Analysis
- max time kernel
147s - max time network
134s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:58
Static task
static1
Behavioral task
behavioral1
Sample
RFQ-PO04635AZ323.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target RFQ-PO04635AZ323.exe
- Size 461KB
- Sample201109-a27vpwm5js
- SHA256 f310aa4f6cb0b3c3d237d13640594dd0a06f8c42ab5ecd1cba3daecc860129bf
- MD5 93de480dde266435aaac2a9c0ff59c1e
- SHA1 56a40e486e6c3a7d7fa458293f39a5d339f89202
- SHA512 0efd6180c0a4f6b8dc42c07418f1f41117d6c12e982605d577737e7fefe642b3ef1f5152ef44dae0e34176283a10b059f423df4e4d5e083116dd5ee1f7dd6175
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.nimtax.com/ut/
Decoy
-
testestes.com
-
taihaogame.com
-
onlinecomedians.com
-
cheapest-pricelevitra-buy.com
-
ohioriverboats.com
-
heimac100.com
-
justicejava.com
-
lisaseansadvancedskincare.com
-
pattymeyerphotography.com
-
yogijobs.com
-
timelessbabez.com
-
aliandanusha.com
-
comaan.net
-
calomio.com
-
654we.com
-
charlottesballoons.com
-
ageingtech.com
-
ktdlh.info
-
lafermedecamelia.com
-
ido-expo.com
-
vancityseminars.com
-
studenttunes.com
-
lafarmaciatelurica.com
-
01028038168.com
-
memoryid.life
-
bitdice-casino-ico.com
-
commentecrireunarticle.com
-
vwz1ntca.site
-
zsy2.com
-
miyimg.com
-
stressreliefzone.com
-
digitalservicesmedialtd.com
-
unicgears.com
-
e-litex.com
-
revolve-llc.com
-
elleintimement.com
-
gornovic.com
-
peakfitnessrx.info
-
colossustraining.com
-
technologyread.com
-
1024ddds.info
-
ebee.ltd
-
johndeere-tractors.com
-
jilincdhpower.com
-
blancoelephanto.com
-
realestatepropertiesale.com
-
khhhr.loan
-
lesdelicesdadriel.com
-
monsterbeats-drdre.net
-
alternatribo.net
-
maxthemarketer.com
-
cinema-cipriana.online
-
dynabracketts.com
-
wasserschaden-hero.com
-
shopeeyz.online
-
brendabags.com
-
putztrintei.com
-
tsingem.group
-
thechekucafe.com
-
hsyvtj.com
-
metrobank45949342947.site
-
tec-spark.com
-
xn--fcsv5eky2b5qk.com
-
afiengneering.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/3960-2-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/3960-3-0x000000000041B6E0-mapping.dmp formbook behavioral2/memory/3912-4-0x0000000000000000-mapping.dmp formbook - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cmmon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\8PRHFBIXK = "C:\\Program Files (x86)\\Av8ftlbmx\\dxph4hd.exe" cmmon32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3968 set thread context of 3960 3968 RFQ-PO04635AZ323.exe 81 PID 3960 set thread context of 3036 3960 RFQ-PO04635AZ323.exe 57 PID 3912 set thread context of 3036 3912 cmmon32.exe 57 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Av8ftlbmx\dxph4hd.exe cmmon32.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1728 schtasks.exe -
description ioc Process Key created \Registry\User\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmmon32.exe - Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 3960 RFQ-PO04635AZ323.exe 3960 RFQ-PO04635AZ323.exe 3960 RFQ-PO04635AZ323.exe 3960 RFQ-PO04635AZ323.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe 3912 cmmon32.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3960 RFQ-PO04635AZ323.exe 3960 RFQ-PO04635AZ323.exe 3960 RFQ-PO04635AZ323.exe 3912 cmmon32.exe 3912 cmmon32.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3960 RFQ-PO04635AZ323.exe Token: SeDebugPrivilege 3912 cmmon32.exe Token: SeShutdownPrivilege 3036 Explorer.EXE Token: SeCreatePagefilePrivilege 3036 Explorer.EXE Token: SeShutdownPrivilege 3036 Explorer.EXE Token: SeCreatePagefilePrivilege 3036 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3036 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3968 wrote to memory of 1728 3968 RFQ-PO04635AZ323.exe 79 PID 3968 wrote to memory of 1728 3968 RFQ-PO04635AZ323.exe 79 PID 3968 wrote to memory of 1728 3968 RFQ-PO04635AZ323.exe 79 PID 3968 wrote to memory of 3960 3968 RFQ-PO04635AZ323.exe 81 PID 3968 wrote to memory of 3960 3968 RFQ-PO04635AZ323.exe 81 PID 3968 wrote to memory of 3960 3968 RFQ-PO04635AZ323.exe 81 PID 3968 wrote to memory of 3960 3968 RFQ-PO04635AZ323.exe 81 PID 3968 wrote to memory of 3960 3968 RFQ-PO04635AZ323.exe 81 PID 3968 wrote to memory of 3960 3968 RFQ-PO04635AZ323.exe 81 PID 3036 wrote to memory of 3912 3036 Explorer.EXE 82 PID 3036 wrote to memory of 3912 3036 Explorer.EXE 82 PID 3036 wrote to memory of 3912 3036 Explorer.EXE 82 PID 3912 wrote to memory of 2324 3912 cmmon32.exe 83 PID 3912 wrote to memory of 2324 3912 cmmon32.exe 83 PID 3912 wrote to memory of 2324 3912 cmmon32.exe 83
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\RFQ-PO04635AZ323.exe"C:\Users\Admin\AppData\Local\Temp\RFQ-PO04635AZ323.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pAgbxDdlW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9010.tmp"3⤵
- Creates scheduled task(s)
PID:1728
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ-PO04635AZ323.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ-PO04635AZ323.exe"3⤵PID:2324
-
-