Analysis
- max time kernel
146s - max time network
8s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 20:37
Static task
static1
Behavioral task
behavioral1
Sample
PO 14544.exe
Resource
win7v20201028
windows7_x64
General
- Target PO 14544.exe
- Size 669KB
- Sample201109-bldphwt722
- SHA256 c7544c2d4180660fc3a96f3b66b5caa0e168dcfbb35a870f1c576a152ed62348
- MD5 4d2fb973d84c8528bd40f4173e87dfc9
- SHA1 8b0099a296433b49e0c00b03d895b3e4a65feeb3
- SHA512 f2002cc408ee1c6fdce50a72559b03fe18a9ec1e3a23c15aa44f493dc2c6610ab4407fed01a540ac3fbb2bc1667c3dae428c4fd8c6b8e0db8684b3bef15f43a8
- MD5 SHA1 SHA512
Malware Config
Extracted
-
formbook
-
http://www.worstig.com/w9z/
-
crazzysex.com
-
hanferd.com
-
gteesrd.com
-
bayfrontbabyplace.com
-
jicuiquan.net
-
relationshiplink.net
-
ohchacyberphoto.com
-
kauegimenes.com
-
powerful-seldom.com
-
ketotoken.com
-
make-money-online-success.com
-
redgoldcollection.com
-
hannan-football.com
-
hamptondc.com
-
vllii.com
-
aa8520.com
-
platform35markethall.com
-
larozeimmo.com
-
oligopoly.net
-
llhak.info
-
fisioservice.com
-
tesla-magnumopus.com
-
cocodrilodigital.com
-
pinegrovesg.com
-
traveladventureswithme.com
-
hebitaixin.com
-
golphysi.com
-
gayjeans.com
-
quickhire.expert
-
randomviews1.com
-
eatatnobu.com
-
topmabati.com
-
mediaupside.com
-
spillerakademi.com
-
thebowtie.store
-
sensomaticloadcell.com
-
turismodemadrid.net
-
yuhe89.com
-
wernerkrug.com
-
cdpogo.net
-
dannynhois.com
-
realestatestructureddata.com
-
matewhereareyou.net
-
laimeibei.ltd
-
sw328.com
-
lmwworks.net
-
xtremefish.com
-
tonerias.com
-
dsooneclinicianexpert.com
-
281clara.com
-
smmcommunity.net
-
dreamneeds.info
-
twocraft.com
-
yasasiite.salon
-
advk8qi.top
-
drabist.com
-
europartnersplus.com
-
saltbgone.com
-
teslaoceanic.info
-
bestmedicationstore.com
-
buynewcartab.live
-
prospect.money
-
viebrocks.com
-
transportationhappy.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral1/memory/816-0-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/816-1-0x000000000041E2D0-mapping.dmp formbook behavioral1/memory/1596-3-0x0000000000000000-mapping.dmp formbook - Deletes itself 1 IoCs
pid Process 1648 cmd.exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1584 set thread context of 816 1584 PO 14544.exe 26 PID 816 set thread context of 1192 816 PO 14544.exe 21 PID 816 set thread context of 1192 816 PO 14544.exe 21 PID 1596 set thread context of 1192 1596 NAPSTAT.EXE 21 - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 1584 PO 14544.exe 816 PO 14544.exe 816 PO 14544.exe 816 PO 14544.exe 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1584 PO 14544.exe 816 PO 14544.exe 816 PO 14544.exe 816 PO 14544.exe 816 PO 14544.exe 1596 NAPSTAT.EXE 1596 NAPSTAT.EXE - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 816 PO 14544.exe Token: SeDebugPrivilege 1596 NAPSTAT.EXE - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1584 wrote to memory of 816 1584 PO 14544.exe 26 PID 1584 wrote to memory of 816 1584 PO 14544.exe 26 PID 1584 wrote to memory of 816 1584 PO 14544.exe 26 PID 1584 wrote to memory of 816 1584 PO 14544.exe 26 PID 816 wrote to memory of 1596 816 PO 14544.exe 30 PID 816 wrote to memory of 1596 816 PO 14544.exe 30 PID 816 wrote to memory of 1596 816 PO 14544.exe 30 PID 816 wrote to memory of 1596 816 PO 14544.exe 30 PID 1596 wrote to memory of 1648 1596 NAPSTAT.EXE 31 PID 1596 wrote to memory of 1648 1596 NAPSTAT.EXE 31 PID 1596 wrote to memory of 1648 1596 NAPSTAT.EXE 31 PID 1596 wrote to memory of 1648 1596 NAPSTAT.EXE 31
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\PO 14544.exe"C:\Users\Admin\AppData\Local\Temp\PO 14544.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\PO 14544.exe"C:\Users\Admin\AppData\Local\Temp\PO 14544.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO 14544.exe"5⤵
- Deletes itself
PID:1648
-
-
-
-