Analysis
- max time kernel
148s - max time network
149s - platform
windows10_x64 - resource
win10v200722 - submitted
18/08/2020, 11:44
Static task
static1
Behavioral task
behavioral1
Sample
SCAN_PAYMENT ADVICE.scr
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target SCAN_PAYMENT ADVICE.scr
- Size 189KB
- Sample200818-llzzzcndd2
- SHA256 017bb0ec25e33f7dbefcac17b8bdfc5ca199579e0d7a14670270eef15ff8abce
- MD5 58e5625ddd12f520189eb0e06e5bc08d
- SHA1 8976890c7799f2b43d0f87d13e578971150a2601
- SHA512 ce8fc7600d350e3ffb9da859fcca89fc359fa2142ddebc23d7f8eac37c950ad05798f13552e3062d75bcdc28f3cf50cd53554dea4adbb9c0da834d2068870dbc
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.mage-cart.info/d9s8/
Decoy
-
dengken.net
-
mifrio.com
-
testingin01beta.biz
-
upsidedownspeaking.net
-
808manx.com
-
tacticalthieves.com
-
hairbyedy.com
-
freddyrentcar.com
-
pacificbrandsuk.com
-
vienesta.com
-
juzi007.com
-
masterclasslaunchformula.com
-
sentrahidroponik.com
-
n-riched.com
-
codingcaptor.net
-
artisanal-wines.com
-
dreamycosmetics.com
-
cryptoxpace.com
-
honezanz.biz
-
rocknbpropertymanagement.com
-
syracusebodysculpt.com
-
0pe10.com
-
tchwza.faith
-
reina-no-hetae.com
-
amaliaarfelt.com
-
akasha-palembang.com
-
itsaston.com
-
thehintforyou.net
-
underdecklifestyle.com
-
calistawellbeing.com
-
4862666.com
-
brttkorea.com
-
intocoupons.download
-
buytec.net
-
elskercreations.com
-
simposioiamaecenas.com
-
jinglepantsinc.com
-
dara88.com
-
rlvxing.com
-
mynaturalhealingsolutions.com
-
jamesreadhughes.com
-
xn--brndebixen-e6a.com
-
eveningsuffer.net
-
2690870.top
-
earnestinemaddison.net
-
204bifa.com
-
instagram.erni
-
buildingmaterialbarginctr.com
-
innosign.gmbh
-
darlingpomeranianpup.com
-
atlas2018.com
-
mecidiyekahve.com
-
lherbertdesigns.com
-
tx-nude.men
-
catfishcadenza.com
-
zeewatson.com
-
qv22.com
-
strictlydigitalproduction.com
-
kilgoresfitness.com
-
naturevolved.com
-
xiongantrip.top
-
ufnda.info
-
vqvfc.info
-
283cb.com
Signatures
- Formbook Payload 7 IoCs
resource yara_rule behavioral2/memory/512-5-0x0000000005A00000-0x0000000005A32000-memory.dmp formbook behavioral2/memory/512-5-0x0000000005A00000-0x0000000005A32000-memory.dmp formbook behavioral2/memory/612-6-0x0000000000400000-0x0000000000430000-memory.dmp formbook behavioral2/memory/612-6-0x0000000000400000-0x0000000000430000-memory.dmp formbook behavioral2/memory/612-7-0x000000000041CA10-mapping.dmp formbook behavioral2/memory/1076-8-0x0000000000000000-mapping.dmp formbook behavioral2/memory/4076-30-0x000000000041CA10-mapping.dmp formbook - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XBMLDZUHQLA = "C:\\Program Files (x86)\\Sc6ft\\ilntb6hrpx0.exe" svchost.exe - Executes dropped EXE 2 IoCs
pid Process 2264 ilntb6hrpx0.exe 4076 ilntb6hrpx0.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 512 set thread context of 612 512 SCAN_PAYMENT ADVICE.scr 66 PID 612 set thread context of 2112 612 SCAN_PAYMENT ADVICE.scr 56 PID 1076 set thread context of 2112 1076 svchost.exe 56 PID 2264 set thread context of 4076 2264 ilntb6hrpx0.exe 80 - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Sc6ft\ilntb6hrpx0.exe svchost.exe File opened for modification C:\Program Files (x86)\Sc6ft Explorer.EXE File created C:\Program Files (x86)\Sc6ft\ilntb6hrpx0.exe Explorer.EXE File opened for modification C:\Program Files (x86)\Sc6ft\ilntb6hrpx0.exe Explorer.EXE -
