Analysis
- max time kernel
148s - max time network
136s - platform
windows10_x64 - resource
win10v20201028 - submitted
04/11/2020, 11:34
Static task
static1
Behavioral task
behavioral1
Sample
noah crypt(1).exe
Resource
win7v20201028
windows7_x64
General
- Target noah crypt(1).exe
- Size 703KB
- Sample201104-cf41tmc94x
- SHA256 88ae2d739cf1bb2cb87e55498b46f53cc6c641ede1cf5619af8d0a128a1a2a39
- MD5 1785158f20ac4437f58b257f34a3a5b3
- SHA1 4552ad8e9225d14042c85c2336e4664003736dc5
- SHA512 a697bea653015b007b5ecd11a06870be1e75a5b141cab708e3e8472dd530c751155d23393c7c355aef678c951fc238802b1d44fc1cd47e49c31762eba4f1a4b0
- MD5 SHA1 SHA512
Malware Config
Extracted
-
formbook
-
http://www.impactheroes.agency/bns/
-
americontractors.com
-
zzpf110.com
-
erictrueman.com
-
rajinination.com
-
dpmystar.com
-
0769dhl.com
-
solopergrazia.com
-
ciocolombia.com
-
the-djay.com
-
tradingforexmastery.com
-
myselfkare.com
-
crossfitgrapheneatl.com
-
hindigkquestion.com
-
zaidaburtoarte.com
-
rashiarora17.website
-
2999online.com
-
cyphergrey.com
-
kaioit.com
-
mazzarothcl.com
-
1000t.online
-
trxmef.info
-
delaparraconsultingroup.com
-
acryliccrates.com
-
atlaslabsis.xyz
-
applywithbroch.com
-
phoenixhypnotic.com
-
mynormaklen.com
-
garage-repair-near-me.com
-
joshuamusick.com
-
sandiegorealestate.report
-
tataxian.com
-
generalelectionstrike.com
-
balloonsouthbend.com
-
t-delivery.com
-
smxlyhq.com
-
cheap-housekeeping.com
-
lavisheventsanddecor.website
-
westorlandocbd.com
-
timeshare-free.com
-
bitcoinsix.com
-
dawnrayspharmacy.com
-
nationwidecleaning.net
-
pgictd.com
-
peanutcustomcreations.com
-
quickpayboards.com
-
luzshoesr.online
-
centigrampay.com
-
seospecialised.com
-
twenty1atoms.com
-
lojanatufit.com
-
buxs.xyz
-
priceelasticityofsupply.com
-
3528385.com
-
51zao.net
-
blackmarlinbroadband.com
-
rare-vn.xyz
-
pk435.com
-
estate-in-russia.club
-
hoopersbbqinc.com
-
bellasebastianhair.com
-
fedosia.net
-
kanbsvtsrkfrtk.com
-
gangstargames.com
-
dhlpost.online
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/200-0-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/200-1-0x000000000041EB80-mapping.dmp formbook behavioral2/memory/2944-2-0x0000000000000000-mapping.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 580 set thread context of 200 580 noah crypt(1).exe 78 PID 200 set thread context of 3040 200 RegSvcs.exe 57 PID 2944 set thread context of 3040 2944 systray.exe 57 - Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 580 noah crypt(1).exe 200 RegSvcs.exe 200 RegSvcs.exe 200 RegSvcs.exe 200 RegSvcs.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe 2944 systray.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 200 RegSvcs.exe 200 RegSvcs.exe 200 RegSvcs.exe 2944 systray.exe 2944 systray.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 580 noah crypt(1).exe Token: SeDebugPrivilege 200 RegSvcs.exe Token: SeDebugPrivilege 2944 systray.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3040 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 580 wrote to memory of 200 580 noah crypt(1).exe 78 PID 580 wrote to memory of 200 580 noah crypt(1).exe 78 PID 580 wrote to memory of 200 580 noah crypt(1).exe 78 PID 580 wrote to memory of 200 580 noah crypt(1).exe 78 PID 580 wrote to memory of 200 580 noah crypt(1).exe 78 PID 580 wrote to memory of 200 580 noah crypt(1).exe 78 PID 3040 wrote to memory of 2944 3040 Explorer.EXE 79 PID 3040 wrote to memory of 2944 3040 Explorer.EXE 79 PID 3040 wrote to memory of 2944 3040 Explorer.EXE 79 PID 2944 wrote to memory of 3504 2944 systray.exe 80 PID 2944 wrote to memory of 3504 2944 systray.exe 80 PID 2944 wrote to memory of 3504 2944 systray.exe 80
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\noah crypt(1).exe"C:\Users\Admin\AppData\Local\Temp\noah crypt(1).exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:200
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵PID:3504
-
-