Analysis
- max time kernel
150s - max time network
145s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:30
Static task
static1
Behavioral task
behavioral1
Sample
PO 19877.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target PO 19877.exe
- Size 674KB
- Sample201109-q6rfw55bea
- SHA256 30bbf2043054b92e495bbd55f67e43b8eafce430bf31d8aaa4899385e503cdbe
- MD5 56c623aaef953d0c9e12d8dc1db68bf4
- SHA1 4bea4c46b11e0e096d0d9cf34cdab5b11b001d90
- SHA512 0d9241c022bf006dfa029d1f9807ab62bd904a253cd9891c8e706fb1ec570c962fe197e1d02dfc4b30e53799850e0fb4e986857291ebf0cad3342c476900c15a
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.worstig.com/w9z/
Decoy
-
crazzysex.com
-
hanferd.com
-
gteesrd.com
-
bayfrontbabyplace.com
-
jicuiquan.net
-
relationshiplink.net
-
ohchacyberphoto.com
-
kauegimenes.com
-
powerful-seldom.com
-
ketotoken.com
-
make-money-online-success.com
-
redgoldcollection.com
-
hannan-football.com
-
hamptondc.com
-
vllii.com
-
aa8520.com
-
platform35markethall.com
-
larozeimmo.com
-
oligopoly.net
-
llhak.info
-
fisioservice.com
-
tesla-magnumopus.com
-
cocodrilodigital.com
-
pinegrovesg.com
-
traveladventureswithme.com
-
hebitaixin.com
-
golphysi.com
-
gayjeans.com
-
quickhire.expert
-
randomviews1.com
-
eatatnobu.com
-
topmabati.com
-
mediaupside.com
-
spillerakademi.com
-
thebowtie.store
-
sensomaticloadcell.com
-
turismodemadrid.net
-
yuhe89.com
-
wernerkrug.com
-
cdpogo.net
-
dannynhois.com
-
realestatestructureddata.com
-
matewhereareyou.net
-
laimeibei.ltd
-
sw328.com
-
lmwworks.net
-
xtremefish.com
-
tonerias.com
-
dsooneclinicianexpert.com
-
281clara.com
-
smmcommunity.net
-
dreamneeds.info
-
twocraft.com
-
yasasiite.salon
-
advk8qi.top
-
drabist.com
-
europartnersplus.com
-
saltbgone.com
-
teslaoceanic.info
-
bestmedicationstore.com
-
buynewcartab.live
-
prospect.money
-
viebrocks.com
-
transportationhappy.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/3132-0-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/3132-1-0x000000000041E2D0-mapping.dmp formbook behavioral2/memory/3876-3-0x0000000000000000-mapping.dmp formbook - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run cscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CNHPD4FPZD = "C:\\Program Files (x86)\\Xebxdj\\xhm4ut6hzl.exe" cscript.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 412 set thread context of 3132 412 PO 19877.exe 76 PID 3132 set thread context of 3012 3132 PO 19877.exe 57 PID 3876 set thread context of 3012 3876 cscript.exe 57 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Xebxdj\xhm4ut6hzl.exe cscript.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cscript.exe - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 412 PO 19877.exe 412 PO 19877.exe 3132 PO 19877.exe 3132 PO 19877.exe 3132 PO 19877.exe 3132 PO 19877.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe 3876 cscript.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 412 PO 19877.exe 3132 PO 19877.exe 3132 PO 19877.exe 3132 PO 19877.exe 3876 cscript.exe 3876 cscript.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3132 PO 19877.exe Token: SeDebugPrivilege 3876 cscript.exe Token: SeShutdownPrivilege 3012 Explorer.EXE Token: SeCreatePagefilePrivilege 3012 Explorer.EXE Token: SeShutdownPrivilege 3012 Explorer.EXE Token: SeCreatePagefilePrivilege 3012 Explorer.EXE - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 412 wrote to memory of 3132 412 PO 19877.exe 76 PID 412 wrote to memory of 3132 412 PO 19877.exe 76 PID 412 wrote to memory of 3132 412 PO 19877.exe 76 PID 3012 wrote to memory of 3876 3012 Explorer.EXE 77 PID 3012 wrote to memory of 3876 3012 Explorer.EXE 77 PID 3012 wrote to memory of 3876 3012 Explorer.EXE 77 PID 3876 wrote to memory of 916 3876 cscript.exe 78 PID 3876 wrote to memory of 916 3876 cscript.exe 78 PID 3876 wrote to memory of 916 3876 cscript.exe 78
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\PO 19877.exe"C:\Users\Admin\AppData\Local\Temp\PO 19877.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\PO 19877.exe"C:\Users\Admin\AppData\Local\Temp\PO 19877.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3132
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO 19877.exe"3⤵PID:916
-
-