Analysis
- max time kernel
148s - max time network
144s - platform
windows10_x64 - resource
win10v200722 - submitted
23/10/2020, 08:54
Static task
static1
Behavioral task
behavioral1
Sample
Bank Receipt.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target Bank Receipt.exe
- Size 424KB
- Sample201023-8wp996fmtn
- SHA256 b7d55f5145ac91a9b2e9d1b98f65bf6844248ebd6612be241e2fe5755dcf0733
- MD5 87472467d8185998553cc37afce80bbd
- SHA1 e4b671f691c4b067743de9e2ff2a91b534c183a1
- SHA512 a3d5e2871480997b87ab89d83115afca65c1073517f3a31791a6007063ffbc884ed200e8efc12f38ee36e85c05e5d002c7dbc3baf0c22eef7c2fef1bc1c46636
- MD5 SHA1 SHA512
Malware Config
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/2752-5-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2752-6-0x000000000041EB80-mapping.dmp formbook behavioral2/memory/3872-13-0x0000000000000000-mapping.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3900 set thread context of 2752 3900 Bank Receipt.exe 72 PID 2752 set thread context of 3044 2752 Bank Receipt.exe 56 PID 3872 set thread context of 3044 3872 help.exe 56 - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3900 Bank Receipt.exe 2752 Bank Receipt.exe 2752 Bank Receipt.exe 2752 Bank Receipt.exe 2752 Bank Receipt.exe 3900 Bank Receipt.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe 3872 help.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2752 Bank Receipt.exe 2752 Bank Receipt.exe 2752 Bank Receipt.exe 3872 help.exe 3872 help.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 3900 Bank Receipt.exe Token: 33 3900 Bank Receipt.exe Token: SeIncBasePriorityPrivilege 3900 Bank Receipt.exe Token: SeDebugPrivilege 2752 Bank Receipt.exe Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeDebugPrivilege 3872 help.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3900 wrote to memory of 2752 3900 Bank Receipt.exe 72 PID 3900 wrote to memory of 2752 3900 Bank Receipt.exe 72 PID 3900 wrote to memory of 2752 3900 Bank Receipt.exe 72 PID 3900 wrote to memory of 2752 3900 Bank Receipt.exe 72 PID 3900 wrote to memory of 2752 3900 Bank Receipt.exe 72 PID 3900 wrote to memory of 2752 3900 Bank Receipt.exe 72 PID 3044 wrote to memory of 3872 3044 Explorer.EXE 73 PID 3044 wrote to memory of 3872 3044 Explorer.EXE 73 PID 3044 wrote to memory of 3872 3044 Explorer.EXE 73 PID 3900 wrote to memory of 3976 3900 Bank Receipt.exe 74 PID 3900 wrote to memory of 3976 3900 Bank Receipt.exe 74 PID 3900 wrote to memory of 3976 3900 Bank Receipt.exe 74 PID 3900 wrote to memory of 3944 3900 Bank Receipt.exe 76 PID 3900 wrote to memory of 3944 3900 Bank Receipt.exe 76 PID 3900 wrote to memory of 3944 3900 Bank Receipt.exe 76 PID 3944 wrote to memory of 3448 3944 cmd.exe 78 PID 3944 wrote to memory of 3448 3944 cmd.exe 78 PID 3944 wrote to memory of 3448 3944 cmd.exe 78 PID 3900 wrote to memory of 3552 3900 Bank Receipt.exe 79 PID 3900 wrote to memory of 3552 3900 Bank Receipt.exe 79 PID 3900 wrote to memory of 3552 3900 Bank Receipt.exe 79 PID 3872 wrote to memory of 3800 3872 help.exe 84 PID 3872 wrote to memory of 3800 3872 help.exe 84 PID 3872 wrote to memory of 3800 3872 help.exe 84
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\Bank Receipt.exe"C:\Users\Admin\AppData\Local\Temp\Bank Receipt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\Bank Receipt.exe"C:/Users/Admin/AppData/Local/Temp/Bank Receipt.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2752
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/Bank Receipt.exe" "%temp%\FolderN\name.exe" /Y3⤵PID:3976
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f3⤵
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f4⤵PID:3448
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier3⤵
- NTFS ADS
PID:3552
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Bank Receipt.exe"3⤵PID:3800
-
-