description ioc Process Key created \Registry\User\S-1-5-21-1400429095-533421673-2598934218-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 svchost.exe - Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 612 SCAN_PAYMENT ADVICE.scr 612 SCAN_PAYMENT ADVICE.scr 612 SCAN_PAYMENT ADVICE.scr 612 SCAN_PAYMENT ADVICE.scr 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 4076 ilntb6hrpx0.exe 4076 ilntb6hrpx0.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 612 SCAN_PAYMENT ADVICE.scr 612 SCAN_PAYMENT ADVICE.scr 612 SCAN_PAYMENT ADVICE.scr 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe 1076 svchost.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 512 SCAN_PAYMENT ADVICE.scr Token: SeDebugPrivilege 612 SCAN_PAYMENT ADVICE.scr Token: SeDebugPrivilege 1076 svchost.exe Token: SeShutdownPrivilege 2112 Explorer.EXE Token: SeCreatePagefilePrivilege 2112 Explorer.EXE Token: SeShutdownPrivilege 2112 Explorer.EXE Token: SeCreatePagefilePrivilege 2112 Explorer.EXE Token: SeShutdownPrivilege 2112 Explorer.EXE Token: SeCreatePagefilePrivilege 2112 Explorer.EXE Token: SeDebugPrivilege 2264 ilntb6hrpx0.exe Token: SeDebugPrivilege 4076 ilntb6hrpx0.exe - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 512 wrote to memory of 612 512 SCAN_PAYMENT ADVICE.scr 66 PID 512 wrote to memory of 612 512 SCAN_PAYMENT ADVICE.scr 66 PID 512 wrote to memory of 612 512 SCAN_PAYMENT ADVICE.scr 66 PID 512 wrote to memory of 612 512 SCAN_PAYMENT ADVICE.scr 66 PID 512 wrote to memory of 612 512 SCAN_PAYMENT ADVICE.scr 66 PID 512 wrote to memory of 612 512 SCAN_PAYMENT ADVICE.scr 66 PID 512 wrote to memory of 612 512 SCAN_PAYMENT ADVICE.scr 66 PID 2112 wrote to memory of 1076 2112 Explorer.EXE 67 PID 2112 wrote to memory of 1076 2112 Explorer.EXE 67 PID 2112 wrote to memory of 1076 2112 Explorer.EXE 67 PID 1076 wrote to memory of 1208 1076 svchost.exe 68 PID 1076 wrote to memory of 1208 1076 svchost.exe 68 PID 1076 wrote to memory of 1208 1076 svchost.exe 68 PID 1076 wrote to memory of 3528 1076 svchost.exe 76 PID 1076 wrote to memory of 3528 1076 svchost.exe 76 PID 1076 wrote to memory of 3528 1076 svchost.exe 76 PID 1076 wrote to memory of 3124 1076 svchost.exe 78 PID 1076 wrote to memory of 3124 1076 svchost.exe 78 PID 1076 wrote to memory of 3124 1076 svchost.exe 78 PID 2112 wrote to memory of 2264 2112 Explorer.EXE 79 PID 2112 wrote to memory of 2264 2112 Explorer.EXE 79 PID 2112 wrote to memory of 2264 2112 Explorer.EXE 79 PID 2264 wrote to memory of 4076 2264 ilntb6hrpx0.exe 80 PID 2264 wrote to memory of 4076 2264 ilntb6hrpx0.exe 80 PID 2264 wrote to memory of 4076 2264 ilntb6hrpx0.exe 80 PID 2264 wrote to memory of 4076 2264 ilntb6hrpx0.exe 80 PID 2264 wrote to memory of 4076 2264 ilntb6hrpx0.exe 80 PID 2264 wrote to memory of 4076 2264 ilntb6hrpx0.exe 80 PID 2264 wrote to memory of 4076 2264 ilntb6hrpx0.exe 80
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\SCAN_PAYMENT ADVICE.scr"C:\Users\Admin\AppData\Local\Temp\SCAN_PAYMENT ADVICE.scr" /S2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Users\Admin\AppData\Local\Temp\SCAN_PAYMENT ADVICE.scr"C:\Users\Admin\AppData\Local\Temp\SCAN_PAYMENT ADVICE.scr"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:612
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SCAN_PAYMENT ADVICE.scr"3⤵PID:1208
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3528
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3124
-
-
-
C:\Program Files (x86)\Sc6ft\ilntb6hrpx0.exe"C:\Program Files (x86)\Sc6ft\ilntb6hrpx0.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Program Files (x86)\Sc6ft\ilntb6hrpx0.exe"C:\Program Files (x86)\Sc6ft\ilntb6hrpx0.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4076
-
-