweld.com
venria.store
lglcyoy.cfd
kanmuftic.com
zbjcolwy.cfd
mlking99.net
eyyk63.cfd
tcnckkne.cfd
buddhabazaar.online
tissageparis.com
cacciatoridiofferte.com
duffledash.com
kmsvvybi.cfd
aqeabrdm.cfd
qhrxnxoe.cfd
fitnessline.app
civzbpp.xyz
Signatures
-
Formbook payload 4 IoCs
resource yara_rule behavioral2/memory/4204-147-0x0000000000400000-0x0000000001654000-memory.dmp formbook behavioral2/memory/4204-150-0x0000000000400000-0x0000000001654000-memory.dmp formbook behavioral2/memory/1080-156-0x00000000011C0000-0x00000000011EE000-memory.dmp formbook behavioral2/memory/1080-162-0x00000000011C0000-0x00000000011EE000-memory.dmp formbook -
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
description ioc Process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe tmp.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe tmp.exe -
Loads dropped DLL 1 IoCs
pid Process 744 tmp.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 4204 tmp.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 744 tmp.exe 4204 tmp.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 744 set thread context of 4204 744 tmp.exe 94 PID 4204 set thread context of 2512 4204 tmp.exe 61 PID 1080 set thread context of 2512 1080 cscript.exe 61 -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\sansningerne.Unc tmp.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\resources\0409\Katje\falsebenet\Bike\Angivende.ini tmp.exe File opened for modification C:\Windows\resources\0409\Hovedgaarde.For tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 4204 tmp.exe 4204 tmp.exe 4204 tmp.exe 4204 tmp.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe 1080 cscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2512 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 744 tmp.exe 4204 tmp.exe 4204 tmp.exe 4204 tmp.exe 1080 cscript.exe 1080 cscript.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4204 tmp.exe Token: SeShutdownPrivilege 2512 Explorer.EXE Token: SeCreatePagefilePrivilege 2512 Explorer.EXE Token: SeShutdownPrivilege 2512 Explorer.EXE Token: SeCreatePagefilePrivilege 2512 Explorer.EXE Token: SeDebugPrivilege 1080 cscript.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 744 wrote to memory of 4204 744 tmp.exe 94 PID 744 wrote to memory of 4204 744 tmp.exe 94 PID 744 wrote to memory of 4204 744 tmp.exe 94 PID 744 wrote to memory of 4204 744 tmp.exe 94 PID 2512 wrote to memory of 1080 2512 Explorer.EXE 101 PID 2512 wrote to memory of 1080 2512 Explorer.EXE 101 PID 2512 wrote to memory of 1080 2512 Explorer.EXE 101 PID 1080 wrote to memory of 5064 1080 cscript.exe 102 PID 1080 wrote to memory of 5064 1080 cscript.exe 102 PID 1080 wrote to memory of 5064 1080 cscript.exe 102
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Checks QEMU agent file
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4204
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵PID:5064
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5375e8a08471dc6f85f3828488b1147b3
SHA11941484ac710fc301a7d31d6f1345e32a21546af
SHA2564c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78
SHA5125ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8