Analysis
- max time kernel
146s - max time network
133s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:58
Static task
static1
Behavioral task
behavioral1
Sample
PO_5892 JANGUANG.exe
Resource
win7v20201028
windows7_x64
General
- Target PO_5892 JANGUANG.exe
- Size 299KB
- Sample201109-lamyb2n3ej
- SHA256 8058effea9cbffe67d3cc69221eda22862586eecdb7c9409b4f9fd6eab6ea04f
- MD5 a040984ea1fdeb9fdd5ee61642ead4cd
- SHA1 a26f6303db3e0ed321cd79ca9c862dcdfc2bf4b1
- SHA512 5021c8411d63d1e3f99945ecbc08a9352a5c611e7a0bc019bce7b5c138f77bec6eb3d7e793188da0369e1741b04b1b49366dbe75d58b840217fbfcdab4725f81
- MD5 SHA1 SHA512
Malware Config
Extracted
-
formbook
-
http://www.regulars5.info/rq8mz/
-
window.company
-
hxjianye.com
-
slc2fcq.info
-
bluechipprepurchase.com
-
toprvandmarineproducts.net
-
verdicts.biz
-
shop3012.com
-
exel-norte.com
-
best-web.com
-
mobilitysolutions.online
-
salon-door.com
-
usaremates.com
-
md-lawfirm.com
-
1123nn.com
-
hillstate-suji.com
-
hcenebenmohamed.com
-
shengtujgj.com
-
costantinisales.com
-
rtcpay.com
-
mikesmalley.net
-
perchengine.com
-
piscoelqui.net
-
ahwbdl.com
-
pjxip.info
-
japanaddiction.com
-
radletec.net
-
huashuo-zhizhao.com
-
gustflo.com
-
banjovi.rocks
-
jedhconstruction.com
-
selltcg.com
-
gocomparematerialquotes.com
-
kordze.info
-
cdn-network13-server4.biz
-
querocomercoxinha.com
-
thebestregistrars.com
-
candijohnssalon.com
-
paramountfh.com
-
adclave.com
-
pennenergymalaysia.com
-
kkdunqng.com
-
consultgenou.com
-
sbn-tv.com
-
weddingrentals.events
-
stockmarketace.com
-
marthataranto.com
-
whereformer.com
-
tohda.net
-
bbb464.com
-
guysbulk.com
-
galaxyonboard.com
-
vabomereclinicaltrials.info
-
jinle8.com
-
schoeneferien.info
-
radugavl.com
-
mljxb.com
-
kanatciaga.com
-
rollet-neu-entdecken.com
-
herostore.online
-
t2intelligence.com
-
laymanbrothers.com
-
cheetah-press.com
-
laurentbrissonphoto.com
-
aloveto.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/4240-1-0x000000000041E310-mapping.dmp formbook behavioral2/memory/4240-0-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/4248-2-0x0000000000000000-mapping.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4700 set thread context of 4240 4700 PO_5892 JANGUANG.exe 79 PID 4240 set thread context of 2896 4240 PO_5892 JANGUANG.exe 57 PID 4248 set thread context of 2896 4248 wlanext.exe 57 - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 4700 PO_5892 JANGUANG.exe 4700 PO_5892 JANGUANG.exe 4240 PO_5892 JANGUANG.exe 4240 PO_5892 JANGUANG.exe 4240 PO_5892 JANGUANG.exe 4240 PO_5892 JANGUANG.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe 4248 wlanext.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 4240 PO_5892 JANGUANG.exe 4240 PO_5892 JANGUANG.exe 4240 PO_5892 JANGUANG.exe 4248 wlanext.exe 4248 wlanext.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4700 PO_5892 JANGUANG.exe Token: SeDebugPrivilege 4240 PO_5892 JANGUANG.exe Token: SeDebugPrivilege 4248 wlanext.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2896 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4700 wrote to memory of 3988 4700 PO_5892 JANGUANG.exe 78 PID 4700 wrote to memory of 3988 4700 PO_5892 JANGUANG.exe 78 PID 4700 wrote to memory of 3988 4700 PO_5892 JANGUANG.exe 78 PID 4700 wrote to memory of 4240 4700 PO_5892 JANGUANG.exe 79 PID 4700 wrote to memory of 4240 4700 PO_5892 JANGUANG.exe 79 PID 4700 wrote to memory of 4240 4700 PO_5892 JANGUANG.exe 79 PID 4700 wrote to memory of 4240 4700 PO_5892 JANGUANG.exe 79 PID 4700 wrote to memory of 4240 4700 PO_5892 JANGUANG.exe 79 PID 4700 wrote to memory of 4240 4700 PO_5892 JANGUANG.exe 79 PID 2896 wrote to memory of 4248 2896 Explorer.EXE 80 PID 2896 wrote to memory of 4248 2896 Explorer.EXE 80 PID 2896 wrote to memory of 4248 2896 Explorer.EXE 80 PID 4248 wrote to memory of 2324 4248 wlanext.exe 81 PID 4248 wrote to memory of 2324 4248 wlanext.exe 81 PID 4248 wrote to memory of 2324 4248 wlanext.exe 81
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\PO_5892 JANGUANG.exe"C:\Users\Admin\AppData\Local\Temp\PO_5892 JANGUANG.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\PO_5892 JANGUANG.exe"{path}"3⤵PID:3988
-
-
C:\Users\Admin\AppData\Local\Temp\PO_5892 JANGUANG.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4240
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO_5892 JANGUANG.exe"3⤵PID:2324
-
-