Analysis
- max time kernel
150s - max time network
151s - platform
windows7_x64 - resource
win7 - submitted
18/08/2020, 07:40
Static task
static1
Behavioral task
behavioral1
Sample
Remittance copy.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target Remittance copy.exe
- Size 1021KB
- Sample200818-73yt4ml86x
- SHA256 e2ff7c5e749d36ebfcc2a9d5af487369e454ef301a859eb8fc11ebe15ea73e34
- MD5 d9122108ec3cd7a570190d6add288526
- SHA1 c3bb30592f68bb0071b72828ee1480ed673cbb85
- SHA512 00a5ba7002c4231254ecc7a669b9e453430c3101937896a25cb4c341da123d1fd23b0e4b8094d003520a61b35ea9a92ffa30a4f898eb3457c2faf43a4dcf859f
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.iskovlay.com/mcn/
Decoy
-
qww13.com
-
polyadmission.com
-
blackbaycooler.com
-
angelmedics.net
-
saludcomplementariaintegral.com
-
multonin.reisen
-
atelier-des-lilas.com
-
theflamingorealtygroup.info
-
minnesotaauto.loan
-
silvfly.com
-
ubaoc.com
-
learcane.net
-
giftcardcodegenerator.com
-
consciousnessunpleasant.com
-
g1media.net
-
wwwstrikeout.com
-
yimifanghua.com
-
stampkm.com
-
bx-wdcl.com
-
unieekly.net
-
endsellerfraud.com
-
kriptoanaliz.com
-
deepcallsmusic.com
-
antiterrorsecurity.technology
-
wesk.tech
-
xbjxs.com
-
jnjmqzzl.com
-
1-edogawa-one.net
-
hnpzgc.com
-
vieclam-jobs.net
-
intensivprogramme.com
-
jlegitimus.com
-
f0aw9u.com
-
strikermillion.net
-
skyhomeshn.com
-
thatmountainbiking.com
-
sanweigame.com
-
rilke.photography
-
jp-accntapps02102911verif.com
-
radiomaceiomix.com
-
theshopby.com
-
surveywithease.com
-
cexo.ltd
-
frontgames.info
-
ukdealpal.com
-
fizzwagon.com
-
beautyfullyboundless.com
-
myadaptivespace.com
-
gentlemanism.com
-
longdu665.com
-
mlabsassociates.com
-
adventurechanneltv.com
-
j9d9.com
-
ehoulby.com
-
schisox.win
-
serviceiqinternational.com
-
smokinginc.com
-
mariscando.com
-
larympei.com
-
zhguixin.site
-
yuomi.net
-
butiku01.com
-
recetasinstantpot.com
-
designing-home.com
Signatures
- Formbook Payload 4 IoCs
resource yara_rule behavioral1/memory/760-6-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/760-6-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/760-7-0x000000000041E310-mapping.dmp formbook behavioral1/memory/1064-8-0x0000000000000000-mapping.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1448 set thread context of 760 1448 Remittance copy.exe 25 PID 760 set thread context of 1312 760 RegAsm.exe 20 PID 1064 set thread context of 1312 1064 cmstp.exe 20 - Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 760 RegAsm.exe 760 RegAsm.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe 1064 cmstp.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1448 Remittance copy.exe 1448 Remittance copy.exe 760 RegAsm.exe 760 RegAsm.exe 760 RegAsm.exe 1064 cmstp.exe 1064 cmstp.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 760 RegAsm.exe Token: SeDebugPrivilege 1064 cmstp.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1312 Explorer.EXE 1312 Explorer.EXE 1312 Explorer.EXE 1312 Explorer.EXE 1312 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1312 Explorer.EXE 1312 Explorer.EXE 1312 Explorer.EXE 1312 Explorer.EXE - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1448 wrote to memory of 800 1448 Remittance copy.exe 24 PID 1448 wrote to memory of 800 1448 Remittance copy.exe 24 PID 1448 wrote to memory of 800 1448 Remittance copy.exe 24 PID 1448 wrote to memory of 800 1448 Remittance copy.exe 24 PID 1448 wrote to memory of 800 1448 Remittance copy.exe 24 PID 1448 wrote to memory of 800 1448 Remittance copy.exe 24 PID 1448 wrote to memory of 800 1448 Remittance copy.exe 24 PID 1448 wrote to memory of 760 1448 Remittance copy.exe 25 PID 1448 wrote to memory of 760 1448 Remittance copy.exe 25 PID 1448 wrote to memory of 760 1448 Remittance copy.exe 25 PID 1448 wrote to memory of 760 1448 Remittance copy.exe 25 PID 1448 wrote to memory of 760 1448 Remittance copy.exe 25 PID 1448 wrote to memory of 760 1448 Remittance copy.exe 25 PID 1448 wrote to memory of 760 1448 Remittance copy.exe 25 PID 1448 wrote to memory of 760 1448 Remittance copy.exe 25 PID 1312 wrote to memory of 1064 1312 Explorer.EXE 26 PID 1312 wrote to memory of 1064 1312 Explorer.EXE 26 PID 1312 wrote to memory of 1064 1312 Explorer.EXE 26 PID 1312 wrote to memory of 1064 1312 Explorer.EXE 26 PID 1312 wrote to memory of 1064 1312 Explorer.EXE 26 PID 1312 wrote to memory of 1064 1312 Explorer.EXE 26 PID 1312 wrote to memory of 1064 1312 Explorer.EXE 26 PID 1064 wrote to memory of 1120 1064 cmstp.exe 27 PID 1064 wrote to memory of 1120 1064 cmstp.exe 27 PID 1064 wrote to memory of 1120 1064 cmstp.exe 27 PID 1064 wrote to memory of 1120 1064 cmstp.exe 27
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\Remittance copy.exe"C:\Users\Admin\AppData\Local\Temp\Remittance copy.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:800
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:760
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:1120
-
-