Analysis
- max time kernel
146s - max time network
145s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:52
Static task
static1
Behavioral task
behavioral1
Sample
80e034f9519c0b327c5d55c5ba34511e.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 80e034f9519c0b327c5d55c5ba34511e.exe
- Size 1.6MB
- Sample201109-422cxf6jsj
- SHA256 f91b7471cdeb5b3ff9ac0fbbef508f16a405631a3d3ec8014d0ad87d5e6fbcd5
- MD5 80e034f9519c0b327c5d55c5ba34511e
- SHA1 7901095067aab8e0c400f34343ddf52371671a9a
- SHA512 9156ce853af264615d5613542a99252cb7fdbabcc8463bffaf0aa06a2274669a02e245220805e95db577b65e24dfb2382db165a6eaf74b51a2018d8c86fd62ad
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.glamotd.com/gm1/
Decoy
-
802477.com
-
theclippersofficial.com
-
mysticadventuresails.com
-
joshkaeding.com
-
www4915a.com
-
nicolasdumasxiii.com
-
transbagasputra.com
-
motherdaughter.date
-
truflorawellness.com
-
ff1q.com
-
elettronicasmart.com
-
obtes.com
-
pfamkyr.com
-
9ycpbr.info
-
gtitdunproductions.com
-
mashreviews.com
-
methvenonthemove.com
-
jinshavip38.com
-
theedgebizconnect.com
-
jessandalextietheknot.com
-
vallleylnd.net
-
w.mom
-
formacionparaelexito.com
-
robinruhmel.com
-
annualtransmission.technology
-
nazitube.com
-
executiveliontamer.com
-
411hotwire.com
-
sendoba.com
-
xnyppw.com
-
un4mo.com
-
pepper.guide
-
novaeramotoboysportoalegre.com
-
limper.net
-
cloudyans.com
-
atomicyou.com
-
jentang.com
-
hylg6.com
-
laperamordidablog.com
-
mannionexpertseniorcare.com
-
009cb.com
-
azasianow.com
-
intera-canada.com
-
bladexpo.com
-
affinityhomeinspectionpro.com
-
purrfectlynoble.com
-
3lmktgsvc.com
-
babooneh.net
-
sholarshyp.com
-
startboostcapital.com
-
pamhomedaycare.com
-
homecoralgables.com
-
q83pfq.biz
-
100fwq.com
-
incmint.com
-
k-pagador.com
-
stoxcrypto.com
-
sketchgecko.com
-
myweddingbeautiful.com
-
playgroundcareer.com
-
suite5digital.com
-
fristcreditunion.com
-
astonfly.info
-
www750456.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/1476-0-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/1476-1-0x000000000041B680-mapping.dmp formbook behavioral2/memory/2256-3-0x0000000000000000-mapping.dmp formbook - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run cmstp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DBLTG6_H1L = "C:\\Program Files (x86)\\V8po\\rbxl-zxxv4cp.exe" cmstp.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3284 set thread context of 1476 3284 80e034f9519c0b327c5d55c5ba34511e.exe 75 PID 1476 set thread context of 2312 1476 dllhost.exe 57 PID 2256 set thread context of 2312 2256 cmstp.exe 57 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\V8po\rbxl-zxxv4cp.exe cmstp.exe -
description ioc Process Key created \Registry\User\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmstp.exe - Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 1476 dllhost.exe 1476 dllhost.exe 1476 dllhost.exe 1476 dllhost.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe 2256 cmstp.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1476 dllhost.exe 1476 dllhost.exe 1476 dllhost.exe 2256 cmstp.exe 2256 cmstp.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1476 dllhost.exe Token: SeDebugPrivilege 2256 cmstp.exe Token: SeShutdownPrivilege 2312 Explorer.EXE Token: SeCreatePagefilePrivilege 2312 Explorer.EXE Token: SeShutdownPrivilege 2312 Explorer.EXE Token: SeCreatePagefilePrivilege 2312 Explorer.EXE - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3284 80e034f9519c0b327c5d55c5ba34511e.exe 3284 80e034f9519c0b327c5d55c5ba34511e.exe 3284 80e034f9519c0b327c5d55c5ba34511e.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3284 80e034f9519c0b327c5d55c5ba34511e.exe 3284 80e034f9519c0b327c5d55c5ba34511e.exe 3284 80e034f9519c0b327c5d55c5ba34511e.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3284 wrote to memory of 1476 3284 80e034f9519c0b327c5d55c5ba34511e.exe 75 PID 3284 wrote to memory of 1476 3284 80e034f9519c0b327c5d55c5ba34511e.exe 75 PID 3284 wrote to memory of 1476 3284 80e034f9519c0b327c5d55c5ba34511e.exe 75 PID 3284 wrote to memory of 1476 3284 80e034f9519c0b327c5d55c5ba34511e.exe 75 PID 3284 wrote to memory of 1476 3284 80e034f9519c0b327c5d55c5ba34511e.exe 75 PID 2312 wrote to memory of 2256 2312 Explorer.EXE 76 PID 2312 wrote to memory of 2256 2312 Explorer.EXE 76 PID 2312 wrote to memory of 2256 2312 Explorer.EXE 76 PID 2256 wrote to memory of 3728 2256 cmstp.exe 80 PID 2256 wrote to memory of 3728 2256 cmstp.exe 80 PID 2256 wrote to memory of 3728 2256 cmstp.exe 80
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\80e034f9519c0b327c5d55c5ba34511e.exe"C:\Users\Admin\AppData\Local\Temp\80e034f9519c0b327c5d55c5ba34511e.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\SysWOW64\dllhost.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1476
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\dllhost.exe"3⤵PID:3728
-
-