Analysis
- max time kernel
150s - max time network
137s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 20:54
Static task
static1
Behavioral task
behavioral1
Sample
8903-Dco2.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
8903-Dco2.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 8903-Dco2.exe
- Size 557KB
- Sample201109-be99v6pt9n
- SHA256 ec8d87e7db1c4f69358cdd9de92c9f8d4077dc7b61b4ccb834bf2fe129279289
- MD5 dc81e74a59940379870c59aff72f1540
- SHA1 6ec5f57a41bff9255e62822f720c089cb372f422
- SHA512 cfc6179a2c4278c56e371b02e23707a9ff585ebbc991fc427ba6179fb78371d706844e61d4b7328483b3a2ca47215d032efb3cc3962ad2643adda173c9b14180
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.hearxy.com/s5l/
Decoy
-
greenstock.info
-
laurajaneaesthetics.com
-
817comm.com
-
dbprimery.com
-
slzu-vxtx9.biz
-
covetpro.com
-
50.ink
-
weick.email
-
88717888.com
-
tongyue0423.com
-
anchorsky.com
-
horapatarot.com
-
cadillacforless.com
-
primesupplyvintage.com
-
torchinstant.win
-
thebrandishere.com
-
www-69677.com
-
savestj.com
-
tommydad.com
-
xigjailbreak.com
-
contulinemotieeszere.info
-
virtualrealitydomainnames.com
-
oldschoolrentalcars.com
-
zerosumtoken.info
-
facingrods.com
-
bagodawatch.com
-
theecostone.com
-
fireangelstech.com
-
lendingnetworksmail.com
-
apartemenbegawan.com
-
oniapparel.com
-
sanjeevkumarvestige.com
-
jiqywrrcmyudxaydrw.com
-
ptt-store.com
-
affilifaq.net
-
eyezonsite.com
-
youreadorkable.com
-
eh-sc.com
-
diariodasnoticias.com
-
bcqts.com
-
9a176.com
-
triplicesports.com
-
thetravelguideindia.com
-
frottolesignoraggio.info
-
swiftlogistics-service.com
-
36lk.info
-
webuyoldmotorcycles.com
-
mikedtoyota.com
-
honghuyangguang.com
-
soft-bits.com
-
twheb.com
-
poshchain.com
-
socialgeeknwa.com
-
alltexvets.com
-
coscolg.com
-
theflyingwolves.com
-
stonebridgeiwm.info
-
requestforcollect.com
-
weatherdeep.com
-
webxhard.com
-
six.ltd
-
belamargarida.com
-
eskisehirkahvefestivali.com
-
sf8803.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral1/memory/1652-9-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/1652-10-0x000000000041B6E0-mapping.dmp formbook behavioral1/memory/824-13-0x0000000000000000-mapping.dmp formbook - Executes dropped EXE 1 IoCs
pid Process 1652 8903-Dco2.exe - Loads dropped DLL 1 IoCs
pid Process 1628 8903-Dco2.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\product.exe = "\"C:\\Users\\Admin\\AppData\\Local\\product.exe.exe\"" 8903-Dco2.exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1628 set thread context of 1652 1628 8903-Dco2.exe 30 PID 1652 set thread context of 1232 1652 8903-Dco2.exe 21 PID 1652 set thread context of 1232 1652 8903-Dco2.exe 21 PID 824 set thread context of 1232 824 wscript.exe 21 - Suspicious behavior: EnumeratesProcesses 142 IoCs
pid Process 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1652 8903-Dco2.exe 1652 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1652 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 824 wscript.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 824 wscript.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 824 wscript.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 824 wscript.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 824 wscript.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 824 wscript.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 824 wscript.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 824 wscript.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 824 wscript.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 824 wscript.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 824 wscript.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 824 wscript.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 824 wscript.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 824 wscript.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 824 wscript.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 824 wscript.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 824 wscript.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 824 wscript.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 824 wscript.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 1628 8903-Dco2.exe 824 wscript.exe 1628 8903-Dco2.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1652 8903-Dco2.exe 1652 8903-Dco2.exe 1652 8903-Dco2.exe 1652 8903-Dco2.exe 824 wscript.exe 824 wscript.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1628 8903-Dco2.exe Token: SeDebugPrivilege 1652 8903-Dco2.exe Token: SeDebugPrivilege 824 wscript.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1232 Explorer.EXE 1232 Explorer.EXE 1232 Explorer.EXE 1232 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1232 Explorer.EXE 1232 Explorer.EXE 1232 Explorer.EXE 1232 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1628 wrote to memory of 1652 1628 8903-Dco2.exe 30 PID 1628 wrote to memory of 1652 1628 8903-Dco2.exe 30 PID 1628 wrote to memory of 1652 1628 8903-Dco2.exe 30 PID 1628 wrote to memory of 1652 1628 8903-Dco2.exe 30 PID 1628 wrote to memory of 1652 1628 8903-Dco2.exe 30 PID 1628 wrote to memory of 1652 1628 8903-Dco2.exe 30 PID 1628 wrote to memory of 1652 1628 8903-Dco2.exe 30 PID 1652 wrote to memory of 824 1652 8903-Dco2.exe 31 PID 1652 wrote to memory of 824 1652 8903-Dco2.exe 31 PID 1652 wrote to memory of 824 1652 8903-Dco2.exe 31 PID 1652 wrote to memory of 824 1652 8903-Dco2.exe 31 PID 824 wrote to memory of 1512 824 wscript.exe 32 PID 824 wrote to memory of 1512 824 wscript.exe 32 PID 824 wrote to memory of 1512 824 wscript.exe 32 PID 824 wrote to memory of 1512 824 wscript.exe 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\8903-Dco2.exe"C:\Users\Admin\AppData\Local\Temp\8903-Dco2.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\8903-Dco2.exe"C:\Users\Admin\AppData\Local\Temp\8903-Dco2.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\8903-Dco2.exe"5⤵PID:1512
-
-
-
-