Analysis
- max time kernel
147s - max time network
11s - platform
windows7_x64 - resource
win7v200722 - submitted
07/10/2020, 14:52
Static task
static1
Behavioral task
behavioral1
Sample
eed37078c2abd45504eebb66e9a99564.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target eed37078c2abd45504eebb66e9a99564.exe
- Size 666KB
- Sample201007-akvxdcv8qa
- SHA256 fd9f113a78e94fc975ba4e5e940c91395e63b5ea904e7690fbad9f569b6da1b8
- MD5 eed37078c2abd45504eebb66e9a99564
- SHA1 6d4b8ca46323f91ff6eb3c756a95785c79e95403
- SHA512 344fdfcdba4b5f391c6f2d852e6c2e520573e1d88e768759ef7d07e53120768a2c7b34d4608ff58adcbec2e5da63f302eb1d87e64223cfdbf44022da9f071d50
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.ccminghao.com/bnc/
Decoy
-
iseoguide.com
-
rogerellisonline.com
-
thephonelenses.com
-
reddystone.com
-
explorehokianga.com
-
miaflcio.vote
-
baonihaochi.com
-
thewiseengineer.com
-
exciplexinc.com
-
luewaeeqaredre.com
-
atharvatechnologysolutions.com
-
vnsr1234.com
-
nationswines.com
-
toaglobalcc.com
-
texasbusrental.com
-
sailfishingcostarica.com
-
superbuy.today
-
mode-paradox.com
-
soperlz.xyz
-
filterdance.com
-
bllck.com
-
cocitas.com
-
hiflips.com
-
in-unicorn.com
-
panduitusa.com
-
pradamany.com
-
takingcheck.com
-
thinlinecreations.com
-
trendycollectionz.com
-
chantalrenaud.com
-
bundangsvc.com
-
stlouisoutdooradventures.com
-
patcapfinances.com
-
online-record.com
-
bangbangfactory.com
-
zzzttt10.com
-
jennishewardart.com
-
number1texasmedium.com
-
organichighqualityrush.com
-
ja6g.com
-
futureballet.com
-
siliconchips-synctoday.com
-
mesotherlioma.com
-
wzditai.com
-
chemcleandw.com
-
changhong433sj.com
-
k2night.com
-
londonvisas.com
-
luxuryfloatingflat.com
-
dgsazeh.com
-
graeciantiqui.net
-
finehairedgirls.com
-
comsweetrbx.com
-
pcnyyxo.icu
-
sevilce.com
-
omhwywwcxorl.com
-
top10mindset.com
-
cristinaiovu.com
-
fcpinnovacion.com
-
marcelopissardini.com
-
scorebuddycx.com
-
xn--lsuoa.net
-
mrchensauthenticchinese.com
-
jesse-mansfield.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral1/memory/1892-6-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1892-7-0x000000000041EB20-mapping.dmp formbook behavioral1/memory/1992-9-0x0000000000000000-mapping.dmp formbook - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1264 set thread context of 1892 1264 eed37078c2abd45504eebb66e9a99564.exe 30 PID 1892 set thread context of 1200 1892 RegSvcs.exe 20 PID 1892 set thread context of 1200 1892 RegSvcs.exe 20 PID 1992 set thread context of 1200 1992 svchost.exe 20 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1264 eed37078c2abd45504eebb66e9a99564.exe 1264 eed37078c2abd45504eebb66e9a99564.exe 1264 eed37078c2abd45504eebb66e9a99564.exe 1892 RegSvcs.exe 1892 RegSvcs.exe 1892 RegSvcs.exe 1992 svchost.exe 1992 svchost.exe 1992 svchost.exe 1992 svchost.exe 1992 svchost.exe 1992 svchost.exe 1992 svchost.exe 1992 svchost.exe 1992 svchost.exe 1992 svchost.exe 1992 svchost.exe 1992 svchost.exe 1992 svchost.exe 1992 svchost.exe 1992 svchost.exe 1992 svchost.