Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 14:55
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230831-en
General
-
Target
tmp.exe
-
Size
626KB
-
MD5
b1635f0a98ef8519984bb3f9ef1979f8
-
SHA1
ef247f07d841bc68214c37597cc4557ce8b09ca2
-
SHA256
be8032937b016362c56bd7da1fce8a127af3f1a13839b11a96480a53f0d548f6
-
SHA512
e8127ee5acd14d85048ffadd764e81b3761db25f77778e2013bce358f499d896770fc82b37f8e3d280018c91c06cd3300c35fbd473ff3c7d1c8c9b746fb24e92
-
SSDEEP
12288:JVj3hLQvfdxOo7gpXtrrF725O3CyIKvykzST2YXMq2bI3cjhyZSbR565SRE5uPPC:ZMCjIKzzwXzTayMbq5X5APE1
Malware Config
Extracted
formbook
4.1
ro12
start399.com
decyfincoin.com
binguozhijiaok.com
one45.vip
55dy5s.top
regmt.pro
2ahxgaafifl.com
xn--6rtp2flvfc2h.com
justinmburns.com
los3.online
fleshaaikensdivinegiven7llc.com
servicedelv.services
apexcaryhomesforsale.com
shuraop.xyz
sagetotal.com
gratitude-et-compagnie.com
riderarea.com
digitalserviceact.online
contentbyc.com
agenda-digital-planner.com
senior-living-91799.bond
navigationexperiments.com
tiktok-shop-he.com
qualityquickprints.com
ddbetting.com
navigatenuggets.com
indiannaturals.online
xzgx360.com
xlrj.asia
seagaming.net
saltcasing.info
pq-es.com
doubleapus.com
speedgallery.shop
millions-fans.com
ktrandnews.com
niaeoer.com
60plusmen.com
nala.dev
costanotaryservice.com
palokallio.net
sportsynergyemporium.fun
fathomtackle.com
computer-chronicles.com
valeriaestate.com
holzleisten24.shop
ps212naming.com
blessed-autos.com
rptiki.com
bjykswkj.com
vorbergh.info
ssongg273.cfd
thevitaminstore.store
easyeats307.com
mcied.link
ssongg1620.cfd
y-12federalcreditunion.top
jlh777.com
no5th3267.top
toolifyonline.com
hcsjwdy.com
ypwvj8.top
hja357b.com
bajie6.com
pwpholdings.com
Signatures
-
Formbook payload 4 IoCs
resource yara_rule behavioral1/memory/2564-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2564-18-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2516-24-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/2516-26-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
pid Process 2476 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2808 set thread context of 2564 2808 tmp.exe 30 PID 2564 set thread context of 1268 2564 tmp.exe 21 PID 2516 set thread context of 1268 2516 chkdsk.exe 21 -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2808 tmp.exe 2808 tmp.exe 2808 tmp.exe 2808 tmp.exe 2808 tmp.exe 2808 tmp.exe 2808 tmp.exe 2564 tmp.exe 2564 tmp.exe 2516 chkdsk.exe 2516 chkdsk.exe 2516 chkdsk.exe 2516 chkdsk.exe 2516 chkdsk.exe 2516 chkdsk.exe 2516 chkdsk.exe 2516 chkdsk.exe 2516 chkdsk.exe 2516 chkdsk.exe 2516 chkdsk.exe 2516 chkdsk.exe 2516 chkdsk.exe 2516 chkdsk.exe 2516 chkdsk.exe 2516 chkdsk.exe 2516 chkdsk.exe 2516 chkdsk.exe 2516 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1268 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2564 tmp.exe 2564 tmp.exe 2564 tmp.exe 2516 chkdsk.exe 2516 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2808 tmp.exe Token: SeDebugPrivilege 2564 tmp.exe Token: SeDebugPrivilege 2516 chkdsk.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2808 wrote to memory of 2564 2808 tmp.exe 30 PID 2808 wrote to memory of 2564 2808 tmp.exe 30 PID 2808 wrote to memory of 2564 2808 tmp.exe 30 PID 2808 wrote to memory of 2564 2808 tmp.exe 30 PID 2808 wrote to memory of 2564 2808 tmp.exe 30 PID 2808 wrote to memory of 2564 2808 tmp.exe 30 PID 2808 wrote to memory of 2564 2808 tmp.exe 30 PID 1268 wrote to memory of 2516 1268 Explorer.EXE 31 PID 1268 wrote to memory of 2516 1268 Explorer.EXE 31 PID 1268 wrote to memory of 2516 1268 Explorer.EXE 31 PID 1268 wrote to memory of 2516 1268 Explorer.EXE 31 PID 2516 wrote to memory of 2476 2516 chkdsk.exe 32 PID 2516 wrote to memory of 2476 2516 chkdsk.exe 32 PID 2516 wrote to memory of 2476 2516 chkdsk.exe 32 PID 2516 wrote to memory of 2476 2516 chkdsk.exe 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Deletes itself
PID:2476
-
-