Analysis
- max time kernel
148s - max time network
142s - platform
windows10_x64 - resource
win10 - submitted
23/10/2020, 06:47
Static task
static1
Behavioral task
behavioral1
Sample
Bank Swift TT copy.exe
Resource
win7v200722
windows7_x64
General
- Target Bank Swift TT copy.exe
- Size 882KB
- Sample201023-e4ln8bjzh6
- SHA256 51fc4c13e2fa607113d821aaab2ba2e96d10097d69698ec3facc71b8b751e068
- MD5 750573c0d279954b21170cd2e060002e
- SHA1 b2b914956935da87e68847688476e4dbcdd9f3ce
- SHA512 90e5ae4fda9520bbd145cd9a712c04a0b0d376825ab6a3bd8873b088dd4ce05aad4bfa3d19aa38a2300631d72c7b9a44766a063302be3635ae08288271aa0ce3
- MD5 SHA1 SHA512
Malware Config
Extracted
-
formbook
-
http://www.onedollarreports.com/ga4/
-
rivercitygoldens.com
-
seattlebarkery.com
-
jxsxdb.com
-
bet365o1.com
-
mynexthomedfw.com
-
scheduleyourintentions.com
-
vestingfacts.com
-
angelicasanchezpsicologa.com
-
constructorariedel.com
-
myabron.com
-
askthepotato.com
-
cuscases.com
-
dlrioata.com
-
ilikecircles.com
-
teamsters401kupsplan.com
-
79dzb.com
-
simoneventpros.com
-
cloversonglyrics.com
-
intansuper.com
-
gamefacesydney.com
-
rangemarketsltd.com
-
hobbyoo.com
-
miniperle.com
-
p17173.com
-
leveecrossfit.com
-
despoticat.com
-
mingchi168.com
-
zumoapp.xyz
-
outdoorsmanparadise.com
-
loveahoodie.net
-
vigorlifeproject.com
-
zoomforyourhealth.com
-
xcusebeseheje.com
-
avorothforever.com
-
cornak.xyz
-
99f91.com
-
twofishsoft.com
-
xn--qpr83at9ccyf9y6dksya.site
-
fisheye.fish
-
sanskaar.life
-
afghanmoneyexchange.com
-
capitalvideos.com
-
nunezh.com
-
ghhjddtu.com
-
emythaccelerators.com
-
hellocarrey.com
-
notify-nab.com
-
ninjamelody.com
-
qihuo119.com
-
anandsharmah.com
-
javedcoaching.com
-
st883.com
-
pawhot.com
-
xisburgueria.com
-
indiana4biden.com
-
foodrenewal.com
-
weibringcreative.com
-
theloveofliving.com
-
grandbilisim.com
-
pleasurezoneplaybook.com
-
merhomeimprovement.com
-
mydepressed.com
-
bolplasticelaguilagt.com
-
nikoladom.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/1228-0-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/1228-1-0x000000000041EB60-mapping.dmp formbook behavioral2/memory/1448-3-0x0000000000000000-mapping.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3828 set thread context of 1228 3828 Bank Swift TT copy.exe 76 PID 1228 set thread context of 3028 1228 Bank Swift TT copy.exe 56 PID 1448 set thread context of 3028 1448 msiexec.exe 56 - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 1228 Bank Swift TT copy.exe 1228 Bank Swift TT copy.exe 1228 Bank Swift TT copy.exe 1228 Bank Swift TT copy.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe 1448 msiexec.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1228 Bank Swift TT copy.exe 1228 Bank Swift TT copy.exe 1228 Bank Swift TT copy.exe 1448 msiexec.exe 1448 msiexec.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1228 Bank Swift TT copy.exe Token: SeDebugPrivilege 1448 msiexec.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3828 wrote to memory of 1228 3828 Bank Swift TT copy.exe 76 PID 3828 wrote to memory of 1228 3828 Bank Swift TT copy.exe 76 PID 3828 wrote to memory of 1228 3828 Bank Swift TT copy.exe 76 PID 3828 wrote to memory of 1228 3828 Bank Swift TT copy.exe 76 PID 3828 wrote to memory of 1228 3828 Bank Swift TT copy.exe 76 PID 3828 wrote to memory of 1228 3828 Bank Swift TT copy.exe 76 PID 3028 wrote to memory of 1448 3028 Explorer.EXE 77 PID 3028 wrote to memory of 1448 3028 Explorer.EXE 77 PID 3028 wrote to memory of 1448 3028 Explorer.EXE 77 PID 1448 wrote to memory of 1672 1448 msiexec.exe 78 PID 1448 wrote to memory of 1672 1448 msiexec.exe 78 PID 1448 wrote to memory of 1672 1448 msiexec.exe 78
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift TT copy.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift TT copy.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift TT copy.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1228
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Bank Swift TT copy.exe"3⤵PID:1672
-
-