Analysis
- max time kernel
149s - max time network
146s - platform
windows10_x64 - resource
win10 - submitted
08/10/2020, 05:19
Static task
static1
Behavioral task
behavioral1
Sample
af02d7120e0060d42064f98a12bad0bb.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target af02d7120e0060d42064f98a12bad0bb.exe
- Size 438KB
- Sample201008-v22hb2xa96
- SHA256 ebd88634ecfbdc7e88bca32a0b22fa35e24c9feb309799128f3d12d2cceac224
- MD5 af02d7120e0060d42064f98a12bad0bb
- SHA1 7e40ca578adc6790bee70f4a705c03a60b2e4ff6
- SHA512 54d6a69840c7181c70e76e0ebe1a55d3610267ae5c4be9c338b6ff6a19c34cbf1dbf0d39a71be1fcdc5a5990a364b22a625372e8d9fd3ebefdee03115f67a477
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.strivefalcon.com/c233/
Decoy
-
habittudes.com
-
alfud.com
-
greenzwjh.com
-
firebreez.com
-
elmejortoldodecanarias.com
-
miramelfruits.com
-
kamalunacollective.com
-
petitpaul.art
-
houw.info
-
agilitysystem.net
-
briandnewby.com
-
tijancompound.com
-
rxefills.com
-
omesatr.com
-
funghs0.com
-
fumoebrace.com
-
agusrachmanto.xyz
-
fingerofsunshine.com
-
hzitta.com
-
franomista.com
-
somosfigura.com
-
donaldjtruo.com
-
kompassportenentertainment.com
-
k8vina54.com
-
cixibags.com
-
pixiedustbowtique.com
-
riorojopueblo.com
-
elmouse95.com
-
snoconsulting.net
-
hometownprocleaningservice.com
-
purpose.works
-
21labbe.com
-
basictophp.com
-
0755dazhe.com
-
selecthealtadvantageotc.com
-
thetubefactor.com
-
cheflm.com
-
sxdzmj.com
-
xn--2i0bk4c.com
-
tokosalep.com
-
laboutiquedecoco.com
-
tierrabrown.com
-
pavoservices.com
-
elveellainapparel.com
-
tiktoks.info
-
qajcyyy.com
-
diamondgservices.com
-
fetusbreeder.com
-
ceramicnewengland.com
-
wonderfulvpn.xyz
-
airshotsus.com
-
spacex-drones.com
-
postcardsfromnz.com
-
perceptionzine.com
-
meetsno.site
-
hawowkow.com
-
thervervideo.com
-
raizzlearning.com
-
teacherstoybox.com
-
minhbaongocplastics.com
-
esq2b.com
-
bookbeachrecliners.com
-
daija1.com
-
metaltechnologiesllc.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/3176-4-0x0000000004480000-0x00000000044AE000-memory.dmp formbook behavioral2/memory/2208-5-0x0000000000000000-mapping.dmp formbook behavioral2/memory/2132-6-0x0000000000000000-mapping.dmp formbook - Loads dropped DLL 1 IoCs
pid Process 3176 rundll32.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2208 set thread context of 2984 2208 cmd.exe 56 PID 2132 set thread context of 2984 2132 cmd.exe 56 - Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 3176 rundll32.exe 2208 cmd.exe 2208 cmd.exe 2208 cmd.exe 2208 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe 2132 cmd.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 3176 rundll32.exe 2208 cmd.exe 2208 cmd.exe 2208 cmd.exe 2132 cmd.exe 2132 cmd.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2208 cmd.exe Token: SeDebugPrivilege 2132 cmd.exe - Suspicious use of WriteProcessMemory 89 IoCs
description pid Process procid_target PID 3932 wrote to memory of 3176 3932 af02d7120e0060d42064f98a12bad0bb.exe 76 PID 3932 wrote to memory of 3176 3932 af02d7120e0060d42064f98a12bad0bb.exe 76 PID 3932 wrote to memory of 3176 3932 af02d7120e0060d42064f98a12bad0bb.exe 76 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 3176 wrote to memory of 2208 3176 rundll32.exe 77 PID 2984 wrote to memory of 2132 2984 Explorer.EXE 78 PID 2984 wrote to memory of 2132 2984 Explorer.EXE 78 PID 2984 wrote to memory of 2132 2984 Explorer.EXE 78 PID 2132 wrote to memory of 2256 2132 cmd.exe 79 PID 2132 wrote to memory of 2256 2132 cmd.exe 79 PID 2132 wrote to memory of 2256 2132 cmd.exe 79
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\af02d7120e0060d42064f98a12bad0bb.exe"C:\Users\Admin\AppData\Local\Temp\af02d7120e0060d42064f98a12bad0bb.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe Courtesan,Expectorator3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2208
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2132 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"3⤵PID:2256
-
-