Analysis
- max time kernel
149s - max time network
15s - platform
windows7_x64 - resource
win7v200722 - submitted
23/10/2020, 06:49
Static task
static1
Behavioral task
behavioral1
Sample
10-23.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target 10-23.exe
- Size 462KB
- Sample201023-rtddcjmlj2
- SHA256 f24849d70670b5448e96f02fe8bc12328bee2922be60f70ec8121531778f0d05
- MD5 2ffe461efc70d9834d8552595d86a879
- SHA1 45ad15dedf873ea2bf2a98fdb2dc1560c38be334
- SHA512 39831432a0a16a8c96110a96a42c7462e8a91b237f58314496cbb45769c9e2167632ed3d6a326c7a921f3844e108b60d9f8d30d3e6efa6ae9f7fadf1f33e9743
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.crazyenergyguy.com/dmr/
Decoy
-
sweetjacks.com
-
onecleaningcare.company
-
learninglabels.com
-
onlinedesignstees.com
-
jjoxxdx.icu
-
nice-tights.com
-
golancpa.com
-
caringforeastcounty.com
-
whitesandretreat.com
-
1823a.com
-
lazurii.com
-
madisons-deli.com
-
universitynude.com
-
michiganthyroid.com
-
hersidelinestyle.com
-
kumppaurics.com
-
sebicoin.net
-
hatmemama.com
-
oliyad.com
-
avoirbon.com
-
towabletent.com
-
vietngapcapp.info
-
maadicounty.com
-
kooseal.com
-
deadtreeresurrections.com
-
sondrasfarm.com
-
conteamplate.com
-
soltanoptic.com
-
lyjiafengpet.com
-
customersupportamazon.com
-
seekjob.info
-
mostecak.com
-
synergylfdepot.com
-
catcancrochet.com
-
ericdykema.com
-
fgumexico.com
-
hubeihuamu.com
-
lovelyeseses.com
-
selimtaspinar.xyz
-
dinemosaffa.com
-
gooddeedprocessing.com
-
slidegoat.com
-
tgchanger.com
-
kimmikkola.com
-
zoomanstandig.com
-
mercocaribe.com
-
vanyx.club
-
livanesigorta.com
-
shundongdongfang.com
-
kemalyaz.com
-
montelaustin.com
-
decoykey.com
-
sidewalketiquette.com
-
practicalfitnessidea.com
-
comtey.info
-
bauedich.com
-
jrmegashop.com
-
pippins.coffee
-
kxfrw.com
-
stephanieheartsthomas.com
-
kamiapp.company
-
thetravelpup.info
-
sublimatcba.com
-
queerdems.net
Signatures
- Formbook Payload 2 IoCs
resource yara_rule behavioral1/memory/1560-9-0x000000000041EB20-mapping.dmp formbook behavioral1/memory/2008-15-0x0000000000000000-mapping.dmp formbook - Executes dropped EXE 1 IoCs
pid Process 1560 AddInProcess32.exe - Loads dropped DLL 3 IoCs
pid Process 1000 10-23.exe 1000 10-23.exe 1000 10-23.exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1000 set thread context of 1560 1000 10-23.exe 28 PID 1560 set thread context of 1212 1560 AddInProcess32.exe 20 PID 1560 set thread context of 1212 1560 AddInProcess32.exe 20 PID 2008 set thread context of 1212 2008 raserver.exe 20 - Program crash 1 IoCs
pid pid_target Process procid_target 1596 1000 WerFault.exe 23 - Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 1000 10-23.exe 1560 AddInProcess32.exe 1560 AddInProcess32.exe 1596 WerFault.exe 1596 WerFault.exe 1596 WerFault.exe 1596 WerFault.exe 1560 AddInProcess32.exe 2008 raserver.exe 2008 raserver.exe 2008 raserver.exe 2008 raserver.exe 2008 raserver.exe 2008 raserver.exe 2008 raserver.exe 2008 raserver.exe 2008 raserver.exe 2008 raserver.exe 2008 raserver.exe 2008 raserver.exe 2008 raserver.exe 2008 raserver.exe 2008 raserver.exe 2008 raserver.exe 2008 raserver.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1560 AddInProcess32.exe 1560 AddInProcess32.exe 1560 AddInProcess32.exe 1560 AddInProcess32.exe 2008 raserver.exe 2008 raserver.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 1000 10-23.exe Token: SeTakeOwnershipPrivilege 1000 10-23.exe Token: SeRestorePrivilege 1000 10-23.exe Token: SeDebugPrivilege 1560 AddInProcess32.exe Token: SeDebugPrivilege 1596 WerFault.exe Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeDebugPrivilege 2008 raserver.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1000 wrote to memory of 1560 1000 10-23.exe 28 PID 1000 wrote to memory of 1560 1000 10-23.exe 28 PID 1000 wrote to memory of 1560 1000 10-23.exe 28 PID 1000 wrote to memory of 1560 1000 10-23.exe 28 PID 1000 wrote to memory of 1560 1000 10-23.exe 28 PID 1000 wrote to memory of 1560 1000 10-23.exe 28 PID 1000 wrote to memory of 1560 1000 10-23.exe 28 PID 1000 wrote to memory of 1596 1000 10-23.exe 29 PID 1000 wrote to memory of 1596 1000 10-23.exe 29 PID 1000 wrote to memory of 1596 1000 10-23.exe 29 PID 1000 wrote to memory of 1596 1000 10-23.exe 29 PID 1560 wrote to memory of 2008 1560 AddInProcess32.exe 30 PID 1560 wrote to memory of 2008 1560 AddInProcess32.exe 30 PID 1560 wrote to memory of 2008 1560 AddInProcess32.exe 30 PID 1560 wrote to memory of 2008 1560 AddInProcess32.exe 30 PID 2008 wrote to memory of 2032 2008 raserver.exe 31 PID 2008 wrote to memory of 2032 2008 raserver.exe 31 PID 2008 wrote to memory of 2032 2008 raserver.exe 31 PID 2008 wrote to memory of 2032 2008 raserver.exe 31
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\10-23.exe"C:\Users\Admin\AppData\Local\Temp\10-23.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"5⤵PID:2032
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 9803⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596
-
-