Analysis
-
max time kernel
147s -
max time network
14s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:59
Static task
static1
Behavioral task
behavioral1
Sample
flWhrV1J6MAi1kS.exe
Resource
win7v20201028
General
-
Target
flWhrV1J6MAi1kS.exe
-
Size
345KB
-
MD5
61a281d6005afdcb7b9f25b16e71bff3
-
SHA1
a380e614531478c3adf122e78568308e8a46f5c5
-
SHA256
9148c87726f97b18e044b9059a608a3b809ae02a795d44c1609bff24232c45ac
-
SHA512
bc174c366bfefc2acabdaa9b7548a726db82ff408cc145d85d5d7b0400e129d6688aa07928e0dd0a0bdcb9e0598ce86f48c77f7fc2607bdbe440014463eb0f9f
Malware Config
Extracted
formbook
http://www.spatren.com/k0f/
uao2o.info
hehe2.net
beautyqueenstores.com
chataan.com
brazzers-shop.biz
evolutionareligion.com
laysusannausboko.com
idewweddings.com
superwebox.com
moviesfan.net
deal-mix.com
infrarotgrilltest.info
corelesseposrolls.com
mpbrandl-finetrade-gamma.com
statement-log-in.info
romita4harrison.com
cpateamconsultant.com
gxdiaoyu.com
motocenterlaba.com
mlrs1314.com
theartistgym.com
44000163.com
autismtherapycareers.com
southern120.com
florartist.com
bulkingsteroidscycles.com
marcasfashion.com
luga.ltd
amfeicai.com
wolfzh.com
njartiuedu.com
theblacksheepmalta.com
gringouno.com
mercadocorrea.com
member-suport-appld.com
noticiasparaeldia.com
noflamecooker.com
thorpedomains.com
zenmeting.com
hamaridharohar.com
fastestgrowingtechnology.com
mkdcollege.com
ecowastribune.com
financialplanner.cloud
capetown360.net
uzkbpcbhdggp.site
safetwater.com
t-online-de.biz
pinnaclepalmsprings.com
ambconstructioninc.com
printpeacock.biz
fattireflights.com
adultsgetnaughty.com
karavango.com
jasonmildwaters.com
aliveness.online
zepolauto.com
connectowork.com
0p3nine.loan
xn--bb0bw4m92e.com
pratalaw.com
kutuk.online
jsh-tech.com
sptor.net
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1464-5-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/1464-6-0x000000000041E320-mapping.dmp formbook behavioral1/memory/1148-7-0x0000000000000000-mapping.dmp formbook -
Processes:
resource yara_rule behavioral1/memory/1128-4-0x0000000000C60000-0x0000000000C94000-memory.dmp rezer0 -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1788 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
flWhrV1J6MAi1kS.exeflWhrV1J6MAi1kS.exewscript.exedescription pid process target process PID 1128 set thread context of 1464 1128 flWhrV1J6MAi1kS.exe flWhrV1J6MAi1kS.exe PID 1464 set thread context of 1356 1464 flWhrV1J6MAi1kS.exe Explorer.EXE PID 1464 set thread context of 1356 1464 flWhrV1J6MAi1kS.exe Explorer.EXE PID 1148 set thread context of 1356 1148 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
flWhrV1J6MAi1kS.exewscript.exepid process 1464 flWhrV1J6MAi1kS.exe 1464 flWhrV1J6MAi1kS.exe 1464 flWhrV1J6MAi1kS.exe 1148 wscript.exe 1148 wscript.exe 1148 wscript.exe 1148 wscript.exe 1148 wscript.exe 1148 wscript.exe 1148 wscript.exe 1148 wscript.exe 1148 wscript.exe 1148 wscript.exe 1148 wscript.exe 1148 wscript.exe 1148 wscript.exe 1148 wscript.exe 1148 wscript.exe 1148 wscript.exe 1148 wscript.exe 1148 wscript.exe 1148 wscript.exe 1148 wscript.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
flWhrV1J6MAi1kS.exewscript.exepid process 1464 flWhrV1J6MAi1kS.exe 1464 flWhrV1J6MAi1kS.exe 1464 flWhrV1J6MAi1kS.exe 1464 flWhrV1J6MAi1kS.exe 1148 wscript.exe 1148 wscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
flWhrV1J6MAi1kS.exewscript.exedescription pid process Token: SeDebugPrivilege 1464 flWhrV1J6MAi1kS.exe Token: SeDebugPrivilege 1148 wscript.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1356 Explorer.EXE 1356 Explorer.EXE 1356 Explorer.EXE 1356 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1356 Explorer.EXE 1356 Explorer.EXE 1356 Explorer.EXE 1356 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
flWhrV1J6MAi1kS.exeExplorer.EXEwscript.exedescription pid process target process PID 1128 wrote to memory of 1464 1128 flWhrV1J6MAi1kS.exe flWhrV1J6MAi1kS.exe PID 1128 wrote to memory of 1464 1128 flWhrV1J6MAi1kS.exe flWhrV1J6MAi1kS.exe PID 1128 wrote to memory of 1464 1128 flWhrV1J6MAi1kS.exe flWhrV1J6MAi1kS.exe PID 1128 wrote to memory of 1464 1128 flWhrV1J6MAi1kS.exe flWhrV1J6MAi1kS.exe PID 1128 wrote to memory of 1464 1128 flWhrV1J6MAi1kS.exe flWhrV1J6MAi1kS.exe PID 1128 wrote to memory of 1464 1128 flWhrV1J6MAi1kS.exe flWhrV1J6MAi1kS.exe PID 1128 wrote to memory of 1464 1128 flWhrV1J6MAi1kS.exe flWhrV1J6MAi1kS.exe PID 1356 wrote to memory of 1148 1356 Explorer.EXE wscript.exe PID 1356 wrote to memory of 1148 1356 Explorer.EXE wscript.exe PID 1356 wrote to memory of 1148 1356 Explorer.EXE wscript.exe PID 1356 wrote to memory of 1148 1356 Explorer.EXE wscript.exe PID 1148 wrote to memory of 1788 1148 wscript.exe cmd.exe PID 1148 wrote to memory of 1788 1148 wscript.exe cmd.exe PID 1148 wrote to memory of 1788 1148 wscript.exe cmd.exe PID 1148 wrote to memory of 1788 1148 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\flWhrV1J6MAi1kS.exe"C:\Users\Admin\AppData\Local\Temp\flWhrV1J6MAi1kS.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\flWhrV1J6MAi1kS.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\flWhrV1J6MAi1kS.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1128-0-0x0000000074B10000-0x00000000751FE000-memory.dmpFilesize
6.9MB
-
memory/1128-1-0x0000000001070000-0x0000000001071000-memory.dmpFilesize
4KB
-
memory/1128-3-0x0000000000520000-0x000000000052F000-memory.dmpFilesize
60KB
-
memory/1128-4-0x0000000000C60000-0x0000000000C94000-memory.dmpFilesize
208KB
-
memory/1148-7-0x0000000000000000-mapping.dmp
-
memory/1148-8-0x00000000009C0000-0x00000000009E6000-memory.dmpFilesize
152KB
-
memory/1148-10-0x00000000032C0000-0x0000000003426000-memory.dmpFilesize
1.4MB
-
memory/1464-5-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1464-6-0x000000000041E320-mapping.dmp
-
memory/1788-9-0x0000000000000000-mapping.dmp