Analysis
- max time kernel
148s - max time network
135s - platform
windows10_x64 - resource
win10v200722 - submitted
17/08/2020, 19:06
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target file.exe
- Size 1.7MB
- Sample200817-efe6a46jya
- SHA256 3c758c3133fb2a7c7c51b2ec84028759bc99e1f3ca3bc22c1046d90f79801f76
- MD5 d9169d17075bb755958f2ce58d8adc72
- SHA1 0cdce4e32588aa24117ab4aacbe2d13be9f9d069
- SHA512 2a5a14d9e9f784f284b2d1bdbb31831f01ef7aac749e445fe8498737da37b21695a6d0197839d57d85b8cb84939c011f38651c01d3261bf041df976621a54e11
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.joomlas123.info/3nop/
Decoy
-
bakecakesandmore.com
-
shenglisuoye.com
-
chinapopfactory.com
-
ynlrhd.com
-
liqourforyou.com
-
leonqamil.com
-
meccafon.com
-
online-marketing-strategie.biz
-
rbfxi.com
-
frseyb.info
-
leyu91.com
-
hotsmail.today
-
beepot.tech
-
dunaemmetmobility.com
-
sixpenceworkshop.com
-
incrediblefavorcoaching.com
-
pofo.info
-
yanshudaili.com
-
yellowbrickwedding.com
-
paintpartyblueprint.com
-
capricorn1967.com
-
meucarrapicho.com
-
41230793.net
-
yoghurtberry.com
-
wv0uoagz0yr.biz
-
yfjbupes.com
-
mindfulinthemadness.com
-
deloslifesciences.com
-
adokristal.com
-
vandergardetuinmeubelshop.com
-
janewagtus.com
-
cloudmorning.com
-
foresteryt01.com
-
accident-law-yer.info
-
divorcerefinance.guru
-
wenxiban.com
-
589man.com
-
rockerdwe.com
-
duftkerzen.info
-
igametalent.com
-
yoursafetraffictoupdates.review
-
jialingjiangpubu.com
-
maximscrapbooking.com
-
20sf.info
-
shadowlandswitchery.com
-
pmbnc.info
-
shoppingdrift.online
-
potashdragon.com
-
ubkswmpes.com
-
064ewj.info
-
rewsales.com
-
dealsforyou.tech
-
ziruixu.com
-
naehascloud.com
-
smokvape.faith
-
sunflowermoonstudio.com
-
stepgentertainment.com
-
tawbj.info
-
besthappybuds.net
-
koohshoping.com
-
ajikrentcarsurabaya.com
-
jkjohnsroofingfl.com
-
whatsnexttnd.com
-
yoyodvd.com
Signatures
- Formbook Payload 4 IoCs
resource yara_rule behavioral2/memory/904-2-0x0000000010410000-0x000000001043D000-memory.dmp formbook behavioral2/memory/904-2-0x0000000010410000-0x000000001043D000-memory.dmp formbook behavioral2/memory/1356-3-0x0000000000000000-mapping.dmp formbook behavioral2/memory/1508-4-0x0000000000000000-mapping.dmp formbook - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-2168186643-810464528-1121082739-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cmd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2168186643-810464528-1121082739-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GHV4ANAXRTC = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" cmd.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-2168186643-810464528-1121082739-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cmd.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1356 set thread context of 1568 1356 ieinstal.exe 56 PID 1508 set thread context of 1568 1508 cmd.exe 56 -
description ioc Process Key created \Registry\User\S-1-5-21-2168186643-810464528-1121082739-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmd.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 file.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030106082b0601050507030706082b0601050507030206082b0601050507030406082b0601050507030353000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e file.exe - Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 1356 ieinstal.exe 1356 ieinstal.exe 1356 ieinstal.exe 1356 ieinstal.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1356 ieinstal.exe 1356 ieinstal.exe 1356 ieinstal.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe 1508 cmd.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1356 ieinstal.exe Token: SeDebugPrivilege 1508 cmd.exe Token: SeShutdownPrivilege 1568 Explorer.EXE Token: SeCreatePagefilePrivilege 1568 Explorer.EXE Token: SeShutdownPrivilege 1568 Explorer.EXE Token: SeCreatePagefilePrivilege 1568 Explorer.EXE Token: SeShutdownPrivilege 1568 Explorer.EXE Token: SeCreatePagefilePrivilege 1568 Explorer.EXE Token: SeShutdownPrivilege 1568 Explorer.EXE Token: SeCreatePagefilePrivilege 1568 Explorer.EXE Token: SeShutdownPrivilege 1568 Explorer.EXE Token: SeCreatePagefilePrivilege 1568 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 904 wrote to memory of 1356 904 file.exe 67 PID 904 wrote to memory of 1356 904 file.exe 67 PID 904 wrote to memory of 1356 904 file.exe 67 PID 904 wrote to memory of 1356 904 file.exe 67 PID 904 wrote to memory of 1356 904 file.exe 67 PID 904 wrote to memory of 1356 904 file.exe 67 PID 1568 wrote to memory of 1508 1568 Explorer.EXE 68 PID 1568 wrote to memory of 1508 1568 Explorer.EXE 68 PID 1568 wrote to memory of 1508 1568 Explorer.EXE 68 PID 1508 wrote to memory of 2052 1508 cmd.exe 70 PID 1508 wrote to memory of 2052 1508 cmd.exe 70 PID 1508 wrote to memory of 2052 1508 cmd.exe 70 PID 1508 wrote to memory of 3724 1508 cmd.exe 76 PID 1508 wrote to memory of 3724 1508 cmd.exe 76 PID 1508 wrote to memory of 3724 1508 cmd.exe 76
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1356
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:2052
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3724
-
-