Analysis
- max time kernel
150s - max time network
139s - platform
windows10_x64 - resource
win10 - submitted
19/08/2020, 11:18
Static task
static1
Behavioral task
behavioral1
Sample
Confirmation coupon.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target Confirmation coupon.exe
- Size 1016KB
- Sample200819-xg3bty66ce
- SHA256 37e7b7329552ca9f6ab3233ebe1d8ab96c4385b941b31a21ea43c4c2b85fca61
- MD5 72ae0dcb4e1ee4967c220fdd458eeada
- SHA1 5dc0fbd12332e524b1f3c87854e11426d249b998
- SHA512 711c2dd59b8230dc104d8bff88beeebaa909c869e0380f33684fb32dcde2b11b8a71e1c19626079246c455420bc2de1a3226f870b0aed70d51d54f5a6dfe3745
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.fex-tracks.com/hx232/
Decoy
-
locavi33.com
-
footdirectch.com
-
carolinasofina.com
-
sarancasyab.com
-
ourdata.science
-
thewanderingnovice.com
-
hcijq.info
-
peasinabags.com
-
klobucharforpres.com
-
enthb.com
-
cleveparker.com
-
newsflixes.com
-
authorbrandonwong.com
-
bai44777.com
-
nesiacraft.com
-
sandhursthotel.com
-
motorcyclegas.insure
-
latestjobsnigeria.com
-
sylpt.com
-
usvsai.com
-
carmonaruizabogados.com
-
ultimate-baiak.com
-
xunrongda.com
-
rangeevents.com
-
luoyivision.com
-
purplepatriot.net
-
painlesscollective.com
-
ri7788.com
-
040369.com
-
wwwjinsha76.com
-
dunkirkappliances.com
-
companysolucoes.com
-
anatomixboys.com
-
brunoegeisa.com
-
gordanbarrett.com
-
rosagregg.com
-
coursezille.men
-
compareaway.com
-
sheloveshairbeautybar.com
-
tourskisrepare.com
-
krisnaloka.com
-
dd88a.com
-
gorakhpurmarket.com
-
virginrose.group
-
fortwojf.com
-
fivendimeshop.com
-
prestige-europe.com
-
tu215.com
-
pevidl.men
-
jacobusfamilyinvestors.com
-
qianhefanzhuang.com
-
zpjn978ifbqu41dmc.review
-
minnesotatech.com
-
chargedbyqi.com
-
templewebber.net
-
zctlz.info
-
bienesraicesgr.com
-
hackbob.com
-
totalplace.win
-
oklahomacollective.com
-
jixiangyanglaoyuan.com
-
sammamishpropertymanagement.com
-
xn--vuqp1e13s14y.com
-
kontrolunitesi.com
Signatures
- Formbook Payload 4 IoCs
resource yara_rule behavioral2/memory/760-8-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/760-8-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/760-9-0x000000000041ED60-mapping.dmp formbook behavioral2/memory/3088-15-0x0000000000000000-mapping.dmp formbook - Executes dropped EXE 3 IoCs
pid Process 3844 jnpcpkqq.pif 760 RegSvcs.exe 492 RegSvcs.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run cscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\T6QLQXLPZ = "C:\\Program Files (x86)\\Yltkd\\1b7p7bmyzbhbd18.exe" cscript.exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3844 set thread context of 760 3844 jnpcpkqq.pif 70 PID 760 set thread context of 3016 760 RegSvcs.exe 56 PID 760 set thread context of 3016 760 RegSvcs.exe 56 PID 3088 set thread context of 3016 3088 cscript.exe 56 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Yltkd\1b7p7bmyzbhbd18.exe cscript.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cscript.exe - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 760 RegSvcs.exe 760 RegSvcs.exe 760 RegSvcs.exe 760 RegSvcs.exe 760 RegSvcs.exe 760 RegSvcs.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe - Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 760 RegSvcs.exe 760 RegSvcs.exe 760 RegSvcs.exe 760 RegSvcs.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe 3088 cscript.exe - Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeDebugPrivilege 760 RegSvcs.exe Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeDebugPrivilege 3088 cscript.exe Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3844 jnpcpkqq.pif - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3068 wrote to memory of 3844 3068 Confirmation coupon.exe 67 PID 3068 wrote to memory of 3844 3068 Confirmation coupon.exe 67 PID 3068 wrote to memory of 3844 3068 Confirmation coupon.exe 67 PID 3844 wrote to memory of 492 3844 jnpcpkqq.pif 69 PID 3844 wrote to memory of 492 3844 jnpcpkqq.pif 69 PID 3844 wrote to memory of 492 3844 jnpcpkqq.pif 69 PID 3844 wrote to memory of 760 3844 jnpcpkqq.pif 70 PID 3844 wrote to memory of 760 3844 jnpcpkqq.pif 70 PID 3844 wrote to memory of 760 3844 jnpcpkqq.pif 70 PID 3844 wrote to memory of 760 3844 jnpcpkqq.pif 70 PID 3844 wrote to memory of 760 3844 jnpcpkqq.pif 70 PID 3844 wrote to memory of 760 3844 jnpcpkqq.pif 70 PID 760 wrote to memory of 3088 760 RegSvcs.exe 71 PID 760 wrote to memory of 3088 760 RegSvcs.exe 71 PID 760 wrote to memory of 3088 760 RegSvcs.exe 71 PID 3088 wrote to memory of 3104 3088 cscript.exe 72 PID 3088 wrote to memory of 3104 3088 cscript.exe 72 PID 3088 wrote to memory of 3104 3088 cscript.exe 72 PID 3088 wrote to memory of 3000 3088 cscript.exe 80 PID 3088 wrote to memory of 3000 3088 cscript.exe 80 PID 3088 wrote to memory of 3000 3088 cscript.exe 80 PID 3088 wrote to memory of 2076 3088 cscript.exe 82 PID 3088 wrote to memory of 2076 3088 cscript.exe 82 PID 3088 wrote to memory of 2076 3088 cscript.exe 82
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\Confirmation coupon.exe"C:\Users\Admin\AppData\Local\Temp\Confirmation coupon.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Roaming\78120940\jnpcpkqq.pif"C:\Users\Admin\AppData\Roaming\78120940\jnpcpkqq.pif" exmmgvmwk.mjv3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"4⤵
- Executes dropped EXE
PID:492
-
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"5⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"6⤵PID:3104
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V6⤵PID:3000
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"6⤵PID:2076
-
-
-
-
-