Analysis
- max time kernel
150s - max time network
114s - platform
windows10_x64 - resource
win10v20201028 - submitted
05/11/2020, 10:10
Static task
static1
Behavioral task
behavioral1
Sample
mses.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target mses.exe
- Size 455KB
- Sample201105-nhmfca7572
- SHA256 6847d25820be1a4d252df58d3652e103f33af5a43f12febeae71ac66385b0380
- MD5 0eae6cd762d24911991a8f058b48ae1f
- SHA1 7bf2b829ac9de9bd6b6c93c8be43460ef97a98c2
- SHA512 07cae01a69cb0c01ba685f63ed59433cc7445f1af438e0bcfe94f7b07f61da8e84ab04cf6500995b351b976d28bc698d46e90bd0cd8497ccb85a510c7d1e9a60
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.lightmeets.com/c237/
Decoy
-
bulletprooflogisticscompany.com
-
yesonv4mpc.net
-
villasegovia.com
-
aowutai.com
-
alpraa.space
-
transformationnatural.life
-
xiaopoplar.xyz
-
rogvids.site
-
lincolndigital.agency
-
hein.ltd
-
homewelldecor.com
-
essenciaalentejana.com
-
sulehome.com
-
handsometed.com
-
sustainableroadtrips.com
-
jessicascottwriter.com
-
stefanieaoki.com
-
jvrad.com
-
salesperformance360.com
-
jayvanwinkle.com
-
thevendorhub.com
-
terimapesanan.com
-
gamblehotel.com
-
tabbys.space
-
royalsmartinfosys.com
-
almacenpastelero.com
-
trxmef.info
-
neonamart.host
-
reneckrc.com
-
zczzle.space
-
corinalipavsky.com
-
casatensina.com
-
missusmagpie.com
-
survivedbyeaw.com
-
buildermarketingpro.com
-
keithbakos.com
-
keijinya.com
-
quieropublicidad.com
-
lightsworkdefense.com
-
hiperceramica.com
-
ihavetheantibodies.net
-
dorisclothes.com
-
parxvisions.com
-
digitalmedicalgroup.com
-
abxdirt.com
-
thefrankyshaw.com
-
planningpoker.net
-
navwire.net
-
mayopartys.com
-
xn--zeitunghren-yfb.com
-
asochecker.com
-
therentaloffice.info
-
celebrationyear.com
-
truenft.com
-
dieta-lowcarb.com
-
kicklytics.com
-
reech.life
-
createmymobileapp.com
-
judysprivatepersonalcare.com
-
tuljasharma.com
-
psychicradio.network
-
twokan.com
-
kobelojaonline.com
-
call-partner.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/3144-4-0x0000000004EB0000-0x0000000004EDE000-memory.dmp formbook behavioral2/memory/4168-5-0x0000000000000000-mapping.dmp formbook behavioral2/memory/2916-6-0x0000000000000000-mapping.dmp formbook - Loads dropped DLL 1 IoCs
pid Process 3144 rundll32.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4168 set thread context of 2300 4168 cmd.exe 57 PID 2916 set thread context of 2300 2916 svchost.exe 57 - Suspicious behavior: EnumeratesProcesses 41 IoCs
pid Process 3144 rundll32.exe 4168 cmd.exe 4168 cmd.exe 4168 cmd.exe 4168 cmd.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe 2916 svchost.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 3144 rundll32.exe 4168 cmd.exe 4168 cmd.exe 4168 cmd.exe 2916 svchost.exe 2916 svchost.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4168 cmd.exe Token: SeDebugPrivilege 2916 svchost.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2300 Explorer.EXE - Suspicious use of WriteProcessMemory 89 IoCs
description pid Process procid_target PID 4696 wrote to memory of 3144 4696 mses.exe 78 PID 4696 wrote to memory of 3144 4696 mses.exe 78 PID 4696 wrote to memory of 3144 4696 mses.exe 78 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 3144 wrote to memory of 4168 3144 rundll32.exe 79 PID 2300 wrote to memory of 2916 2300 Explorer.EXE 80 PID 2300 wrote to memory of 2916 2300 Explorer.EXE 80 PID 2300 wrote to memory of 2916 2300 Explorer.EXE 80 PID 2916 wrote to memory of 3092 2916 svchost.exe 81 PID 2916 wrote to memory of 3092 2916 svchost.exe 81 PID 2916 wrote to memory of 3092 2916 svchost.exe 81
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\mses.exe"C:\Users\Admin\AppData\Local\Temp\mses.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe Anorthosite,Bullhead3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4168
-
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2916 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"3⤵PID:3092
-
-