Analysis
- max time kernel
145s - max time network
148s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:59
Static task
static1
Behavioral task
behavioral1
Sample
PO_#2576.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target PO_#2576.exe
- Size 393KB
- Sample201109-41xt39fj5e
- SHA256 65a02f6b451bb5ccf5d443b7976da84cb80812e24a909d1038423bfe5ac5e2b8
- MD5 03afc2c56794a27dd1d293ee657925c8
- SHA1 e62ceaf311536d1f66c9fea2d269e678c44c46ae
- SHA512 0042d776c26d92bad30ec8ddc0cbd14a497ffdb8fa09b4cf3940419f7642ac4b5d079c680fba41dec10c4b722fb48872ddd26ecd034ce53a64bda3948332e795
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.govaj.com/bd2/
Decoy
-
coffeeflyer.com
-
joy-cars.com
-
excp0st.com
-
pancakesandprotein.com
-
teenboys.info
-
theperfectgiftshop.net
-
maomao2017.com
-
musiclabtacoma.com
-
taskrit.com
-
pthjxx.com
-
114man.com
-
worldsjsj.com
-
rjpmuztrygwn.online
-
casinotoponlineplay.technology
-
tm88z.com
-
navnoorkang.com
-
lazydogkennels.net
-
yisilv.com
-
usasubels.com
-
desperatehouse-lives.com
-
brianbertini.info
-
sag4bd.com
-
zahnarzt-rosenheim.info
-
newspies.com
-
thefinalexpensegroup.com
-
wwwjinsha784.com
-
128hao.com
-
abesdjc.com
-
majportfolio.com
-
travelfoodmustafa.com
-
indo-mart.com
-
funlick.net
-
howstevedidthat.com
-
katspropertymanagement.com
-
hzsonata.com
-
believers.expert
-
littleapple-vo.com
-
jmdyljuf.win
-
exerzonegymgt.com
-
huichengsl.com
-
keithdeanjr.com
-
ybntest699.com
-
allmandbros.com
-
maftfw.com
-
online-attestation.com
-
fmbzzpx.download
-
staramway.com
-
mugzshideout.net
-
12usy.com
-
immuno-naturo.com
-
tractoferguson.com
-
rjconstrucoesse.com
-
johnscharrett.business
-
1517toparis.movie
-
redpingwinful.net
-
o31y7g.download
-
greenwebapps.com
-
6pinbahis.com
-
shouyou168.com
-
globalvalueshopping.com
-
lfhyblm.com
-
maisbrasilpublicidade.com
-
alixzwane.com
-
pubwild.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/5112-0-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/5112-1-0x000000000041B660-mapping.dmp formbook behavioral2/memory/2172-2-0x0000000000000000-mapping.dmp formbook - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ODBPCT20OBL = "C:\\Program Files (x86)\\X9rhldxhh\\ijogv-.exe" msiexec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4632 set thread context of 5112 4632 PO_#2576.exe 74 PID 5112 set thread context of 2956 5112 PO_#2576.exe 57 PID 5112 set thread context of 2956 5112 PO_#2576.exe 57 PID 2172 set thread context of 2956 2172 msiexec.exe 57 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\X9rhldxhh\ijogv-.exe msiexec.exe -
description ioc Process Key created \Registry\User\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msiexec.exe - Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 5112 PO_#2576.exe 5112 PO_#2576.exe 5112 PO_#2576.exe 5112 PO_#2576.exe 5112 PO_#2576.exe 5112 PO_#2576.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe 2172 msiexec.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 5112 PO_#2576.exe 5112 PO_#2576.exe 5112 PO_#2576.exe 5112 PO_#2576.exe 2172 msiexec.exe 2172 msiexec.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 5112 PO_#2576.exe Token: SeDebugPrivilege 2172 msiexec.exe Token: SeShutdownPrivilege 2956 Explorer.EXE Token: SeCreatePagefilePrivilege 2956 Explorer.EXE Token: SeShutdownPrivilege 2956 Explorer.EXE Token: SeCreatePagefilePrivilege 2956 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4632 wrote to memory of 5112 4632 PO_#2576.exe 74 PID 4632 wrote to memory of 5112 4632 PO_#2576.exe 74 PID 4632 wrote to memory of 5112 4632 PO_#2576.exe 74 PID 4632 wrote to memory of 5112 4632 PO_#2576.exe 74 PID 4632 wrote to memory of 5112 4632 PO_#2576.exe 74 PID 4632 wrote to memory of 5112 4632 PO_#2576.exe 74 PID 2956 wrote to memory of 2172 2956 Explorer.EXE 79 PID 2956 wrote to memory of 2172 2956 Explorer.EXE 79 PID 2956 wrote to memory of 2172 2956 Explorer.EXE 79 PID 2172 wrote to memory of 3824 2172 msiexec.exe 80 PID 2172 wrote to memory of 3824 2172 msiexec.exe 80 PID 2172 wrote to memory of 3824 2172 msiexec.exe 80
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\PO_#2576.exe"C:\Users\Admin\AppData\Local\Temp\PO_#2576.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\PO_#2576.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:5112
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO_#2576.exe"3⤵PID:3824
-
-