Analysis
- max time kernel
146s - max time network
138s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 20:38
Static task
static1
Behavioral task
behavioral1
Sample
Scan_07062020.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target Scan_07062020.exe
- Size 335KB
- Sample201109-k4ryemskte
- SHA256 1fa61bb029466f4fe3ed9385994dcaed8b25715931e460f9b4db88ec155ec6a3
- MD5 0efca6807eac19cadeb17ec53e9c7cd8
- SHA1 68d4ae01ba1fe5af81b634cb569e2062a11b305e
- SHA512 d9d4c2fa717b42a057ae610941baf33b2ca53daf9a61f13aede7c498ae5b2af62424e6ed0de78381fa621124698fa06225293ec71203058219dc18761730a949
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.norjax.com/hxb/
Decoy
-
550731.top
-
dschezzi.com
-
dalinoshop.com
-
cvteh.online
-
sridurgaentertainment.com
-
mybisnet.com
-
beijingkeshi-ip.com
-
cmoudontheroad.com
-
australianaesthetics.com
-
alison.guru
-
cabdesign.biz
-
vppinc2008.com
-
blueskycampaigns.com
-
englishkadikoy.com
-
gaikeji.com
-
andreeacarisa.com
-
schnauzer-lovers-corner.com
-
ordermandwmarket.com
-
steeals.com
-
wellnesswithinyou.net
-
henmeil.net
-
2690879.top
-
unbornpeople.net
-
goinpay.com
-
amarfish.com
-
trutudios.com
-
greenprem.com
-
nanxingbokai.com
-
mingchengzaixian.com
-
zgkaishan.com
-
385ope.com
-
rijscholenvergelijken.online
-
stevejacksonprata.com
-
infernoundergo.com
-
tphandesign.com
-
possiblecopy.site
-
dreamhighdance.com
-
marahlaqo.com
-
edisudsa.com
-
penhouse.biz
-
fuece.info
-
maneed.net
-
vipoffer3.com
-
tysubway.net
-
vlkstars1.life
-
believeinj.com
-
xn--2hv35b3z8d.net
-
deeplearningalgorithm.com
-
wzpyq.com
-
zhkslxh.com
-
nnx.ink
-
weirdwriterscompany.com
-
halthazard.win
-
midwest3dprinting.net
-
lyndsihouskeeper.com
-
farmaciasanmartin.com
-
npscomponentes.com
-
qubohomes.com
-
poonians.com
-
computermatrix.com
-
jiushenggj.com
-
bbgan77.com
-
joyeriagya.com
-
jsjcqm.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral1/memory/1516-1-0x000000000041E2B0-mapping.dmp formbook behavioral1/memory/1516-0-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/268-2-0x0000000000000000-mapping.dmp formbook - Deletes itself 1 IoCs
pid Process 1012 cmd.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 344 set thread context of 1516 344 Scan_07062020.exe 31 PID 1516 set thread context of 1260 1516 Scan_07062020.exe 21 PID 268 set thread context of 1260 268 rundll32.exe 21 - Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 344 Scan_07062020.exe 344 Scan_07062020.exe 344 Scan_07062020.exe 344 Scan_07062020.exe 1516 Scan_07062020.exe 1516 Scan_07062020.exe 268 rundll32.exe 268 rundll32.exe 268 rundll32.exe 268 rundll32.exe 268 rundll32.exe 268 rundll32.exe 268 rundll32.exe 268 rundll32.exe 268 rundll32.exe 268 rundll32.exe 268 rundll32.exe 268 rundll32.exe 268 rundll32.exe 268 rundll32.exe 268 rundll32.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1516 Scan_07062020.exe 1516 Scan_07062020.exe 1516 Scan_07062020.exe 268 rundll32.exe 268 rundll32.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 344 Scan_07062020.exe Token: SeDebugPrivilege 1516 Scan_07062020.exe Token: SeDebugPrivilege 268 rundll32.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 344 wrote to memory of 608 344 Scan_07062020.exe 29 PID 344 wrote to memory of 608 344 Scan_07062020.exe 29 PID 344 wrote to memory of 608 344 Scan_07062020.exe 29 PID 344 wrote to memory of 608 344 Scan_07062020.exe 29 PID 344 wrote to memory of 1384 344 Scan_07062020.exe 30 PID 344 wrote to memory of 1384 344 Scan_07062020.exe 30 PID 344 wrote to memory of 1384 344 Scan_07062020.exe 30 PID 344 wrote to memory of 1384 344 Scan_07062020.exe 30 PID 344 wrote to memory of 1516 344 Scan_07062020.exe 31 PID 344 wrote to memory of 1516 344 Scan_07062020.exe 31 PID 344 wrote to memory of 1516 344 Scan_07062020.exe 31 PID 344 wrote to memory of 1516 344 Scan_07062020.exe 31 PID 344 wrote to memory of 1516 344 Scan_07062020.exe 31 PID 344 wrote to memory of 1516 344 Scan_07062020.exe 31 PID 344 wrote to memory of 1516 344 Scan_07062020.exe 31 PID 1260 wrote to memory of 268 1260 Explorer.EXE 32 PID 1260 wrote to memory of 268 1260 Explorer.EXE 32 PID 1260 wrote to memory of 268 1260 Explorer.EXE 32 PID 1260 wrote to memory of 268 1260 Explorer.EXE 32 PID 1260 wrote to memory of 268 1260 Explorer.EXE 32 PID 1260 wrote to memory of 268 1260 Explorer.EXE 32 PID 1260 wrote to memory of 268 1260 Explorer.EXE 32 PID 268 wrote to memory of 1012 268 rundll32.exe 33 PID 268 wrote to memory of 1012 268 rundll32.exe 33 PID 268 wrote to memory of 1012 268 rundll32.exe 33 PID 268 wrote to memory of 1012 268 rundll32.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\Scan_07062020.exe"C:\Users\Admin\AppData\Local\Temp\Scan_07062020.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Users\Admin\AppData\Local\Temp\Scan_07062020.exe"{path}"3⤵PID:608
-
-
C:\Users\Admin\AppData\Local\Temp\Scan_07062020.exe"{path}"3⤵PID:1384
-
-
C:\Users\Admin\AppData\Local\Temp\Scan_07062020.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1516
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Scan_07062020.exe"3⤵
- Deletes itself
PID:1012
-
-