Analysis
- max time kernel
148s - max time network
150s - platform
windows10_x64 - resource
win10 - submitted
18/08/2020, 06:23
Static task
static1
Behavioral task
behavioral1
Sample
PO HT54336789.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target PO HT54336789.exe
- Size 811KB
- Sample200818-p5ek9eyrqa
- SHA256 b8a70285a4c92a2f629bcb9f0beafccf5ac73e934e28401b970ad4ca6d8bc60b
- MD5 e19f2c8f75ec33d61e158c2164c5cb94
- SHA1 689bbeb42d88436b6388f42133e3d79e077e1b14
- SHA512 406ce3bea945a9ebf2419baf9c2512c360074f2c42f148bf0b2b2beacb572a4d21fa4c4cc0a0c2209ee3ef46cbc6e28ca451cd66fdda8b4a41031e52de9d2d05
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.joomlas123.com/juw/
Decoy
-
thelisareport.com
-
madoola.com
-
equifaxsecurityr017.com
-
jasacoin.com
-
freepizza.download
-
nyactressphoto.com
-
laminasyacero.com
-
helpusbook.com
-
stankabartik.com
-
onlinecupon.com
-
mingzhanyun.com
-
hollywoodspy.online
-
physiotherapie-urdenbach.com
-
qinyeylqx.com
-
mudgalhightech.com
-
northcarolinahydrogen.com
-
tendingthefields.com
-
jlap.ltd
-
bakimliyasa.com
-
abbaoding.com
-
memeqsmtp-21.com
-
alanapate.com
-
airplanescooter.com
-
favoritetrafficforupdate.date
-
childandyouthentrepreneurs.com
-
struosrl.com
-
sanconventioncenter.com
-
santarosadecabal.tours
-
freecarinsurancepricequotes.com
-
drahtbieger.com
-
displayangel.com
-
benchcitystpete.com
-
blzcqs.com
-
avalonriverservices.com
-
huilvxing.com
-
eimly.com
-
progression2work.com
-
odessian.services
-
xn--ok-5f5d.com
-
powa.ltd
-
qxaqrj.info
-
bj-jwzd.com
-
trattoria-villa-conte.com
-
familydesigninc.com
-
weareshiro.com
-
brkser.com
-
hlwgo.com
-
mfix.ltd
-
schlusseldiensthamburg.com
-
1x-73.online
-
gorentmore.com
-
galge.info
-
advicehosting.com
-
clydemccartney.com
-
cemekhpn.com
-
naughtycrush.com
-
thecollagendiet.biz
-
vfashionaccessories.com
-
wanaarecipe.com
-
bannervestibularrehab.com
-
celebritysteals.com
-
colnevalleyselfstorage.com
-
com-listing-rental.online
-
d3x88mk.top
Signatures
- Formbook Payload 4 IoCs
resource yara_rule behavioral2/memory/1980-1-0x000000000041EDC0-mapping.dmp formbook behavioral2/memory/1980-0-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/1980-0-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3640-2-0x0000000000000000-mapping.dmp formbook - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run mstsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\5JDPLHTXGVE = "C:\\Program Files (x86)\\At4nh\\8pu0ytn4.exe" mstsc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3984 set thread context of 1980 3984 PO HT54336789.exe 67 PID 1980 set thread context of 3028 1980 PO HT54336789.exe 56 PID 3640 set thread context of 3028 3640 mstsc.exe 56 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\At4nh\8pu0ytn4.exe mstsc.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 mstsc.exe - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 3984 PO HT54336789.exe 3984 PO HT54336789.exe 1980 PO HT54336789.exe 1980 PO HT54336789.exe 1980 PO HT54336789.exe 1980 PO HT54336789.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe - Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 3984 PO HT54336789.exe 1980 PO HT54336789.exe 1980 PO HT54336789.exe 1980 PO HT54336789.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe 3640 mstsc.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 1980 PO HT54336789.exe Token: SeDebugPrivilege 3640 mstsc.exe Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3028 Explorer.EXE - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3028 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3984 wrote to memory of 1980 3984 PO HT54336789.exe 67 PID 3984 wrote to memory of 1980 3984 PO HT54336789.exe 67 PID 3984 wrote to memory of 1980 3984 PO HT54336789.exe 67 PID 3028 wrote to memory of 3640 3028 Explorer.EXE 72 PID 3028 wrote to memory of 3640 3028 Explorer.EXE 72 PID 3028 wrote to memory of 3640 3028 Explorer.EXE 72 PID 3640 wrote to memory of 3972 3640 mstsc.exe 73 PID 3640 wrote to memory of 3972 3640 mstsc.exe 73 PID 3640 wrote to memory of 3972 3640 mstsc.exe 73 PID 3640 wrote to memory of 3096 3640 mstsc.exe 75 PID 3640 wrote to memory of 3096 3640 mstsc.exe 75 PID 3640 wrote to memory of 3096 3640 mstsc.exe 75 PID 3640 wrote to memory of 3872 3640 mstsc.exe 79 PID 3640 wrote to memory of 3872 3640 mstsc.exe 79 PID 3640 wrote to memory of 3872 3640 mstsc.exe 79
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\PO HT54336789.exe"C:\Users\Admin\AppData\Local\Temp\PO HT54336789.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\PO HT54336789.exe"C:\Users\Admin\AppData\Local\Temp\PO HT54336789.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1980
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:3876
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:3880
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2328
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:3860
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO HT54336789.exe"3⤵PID:3972
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3096
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3872
-
-