Analysis
- max time kernel
145s - max time network
142s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:32
Static task
static1
Behavioral task
behavioral1
Sample
RFQ-0605.exe
Resource
win7v20201028
windows7_x64
General
- Target RFQ-0605.exe
- Size 1.3MB
- Sample201109-7v2bv57pn2
- SHA256 b76aeb95000673c2d56341cdf6b6331f868f6e1e0ab5da4e6ca0b2b399361658
- MD5 d0edc54af178f91fae03e4f8c22742a4
- SHA1 6d55d0029f916d1453dcfb7cbfa00ce1385483a2
- SHA512 96c4fde79cfe530c795365cdd4e66354564f188a10171622b78b6737fcfa5009eaff33a5c95b76254ff5f43fc65384048fb4eef33aa68fcbc9fb567f033ba84c
- MD5 SHA1 SHA512
Malware Config
Extracted
-
formbook
-
http://www.mansiobok2.info/bag0/
-
kririt.com
-
kingsfordbbqmeats.com
-
xn--xys033l.top
-
vitawaffles.com
-
ascentclinic.com
-
rexel.solar
-
wolverinex4sxs.net
-
cubdokitap.com
-
alquilaenroquetas.com
-
rbzuln.com
-
paketwisatabanyuwangimurah.com
-
strippedbackbirth.com
-
blackberryx.biz
-
kccwelltztower.com
-
ls-tong.com
-
www9922145.com
-
ihwmss.info
-
cklzeu.men
-
teenpow.com
-
startmyfamilytoday.com
-
wwwm-hg0088.com
-
xn--7or10a28bm2i532bhf2bsxh.com
-
halalstocks.net
-
basbg.com
-
kidscreationmuseum.com
-
ndpension.net
-
cadilacreview.com
-
sweetsatisfying.site
-
swallowsandamazonstours.net
-
geimongxiang.com
-
gicrypto.com
-
rstjg.info
-
studddsterchaimscas.win
-
1c1oneonly.men
-
itluxurysedansrun.live
-
hoctiengtrungtaivinh.com
-
venezuelancrisis.com
-
uslugi-tartaczne.com
-
dsgafrica.com
-
notify.moda
-
outlando.com
-
anticandidadiet.com
-
jszn28.com
-
qgsplovro.online
-
juliameets.world
-
f2tcrf.info
-
hitchedinhobart.com
-
airconditioningartesia.com
-
kuniqueset.com
-
dancer.network
-
ehtelkanarbik.com
-
courageousace.com
-
kexuebianjie.com
-
tranquilamenities.info
-
verwayurunlerimiz.com
-
adlibtech.info
-
thevierapp.com
-
seoerinfo.win
-
georgetownpersonaltrainer.com
-
hhgan93.com
-
exclusivespadeals.com
-
bikesnbooze.com
-
shoplocalcrew.com
-
osbrim-elthidx.info
Signatures
- Formbook Payload 1 IoCs
resource yara_rule behavioral2/memory/1792-1-0x0000000000000000-mapping.dmp formbook - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\S8LPYHTP5T = "C:\\Program Files (x86)\\U9rd0abmx\\brzelm.exe" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cmd.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 728 set thread context of 3016 728 RFQ-0605.exe 57 PID 1792 set thread context of 3016 1792 cmd.exe 57 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\U9rd0abmx\brzelm.exe cmd.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmd.exe - Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 728 RFQ-0605.exe 728 RFQ-0605.exe 728 RFQ-0605.exe 728 RFQ-0605.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 728 RFQ-0605.exe 728 RFQ-0605.exe 728 RFQ-0605.exe 1792 cmd.exe 1792 cmd.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 728 RFQ-0605.exe Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeDebugPrivilege 1792 cmd.exe Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3016 Explorer.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3016 wrote to memory of 1792 3016 Explorer.EXE 77 PID 3016 wrote to memory of 1792 3016 Explorer.EXE 77 PID 3016 wrote to memory of 1792 3016 Explorer.EXE 77 PID 1792 wrote to memory of 3492 1792 cmd.exe 79 PID 1792 wrote to memory of 3492 1792 cmd.exe 79 PID 1792 wrote to memory of 3492 1792 cmd.exe 79 - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\RFQ-0605.exe"C:\Users\Admin\AppData\Local\Temp\RFQ-0605.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:728
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1792 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ-0605.exe"3⤵PID:3492
-
-