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1892 RegSvcs.exe 1892 RegSvcs.exe 1892 RegSvcs.exe 1892 RegSvcs.exe 1992 svchost.exe 1992 svchost.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1264 eed37078c2abd45504eebb66e9a99564.exe Token: SeDebugPrivilege 1892 RegSvcs.exe Token: SeDebugPrivilege 1992 svchost.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE - Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1264 wrote to memory of 1928 1264 eed37078c2abd45504eebb66e9a99564.exe 28 PID 1264 wrote to memory of 1928 1264 eed37078c2abd45504eebb66e9a99564.exe 28 PID 1264 wrote to memory of 1928 1264 eed37078c2abd45504eebb66e9a99564.exe 28 PID 1264 wrote to memory of 1928 1264 eed37078c2abd45504eebb66e9a99564.exe 28 PID 1264 wrote to memory of 1928 1264 eed37078c2abd45504eebb66e9a99564.exe 28 PID 1264 wrote to memory of 1928 1264 eed37078c2abd45504eebb66e9a99564.exe 28 PID 1264 wrote to memory of 1928 1264 eed37078c2abd45504eebb66e9a99564.exe 28 PID 1264 wrote to memory of 1920 1264 eed37078c2abd45504eebb66e9a99564.exe 29 PID 1264 wrote to memory of 1920 1264 eed37078c2abd45504eebb66e9a99564.exe 29 PID 1264 wrote to memory of 1920 1264 eed37078c2abd45504eebb66e9a99564.exe 29 PID 1264 wrote to memory of 1920 1264 eed37078c2abd45504eebb66e9a99564.exe 29 PID 1264 wrote to memory of 1920 1264 eed37078c2abd45504eebb66e9a99564.exe 29 PID 1264 wrote to memory of 1920 1264 eed37078c2abd45504eebb66e9a99564.exe 29 PID 1264 wrote to memory of 1920 1264 eed37078c2abd45504eebb66e9a99564.exe 29 PID 1264 wrote to memory of 1892 1264 eed37078c2abd45504eebb66e9a99564.exe 30 PID 1264 wrote to memory of 1892 1264 eed37078c2abd45504eebb66e9a99564.exe 30 PID 1264 wrote to memory of 1892 1264 eed37078c2abd45504eebb66e9a99564.exe 30 PID 1264 wrote to memory of 1892 1264 eed37078c2abd45504eebb66e9a99564.exe 30 PID 1264 wrote to memory of 1892 1264 eed37078c2abd45504eebb66e9a99564.exe 30 PID 1264 wrote to memory of 1892 1264 eed37078c2abd45504eebb66e9a99564.exe 30 PID 1264 wrote to memory of 1892 1264 eed37078c2abd45504eebb66e9a99564.exe 30 PID 1264 wrote to memory of 1892 1264 eed37078c2abd45504eebb66e9a99564.exe 30 PID 1264 wrote to memory of 1892 1264 eed37078c2abd45504eebb66e9a99564.exe 30 PID 1264 wrote to memory of 1892 1264 eed37078c2abd45504eebb66e9a99564.exe 30 PID 1200 wrote to memory of 1992 1200 Explorer.EXE 31 PID 1200 wrote to memory of 1992 1200 Explorer.EXE 31 PID 1200 wrote to memory of 1992 1200 Explorer.EXE 31 PID 1200 wrote to memory of 1992 1200 Explorer.EXE 31 PID 1992 wrote to memory of 1968 1992 svchost.exe 32 PID 1992 wrote to memory of 1968 1992 svchost.exe 32 PID 1992 wrote to memory of 1968 1992 svchost.exe 32 PID 1992 wrote to memory of 1968 1992 svchost.exe 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\eed37078c2abd45504eebb66e9a99564.exe"C:\Users\Admin\AppData\Local\Temp\eed37078c2abd45504eebb66e9a99564.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:1928
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:1920
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1892
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:1968
-
-