Analysis
- max time kernel
147s - max time network
147s - platform
windows10_x64 - resource
win10 - submitted
27/10/2020, 16:49
Static task
static1
Behavioral task
behavioral1
Sample
Transfer form.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target Transfer form.exe
- Size 479KB
- Sample201027-e73htmwx2e
- SHA256 6308def230fca10ddd70426bb31764afd2564530a7ff775cf28e5e958c5bd37a
- MD5 687c725aba0415ff0e9754acc5734a72
- SHA1 a66dd7c1248750d92529eed7bf9920305ea5a6e2
- SHA512 24a30d99cc5f05462340c257831d84ff17a7e182ad1ac6a8d6c57526a5ab37a6fc26d72dedd8d4ed030110d4dcf70c19a5a5c0019e0031a895d9054da945c529
- MD5 SHA1 SHA512
Malware Config
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/792-5-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/792-6-0x000000000041EB80-mapping.dmp formbook behavioral2/memory/1896-12-0x0000000000000000-mapping.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3916 set thread context of 792 3916 Transfer form.exe 74 PID 792 set thread context of 2984 792 Transfer form.exe 56 PID 1896 set thread context of 2984 1896 svchost.exe 56 - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3916 Transfer form.exe 3916 Transfer form.exe 792 Transfer form.exe 792 Transfer form.exe 792 Transfer form.exe 792 Transfer form.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe 1896 svchost.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 792 Transfer form.exe 792 Transfer form.exe 792 Transfer form.exe 1896 svchost.exe 1896 svchost.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 3916 Transfer form.exe Token: 33 3916 Transfer form.exe Token: SeIncBasePriorityPrivilege 3916 Transfer form.exe Token: SeDebugPrivilege 792 Transfer form.exe Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeDebugPrivilege 1896 svchost.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3916 wrote to memory of 792 3916 Transfer form.exe 74 PID 3916 wrote to memory of 792 3916 Transfer form.exe 74 PID 3916 wrote to memory of 792 3916 Transfer form.exe 74 PID 3916 wrote to memory of 792 3916 Transfer form.exe 74 PID 3916 wrote to memory of 792 3916 Transfer form.exe 74 PID 3916 wrote to memory of 792 3916 Transfer form.exe 74 PID 3916 wrote to memory of 1056 3916 Transfer form.exe 75 PID 3916 wrote to memory of 1056 3916 Transfer form.exe 75 PID 3916 wrote to memory of 1056 3916 Transfer form.exe 75 PID 3916 wrote to memory of 1384 3916 Transfer form.exe 77 PID 3916 wrote to memory of 1384 3916 Transfer form.exe 77 PID 3916 wrote to memory of 1384 3916 Transfer form.exe 77 PID 1384 wrote to memory of 1756 1384 cmd.exe 79 PID 1384 wrote to memory of 1756 1384 cmd.exe 79 PID 1384 wrote to memory of 1756 1384 cmd.exe 79 PID 2984 wrote to memory of 1896 2984 Explorer.EXE 80 PID 2984 wrote to memory of 1896 2984 Explorer.EXE 80 PID 2984 wrote to memory of 1896 2984 Explorer.EXE 80 PID 3916 wrote to memory of 1304 3916 Transfer form.exe 81 PID 3916 wrote to memory of 1304 3916 Transfer form.exe 81 PID 3916 wrote to memory of 1304 3916 Transfer form.exe 81 PID 1896 wrote to memory of 1452 1896 svchost.exe 85 PID 1896 wrote to memory of 1452 1896 svchost.exe 85 PID 1896 wrote to memory of 1452 1896 svchost.exe 85
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\Transfer form.exe"C:\Users\Admin\AppData\Local\Temp\Transfer form.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\Transfer form.exe"C:/Users/Admin/AppData/Local/Temp/Transfer form.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:792
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/Transfer form.exe" "%temp%\FolderN\name.exe" /Y3⤵PID:1056
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f4⤵PID:1756
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier3⤵
- NTFS ADS
PID:1304
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Transfer form.exe"3⤵PID:1452
-
-