Analysis
- max time kernel
146s - max time network
145s - platform
windows10_x64 - resource
win10 - submitted
23/10/2020, 06:49
Static task
static1
Behavioral task
behavioral1
Sample
10-23.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target 10-23.exe
- Size 462KB
- Sample201023-rtddcjmlj2
- SHA256 f24849d70670b5448e96f02fe8bc12328bee2922be60f70ec8121531778f0d05
- MD5 2ffe461efc70d9834d8552595d86a879
- SHA1 45ad15dedf873ea2bf2a98fdb2dc1560c38be334
- SHA512 39831432a0a16a8c96110a96a42c7462e8a91b237f58314496cbb45769c9e2167632ed3d6a326c7a921f3844e108b60d9f8d30d3e6efa6ae9f7fadf1f33e9743
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.crazyenergyguy.com/dmr/
Decoy
-
sweetjacks.com
-
onecleaningcare.company
-
learninglabels.com
-
onlinedesignstees.com
-
jjoxxdx.icu
-
nice-tights.com
-
golancpa.com
-
caringforeastcounty.com
-
whitesandretreat.com
-
1823a.com
-
lazurii.com
-
madisons-deli.com
-
universitynude.com
-
michiganthyroid.com
-
hersidelinestyle.com
-
kumppaurics.com
-
sebicoin.net
-
hatmemama.com
-
oliyad.com
-
avoirbon.com
-
towabletent.com
-
vietngapcapp.info
-
maadicounty.com
-
kooseal.com
-
deadtreeresurrections.com
-
sondrasfarm.com
-
conteamplate.com
-
soltanoptic.com
-
lyjiafengpet.com
-
customersupportamazon.com
-
seekjob.info
-
mostecak.com
-
synergylfdepot.com
-
catcancrochet.com
-
ericdykema.com
-
fgumexico.com
-
hubeihuamu.com
-
lovelyeseses.com
-
selimtaspinar.xyz
-
dinemosaffa.com
-
gooddeedprocessing.com
-
slidegoat.com
-
tgchanger.com
-
kimmikkola.com
-
zoomanstandig.com
-
mercocaribe.com
-
vanyx.club
-
livanesigorta.com
-
shundongdongfang.com
-
kemalyaz.com
-
montelaustin.com
-
decoykey.com
-
sidewalketiquette.com
-
practicalfitnessidea.com
-
comtey.info
-
bauedich.com
-
jrmegashop.com
-
pippins.coffee
-
kxfrw.com
-
stephanieheartsthomas.com
-
kamiapp.company
-
thetravelpup.info
-
sublimatcba.com
-
queerdems.net
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/2532-10-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2532-11-0x000000000041EB20-mapping.dmp formbook behavioral2/memory/2888-16-0x0000000000000000-mapping.dmp formbook - Executes dropped EXE 1 IoCs
pid Process 2532 AddInProcess32.exe - Loads dropped DLL 2 IoCs
pid Process 3372 10-23.exe 3372 10-23.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3372 set thread context of 2532 3372 10-23.exe 76 PID 2532 set thread context of 3020 2532 AddInProcess32.exe 56 PID 2888 set thread context of 3020 2888 raserver.exe 56 - Program crash 1 IoCs
pid pid_target Process procid_target 3896 3372 WerFault.exe 66 - Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 3372 10-23.exe 3896 WerFault.exe 3896 WerFault.exe 3896 WerFault.exe 3896 WerFault.exe 3896 WerFault.exe 3896 WerFault.exe 3896 WerFault.exe 3896 WerFault.exe 3896 WerFault.exe 3896 WerFault.exe 3896 WerFault.exe 3896 WerFault.exe 3896 WerFault.exe 2532 AddInProcess32.exe 2532 AddInProcess32.exe 2532 AddInProcess32.exe 2532 AddInProcess32.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe 2888 raserver.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2532 AddInProcess32.exe 2532 AddInProcess32.exe 2532 AddInProcess32.exe 2888 raserver.exe 2888 raserver.exe - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeDebugPrivilege 3372 10-23.exe Token: SeTakeOwnershipPrivilege 3372 10-23.exe Token: SeRestorePrivilege 3372 10-23.exe Token: SeRestorePrivilege 3896 WerFault.exe Token: SeBackupPrivilege 3896 WerFault.exe Token: SeDebugPrivilege 3896 WerFault.exe Token: SeDebugPrivilege 2532 AddInProcess32.exe Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeDebugPrivilege 2888 raserver.exe Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3372 wrote to memory of 2532 3372 10-23.exe 76 PID 3372 wrote to memory of 2532 3372 10-23.exe 76 PID 3372 wrote to memory of 2532 3372 10-23.exe 76 PID 3372 wrote to memory of 2532 3372 10-23.exe 76 PID 3372 wrote to memory of 2532 3372 10-23.exe 76 PID 3372 wrote to memory of 2532 3372 10-23.exe 76 PID 3020 wrote to memory of 2888 3020 Explorer.EXE 79 PID 3020 wrote to memory of 2888 3020 Explorer.EXE 79 PID 3020 wrote to memory of 2888 3020 Explorer.EXE 79 PID 2888 wrote to memory of 3500 2888 raserver.exe 80 PID 2888 wrote to memory of 3500 2888 raserver.exe 80 PID 2888 wrote to memory of 3500 2888 raserver.exe 80
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\10-23.exe"C:\Users\Admin\AppData\Local\Temp\10-23.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 15563⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3896
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵PID:3500
-
-