Analysis
- max time kernel
147s - max time network
135s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:04
Static task
static1
Behavioral task
behavioral1
Sample
PO C10090.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PO C10090.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target PO C10090.exe
- Size 309KB
- Sample201109-p2jmcaem32
- SHA256 65cd6807556189c85811f11fb91a981749e7d9760e5a72c0845dd6b8ff93a8f9
- MD5 52b9520f67483c03673b18e500cdb728
- SHA1 c23ebfec4a59e85985dabe251390a195ce3d43ca
- SHA512 38b4ca1c96f6436a7a884ea949af40a2ef52446a0aaeee27e925b8eb8954ded1fcd0f07337d397f9bb4e69c73ccd019826de9cdb0530fa709db7a988cb658677
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.yofdyk.com/q5e/
Decoy
-
2177.ltd
-
thanxiety.com
-
max-width.com
-
fixti.net
-
mostmaj.com
-
mobilteknolojiuzmani.com
-
historyannals.com
-
wheelchairmotion.com
-
mossandmoonstonestudio.com
-
kastellifournis.com
-
axokey.net
-
peekl.com
-
metsteeshirt.com
-
abcfinancial-inc.com
-
btxrsp.com
-
amydh.com
-
ccoauthority.com
-
lumacorretora.com
-
kimfelixrealtor.com
-
iconext.biz
-
giftstgg.com
-
imonsanto.com
-
invoicefor.com
-
qfhxlw.com
-
wsykyy.com
-
gladius.network
-
peliculaslatino.online
-
timookflour.com
-
gxkuangjian.com
-
utvklj.men
-
rabota-v-avon.online
-
sheashealingway.com
-
thoitrangaoda.com
-
rytechweb.com
-
circuit69.com
-
crowd-design.biz
-
carosiandrhee.com
-
778d88.com
-
calvinkl.com
-
cjkit.com
-
jgkwhgxe.com
-
sanitascuadromedico.com
-
mellorangello.com
-
whiteinnocence.com
-
medtechdesignstudio.net
-
nurturingskin.com
-
guardyourweb.net
-
juw2017.com
-
jnheroes.com
-
damicosoftwaresystems.com
-
gesband.com
-
onwardsandupwards.info
-
gopropackaging.com
-
centerforaunts.com
-
sarrahshewdesign.com
-
intelligentcoach.net
-
iasisf.agency
-
products-news.com
-
calvinspring.com
-
100zan.site
-
9mahina.com
-
saleaustralianboots.com
-
floatinginfotech.com
-
calcinoneweek.com
Signatures
- CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
resource yara_rule behavioral2/memory/3644-8-0x0000000000000000-mapping.dmp coreentity - CoreCCC Packer 1 IoCs
Detects CoreCCC packer used to load .NET malware.
resource yara_rule behavioral2/memory/3644-8-0x0000000000000000-mapping.dmp coreccc - Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/3960-0-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/3960-1-0x000000000041E2A0-mapping.dmp formbook behavioral2/memory/568-2-0x0000000000000000-mapping.dmp formbook - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run wlanext.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FVVHANIXGV = "C:\\Program Files (x86)\\Txzhhsf\\rz7pl_6yl.exe" wlanext.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 636 set thread context of 3960 636 PO C10090.exe 75 PID 3960 set thread context of 2868 3960 PO C10090.exe 57 PID 568 set thread context of 2868 568 wlanext.exe 57 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Txzhhsf\rz7pl_6yl.exe wlanext.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wlanext.exe - Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 636 PO C10090.exe 636 PO C10090.exe 636 PO C10090.exe 636 PO C10090.exe 3960 PO C10090.exe 3960 PO C10090.exe 3960 PO C10090.exe 3960 PO C10090.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 3960 PO C10090.exe 3960 PO C10090.exe 3960 PO C10090.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe 568 wlanext.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 636 PO C10090.exe Token: SeDebugPrivilege 3960 PO C10090.exe Token: SeDebugPrivilege 568 wlanext.exe Token: SeShutdownPrivilege 2868 Explorer.EXE Token: SeCreatePagefilePrivilege 2868 Explorer.EXE Token: SeShutdownPrivilege 2868 Explorer.EXE Token: SeCreatePagefilePrivilege 2868 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2868 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 636 wrote to memory of 3960 636 PO C10090.exe 75 PID 636 wrote to memory of 3960 636 PO C10090.exe 75 PID 636 wrote to memory of 3960 636 PO C10090.exe 75 PID 636 wrote to memory of 3960 636 PO C10090.exe 75 PID 636 wrote to memory of 3960 636 PO C10090.exe 75 PID 636 wrote to memory of 3960 636 PO C10090.exe 75 PID 2868 wrote to memory of 568 2868 Explorer.EXE 76 PID 2868 wrote to memory of 568 2868 Explorer.EXE 76 PID 2868 wrote to memory of 568 2868 Explorer.EXE 76 PID 568 wrote to memory of 3024 568 wlanext.exe 79 PID 568 wrote to memory of 3024 568 wlanext.exe 79 PID 568 wrote to memory of 3024 568 wlanext.exe 79 PID 568 wrote to memory of 3644 568 wlanext.exe 82 PID 568 wrote to memory of 3644 568 wlanext.exe 82 PID 568 wrote to memory of 3644 568 wlanext.exe 82
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\PO C10090.exe"C:\Users\Admin\AppData\Local\Temp\PO C10090.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\PO C10090.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO C10090.exe"3⤵PID:3024
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3644
-
-