Analysis
- max time kernel
148s - max time network
147s - platform
windows10_x64 - resource
win10 - submitted
27/10/2020, 08:48
Static task
static1
Behavioral task
behavioral1
Sample
469nGuFQyVJyw0O.exe
Resource
win7
windows7_x64
General
- Target 469nGuFQyVJyw0O.exe
- Size 531KB
- Sample201027-2dgpnwar92
- SHA256 8e816e44eb6ebdc6b99876142caba3fc1f8a0633edec29e8c1ae3f57e1ca55c9
- MD5 5d835e5f1204b33ad2b2cda5313676aa
- SHA1 6f7520b92cfab9a5be6846c62c512bcf88fc2c77
- SHA512 89bbca999fb98b915799e8c8b8cb11b9f1e74b44fabd7a0408ba8f7aa2f20c0d377daf5f0325ce6c051a21e318a242045b3e91ed91439703776b98e8610d0c5f
- MD5 SHA1 SHA512
Malware Config
Extracted
-
formbook
-
http://www.bfboke.com/cpi/
-
tw2dl.com
-
cdmingjun.com
-
tamquin.net
-
shipu252.com
-
teamxnd02.com
-
finansi.website
-
datainnbooking.com
-
shannonballcoach.com
-
giaoruou.club
-
tierraycielo.com
-
quizfall.info
-
hallwayworker.guru
-
smartfundoptions.com
-
iishon11.com
-
zzg-wj7k9.net
-
mylinkbio.com
-
xn--kzw5tq0of14b.com
-
coursereel.club
-
koalainsulationinc.com
-
5ljhyr.com
-
mjhex.com
-
tacpa1.com
-
meadowcap.com
-
evalassproductions.com
-
ilybuy.com
-
recetasdecocinax.com
-
taxtechintelligence.com
-
maristafford.com
-
vireiautonomo.com
-
lahorees.com
-
instahawkers.com
-
renewedwomen.net
-
raudlatulmuhibbin.com
-
hotrodport.net
-
virtualensembleproject.com
-
discoverhp.com
-
portalinformasi.com
-
luzyverdadmiami.com
-
kelasonlineindie.site
-
ohmacey.com
-
titancoreholdings.com
-
rudrasilver.com
-
canandavisagovt.com
-
petwaterdispenserstore.com
-
thaluang1607.com
-
mofongovegano.com
-
hansemall.com
-
amesticaenterprises.com
-
bilzy.info
-
lakedip.com
-
perfectohydrodrills.com
-
thegenvalue.com
-
viviandsenaworld.com
-
blackdfw.com
-
801roof.net
-
khungtranh.net
-
gloryofeden.com
-
jennishewardart.com
-
stilesbuildco.com
-
freedomuph.com
-
quafecompany.com
-
ladyofluggage.com
-
casabellatranslations.com
-
nezzet.net
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/4252-2-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/4252-3-0x000000000041EAB0-mapping.dmp formbook behavioral2/memory/728-5-0x0000000000000000-mapping.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4660 set thread context of 4252 4660 469nGuFQyVJyw0O.exe 79 PID 4252 set thread context of 3032 4252 469nGuFQyVJyw0O.exe 56 PID 728 set thread context of 3032 728 wscript.exe 56 - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3616 schtasks.exe - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 4252 469nGuFQyVJyw0O.exe 4252 469nGuFQyVJyw0O.exe 4252 469nGuFQyVJyw0O.exe 4252 469nGuFQyVJyw0O.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe 728 wscript.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 4252 469nGuFQyVJyw0O.exe 4252 469nGuFQyVJyw0O.exe 4252 469nGuFQyVJyw0O.exe 728 wscript.exe 728 wscript.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4252 469nGuFQyVJyw0O.exe Token: SeDebugPrivilege 728 wscript.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4660 wrote to memory of 3616 4660 469nGuFQyVJyw0O.exe 77 PID 4660 wrote to memory of 3616 4660 469nGuFQyVJyw0O.exe 77 PID 4660 wrote to memory of 3616 4660 469nGuFQyVJyw0O.exe 77 PID 4660 wrote to memory of 4252 4660 469nGuFQyVJyw0O.exe 79 PID 4660 wrote to memory of 4252 4660 469nGuFQyVJyw0O.exe 79 PID 4660 wrote to memory of 4252 4660 469nGuFQyVJyw0O.exe 79 PID 4660 wrote to memory of 4252 4660 469nGuFQyVJyw0O.exe 79 PID 4660 wrote to memory of 4252 4660 469nGuFQyVJyw0O.exe 79 PID 4660 wrote to memory of 4252 4660 469nGuFQyVJyw0O.exe 79 PID 3032 wrote to memory of 728 3032 Explorer.EXE 80 PID 3032 wrote to memory of 728 3032 Explorer.EXE 80 PID 3032 wrote to memory of 728 3032 Explorer.EXE 80 PID 728 wrote to memory of 4136 728 wscript.exe 81 PID 728 wrote to memory of 4136 728 wscript.exe 81 PID 728 wrote to memory of 4136 728 wscript.exe 81
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\469nGuFQyVJyw0O.exe"C:\Users\Admin\AppData\Local\Temp\469nGuFQyVJyw0O.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LjFHlwWSzPC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCC5E.tmp"3⤵
- Creates scheduled task(s)
PID:3616
-
-
C:\Users\Admin\AppData\Local\Temp\469nGuFQyVJyw0O.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4252
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\469nGuFQyVJyw0O.exe"3⤵PID:4136
-
-