Analysis
- max time kernel
147s - max time network
11s - platform
windows7_x64 - resource
win7v20201028 - submitted
05/11/2020, 10:10
Static task
static1
Behavioral task
behavioral1
Sample
mses.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target mses.exe
- Size 455KB
- Sample201105-nhmfca7572
- SHA256 6847d25820be1a4d252df58d3652e103f33af5a43f12febeae71ac66385b0380
- MD5 0eae6cd762d24911991a8f058b48ae1f
- SHA1 7bf2b829ac9de9bd6b6c93c8be43460ef97a98c2
- SHA512 07cae01a69cb0c01ba685f63ed59433cc7445f1af438e0bcfe94f7b07f61da8e84ab04cf6500995b351b976d28bc698d46e90bd0cd8497ccb85a510c7d1e9a60
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.lightmeets.com/c237/
Decoy
-
bulletprooflogisticscompany.com
-
yesonv4mpc.net
-
villasegovia.com
-
aowutai.com
-
alpraa.space
-
transformationnatural.life
-
xiaopoplar.xyz
-
rogvids.site
-
lincolndigital.agency
-
hein.ltd
-
homewelldecor.com
-
essenciaalentejana.com
-
sulehome.com
-
handsometed.com
-
sustainableroadtrips.com
-
jessicascottwriter.com
-
stefanieaoki.com
-
jvrad.com
-
salesperformance360.com
-
jayvanwinkle.com
-
thevendorhub.com
-
terimapesanan.com
-
gamblehotel.com
-
tabbys.space
-
royalsmartinfosys.com
-
almacenpastelero.com
-
trxmef.info
-
neonamart.host
-
reneckrc.com
-
zczzle.space
-
corinalipavsky.com
-
casatensina.com
-
missusmagpie.com
-
survivedbyeaw.com
-
buildermarketingpro.com
-
keithbakos.com
-
keijinya.com
-
quieropublicidad.com
-
lightsworkdefense.com
-
hiperceramica.com
-
ihavetheantibodies.net
-
dorisclothes.com
-
parxvisions.com
-
digitalmedicalgroup.com
-
abxdirt.com
-
thefrankyshaw.com
-
planningpoker.net
-
navwire.net
-
mayopartys.com
-
xn--zeitunghren-yfb.com
-
asochecker.com
-
therentaloffice.info
-
celebrationyear.com
-
truenft.com
-
dieta-lowcarb.com
-
kicklytics.com
-
reech.life
-
createmymobileapp.com
-
judysprivatepersonalcare.com
-
tuljasharma.com
-
psychicradio.network
-
twokan.com
-
kobelojaonline.com
-
call-partner.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral1/memory/1300-4-0x0000000000320000-0x000000000034E000-memory.dmp formbook behavioral1/memory/1240-5-0x0000000000000000-mapping.dmp formbook behavioral1/memory/1196-6-0x0000000000000000-mapping.dmp formbook - Loads dropped DLL 1 IoCs
pid Process 1300 rundll32.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1240 set thread context of 1200 1240 cmd.exe 21 PID 1196 set thread context of 1200 1196 cmstp.exe 21 - Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 1300 rundll32.exe 1240 cmd.exe 1240 cmd.exe 1196 cmstp.exe 1196 cmstp.exe 1196 cmstp.exe 1196 cmstp.exe 1196 cmstp.exe 1196 cmstp.exe 1196 cmstp.exe 1196 cmstp.exe 1196 cmstp.exe 1196 cmstp.exe 1196 cmstp.exe 1196 cmstp.exe 1196 cmstp.exe 1196 cmstp.exe 1196 cmstp.exe 1196 cmstp.exe 1196 cmstp.exe 1196 cmstp.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1300 rundll32.exe 1240 cmd.exe 1240 cmd.exe 1240 cmd.exe 1196 cmstp.exe 1196 cmstp.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1240 cmd.exe Token: SeDebugPrivilege 1196 cmstp.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE - Suspicious use of WriteProcessMemory 59 IoCs
description pid Process procid_target PID 740 wrote to memory of 1300 740 mses.exe 29 PID 740 wrote to memory of 1300 740 mses.exe 29 PID 740 wrote to memory of 1300 740 mses.exe 29 PID 740 wrote to memory of 1300 740 mses.exe 29 PID 740 wrote to memory of 1300 740 mses.exe 29 PID 740 wrote to memory of 1300 740 mses.exe 29 PID 740 wrote to memory of 1300 740 mses.exe 29 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1300 wrote to memory of 1240 1300 rundll32.exe 30 PID 1200 wrote to memory of 1196 1200 Explorer.EXE 31 PID 1200 wrote to memory of 1196 1200 Explorer.EXE 31 PID 1200 wrote to memory of 1196 1200 Explorer.EXE 31 PID 1200 wrote to memory of 1196 1200 Explorer.EXE 31 PID 1200 wrote to memory of 1196 1200 Explorer.EXE 31 PID 1200 wrote to memory of 1196 1200 Explorer.EXE 31 PID 1200 wrote to memory of 1196 1200 Explorer.EXE 31 PID 1196 wrote to memory of 1436 1196 cmstp.exe 32 PID 1196 wrote to memory of 1436 1196 cmstp.exe 32 PID 1196 wrote to memory of 1436 1196 cmstp.exe 32 PID 1196 wrote to memory of 1436 1196 cmstp.exe 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\mses.exe"C:\Users\Admin\AppData\Local\Temp\mses.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe Anorthosite,Bullhead3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1240
-
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"3⤵PID:1436
-
-