Analysis
- max time kernel
149s - max time network
151s - platform
windows10_x64 - resource
win10v20201028 - submitted
06/11/2020, 17:26
Static task
static1
Behavioral task
behavioral1
Sample
Additional Agreement 2020-KYC.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target Additional Agreement 2020-KYC.exe
- Size 558KB
- Sample201106-trs8wmxdln
- SHA256 dc647305de0ae67eff2e86276355bc83aa761b03693459df14d10ae6cd4a3102
- MD5 37c2650f0af20d95c57be00227ad342f
- SHA1 c38e315f0bd4106e19811f0224306d957258a981
- SHA512 e5f7f917e792d8efbf1f6f83fae46cf6ac7aa3c870b44bf209d41426d2b8f3f36192f56a1ec4fe9a4f028c8e5b3aae9dd0da90127f8432ccd09b4419bc5a64c1
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.csgo-c4ses.com/bw82/
Decoy
-
orchid-iris.com
-
owner.codes
-
crispcleanbodyrituals.com
-
nocreditcarswestpalm.com
-
sweetsasu.com
-
downlooader.com
-
candleish.com
-
43414newportdr.com
-
78kanshu.net
-
tncnn.com
-
bcheaptvwd.com
-
trephone.art
-
aloharecords.com
-
latinaexpres.com
-
comminterbusiness.com
-
evokingcalm.com
-
mckarthylabscoe.com
-
make-trends.com
-
modernhomeskitchen.com
-
mousybusiness.com
-
dentonparalegals.com
-
dreammakeloja.com
-
caffeinatedmamasblog.com
-
stockandbarrell.com
-
tesla-commercio.com
-
friendsofhersheypa.com
-
sajjaddeveloper.com
-
roechling-roding.run
-
ruffstuffstore.com
-
monnetier-mornex.com
-
aplustd.com
-
hjscinc.com
-
riquimbilis.com
-
free-outlet.com
-
mail-businessprinting.com
-
xzaztlrl.icu
-
artofsapna.com
-
mercyvh.com
-
beauskitchen.com
-
amq-studio.com
-
whentime12.com
-
helptechservices.com
-
erraticer.com
-
nationalreturnday.com
-
justincook.xyz
-
shopjrock.com
-
breakfastcandy.net
-
penislandbrews.com
-
fjweiwang.com
-
mosterth.com
-
xn--gdask-y7a.com
-
packorganically.com
-
greaterdiabetes.info
-
neotactic.net
-
tiedcaps.rest
-
prandartsagency.com
-
tdmmk.site
-
octoberx2.online
-
idealgaysex.com
-
devitasaude.com
-
tatsunoichie.com
-
amazonprim8.art
-
mcwildwest.net
-
sewythingy.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/1000-8-0x0000000000400000-0x0000000000428000-memory.dmp formbook behavioral2/memory/1000-9-0x000000000041C9D0-mapping.dmp formbook behavioral2/memory/2728-11-0x0000000000000000-mapping.dmp formbook - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1140 set thread context of 1000 1140 Additional Agreement 2020-KYC.exe 78 PID 1000 set thread context of 3044 1000 Additional Agreement 2020-KYC.exe 57 PID 1000 set thread context of 3044 1000 Additional Agreement 2020-KYC.exe 57 PID 2728 set thread context of 3044 2728 msiexec.exe 57 - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 1000 Additional Agreement 2020-KYC.exe 1000 Additional Agreement 2020-KYC.exe 1000 Additional Agreement 2020-KYC.exe 1000 Additional Agreement 2020-KYC.exe 1000 Additional Agreement 2020-KYC.exe 1000 Additional Agreement 2020-KYC.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe 2728 msiexec.exe - Suspicious behavior: MapViewOfSection 9 IoCs
pid Process 1140 Additional Agreement 2020-KYC.exe 1140 Additional Agreement 2020-KYC.exe 1140 Additional Agreement 2020-KYC.exe 1000 Additional Agreement 2020-KYC.exe 1000 Additional Agreement 2020-KYC.exe 1000 Additional Agreement 2020-KYC.exe 1000 Additional Agreement 2020-KYC.exe 2728 msiexec.exe 2728 msiexec.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1140 Additional Agreement 2020-KYC.exe Token: SeDebugPrivilege 1000 Additional Agreement 2020-KYC.exe Token: SeDebugPrivilege 2728 msiexec.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3044 Explorer.EXE - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1140 wrote to memory of 696 1140 Additional Agreement 2020-KYC.exe 76 PID 1140 wrote to memory of 696 1140 Additional Agreement 2020-KYC.exe 76 PID 1140 wrote to memory of 696 1140 Additional Agreement 2020-KYC.exe 76 PID 1140 wrote to memory of 2840 1140 Additional Agreement 2020-KYC.exe 77 PID 1140 wrote to memory of 2840 1140 Additional Agreement 2020-KYC.exe 77 PID 1140 wrote to memory of 2840 1140 Additional Agreement 2020-KYC.exe 77 PID 1140 wrote to memory of 1000 1140 Additional Agreement 2020-KYC.exe 78 PID 1140 wrote to memory of 1000 1140 Additional Agreement 2020-KYC.exe 78 PID 1140 wrote to memory of 1000 1140 Additional Agreement 2020-KYC.exe 78 PID 1140 wrote to memory of 1000 1140 Additional Agreement 2020-KYC.exe 78 PID 3044 wrote to memory of 2728 3044 Explorer.EXE 82 PID 3044 wrote to memory of 2728 3044 Explorer.EXE 82 PID 3044 wrote to memory of 2728 3044 Explorer.EXE 82 PID 2728 wrote to memory of 768 2728 msiexec.exe 83 PID 2728 wrote to memory of 768 2728 msiexec.exe 83 PID 2728 wrote to memory of 768 2728 msiexec.exe 83
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\Additional Agreement 2020-KYC.exe"C:\Users\Admin\AppData\Local\Temp\Additional Agreement 2020-KYC.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\Additional Agreement 2020-KYC.exe"Additional Agreement 2020-KYC.exe"3⤵PID:696
-
-
C:\Users\Admin\AppData\Local\Temp\Additional Agreement 2020-KYC.exe"Additional Agreement 2020-KYC.exe"3⤵PID:2840
-
-
C:\Users\Admin\AppData\Local\Temp\Additional Agreement 2020-KYC.exe"Additional Agreement 2020-KYC.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1000
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Additional Agreement 2020-KYC.exe"3⤵PID:768
-
-