Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 19:37
Behavioral task
behavioral1
Sample
RFQ-MNAMR-001RB-WhastsAAp Images.exe
Resource
win7v20201028
General
-
Target
RFQ-MNAMR-001RB-WhastsAAp Images.exe
-
Size
398KB
-
MD5
239efcf744fc1e906b704d4eebe4a962
-
SHA1
c8c0fe13941c237cd72c2eb3adcfc13f9513d32d
-
SHA256
aae9b362789cdf8a185d9b963cb3b0ba5d7f5599285cecd8625944168232c42c
-
SHA512
affe8bdcfbdc3e2554f2b8c887a9d417a69b5e031f7433ecf8971cc14a55bbabb70fbacd495a23d355662a679fbca321c38eb46e37949ea51e2e290ad7558af9
Malware Config
Extracted
formbook
http://www.salomdy.com/xcm/
xn--rhq5es99j.com
storage-download-fast.review
campingfamilly.com
rientbottcieux.info
2015z.com
999izo.info
guojiafangshui.com
jpaecwra.com
evergreenmga.net
semprebellissima.store
meizin01.com
bangladesherkhobor.net
rivercoveresidencessg.com
carbonfibercrew.com
1rbld2.biz
nikolatesla.review
erlandsonsbrygga.com
cursosreikiadistancia.com
centraldemotorersltda.com
shelskysbrooklynbagels.com
ferfectifyplns.date
gzxj360.com
mshaldernetwork.com
bitejinbi.com
annemariescallan.com
dopcs.com
ignaciobandera.com
hanza-trade.com
mr605.com
smartgridbattery.com
irma.center
imagilt.com
sandy-beauty.com
wildwestshavingco.com
crypto-hardware-wallets.com
nichollspublishing.com
themeancompany.com
weiyilay.com
hinhsex.net
yuyuebaichuan.com
gremioimortaltricolor.com
40wgwg.com
im-i.com
775manbetx.com
skyfieldandgreen.net
biangl.com
jalexsanger.life
kaitlynlagrega.com
bonus-karamba.info
doralcourthandbook.com
hamsterpetcare.com
silco-structural.com
bihanarabi.com
nonelit.com
nagercoilcorporation.com
favoritetrafficupdating.online
corporate1.biz
searchlightroundup.biz
113839stse.com
electric-dinosaur.com
easyworldnewscom.faith
darnellprince.com
szsotx.com
mortgagesaremyjam.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/976-5-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/976-6-0x000000000041B6F0-mapping.dmp formbook behavioral2/memory/772-8-0x0000000000000000-mapping.dmp formbook -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
systray.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run systray.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\EJQLRTJ0 = "C:\\Program Files (x86)\\Bgrxd-61\\bdltlz7ps.exe" systray.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
RFQ-MNAMR-001RB-WhastsAAp Images.exeRFQ-MNAMR-001RB-WhastsAAp Images.exesystray.exedescription pid process target process PID 1180 set thread context of 976 1180 RFQ-MNAMR-001RB-WhastsAAp Images.exe RFQ-MNAMR-001RB-WhastsAAp Images.exe PID 976 set thread context of 2836 976 RFQ-MNAMR-001RB-WhastsAAp Images.exe Explorer.EXE PID 772 set thread context of 2836 772 systray.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
systray.exedescription ioc process File opened for modification C:\Program Files (x86)\Bgrxd-61\bdltlz7ps.exe systray.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
systray.exedescription ioc process Key created \Registry\User\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 systray.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
RFQ-MNAMR-001RB-WhastsAAp Images.exesystray.exepid process 976 RFQ-MNAMR-001RB-WhastsAAp Images.exe 976 RFQ-MNAMR-001RB-WhastsAAp Images.exe 976 RFQ-MNAMR-001RB-WhastsAAp Images.exe 976 RFQ-MNAMR-001RB-WhastsAAp Images.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe 772 systray.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RFQ-MNAMR-001RB-WhastsAAp Images.exesystray.exepid process 976 RFQ-MNAMR-001RB-WhastsAAp Images.exe 976 RFQ-MNAMR-001RB-WhastsAAp Images.exe 976 RFQ-MNAMR-001RB-WhastsAAp Images.exe 772 systray.exe 772 systray.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
RFQ-MNAMR-001RB-WhastsAAp Images.exeRFQ-MNAMR-001RB-WhastsAAp Images.exesystray.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1180 RFQ-MNAMR-001RB-WhastsAAp Images.exe Token: SeDebugPrivilege 976 RFQ-MNAMR-001RB-WhastsAAp Images.exe Token: SeDebugPrivilege 772 systray.exe Token: SeShutdownPrivilege 2836 Explorer.EXE Token: SeCreatePagefilePrivilege 2836 Explorer.EXE Token: SeShutdownPrivilege 2836 Explorer.EXE Token: SeCreatePagefilePrivilege 2836 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RFQ-MNAMR-001RB-WhastsAAp Images.exepid process 1180 RFQ-MNAMR-001RB-WhastsAAp Images.exe 1180 RFQ-MNAMR-001RB-WhastsAAp Images.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2836 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
RFQ-MNAMR-001RB-WhastsAAp Images.exeExplorer.EXEsystray.exedescription pid process target process PID 1180 wrote to memory of 3476 1180 RFQ-MNAMR-001RB-WhastsAAp Images.exe schtasks.exe PID 1180 wrote to memory of 3476 1180 RFQ-MNAMR-001RB-WhastsAAp Images.exe schtasks.exe PID 1180 wrote to memory of 3476 1180 RFQ-MNAMR-001RB-WhastsAAp Images.exe schtasks.exe PID 1180 wrote to memory of 976 1180 RFQ-MNAMR-001RB-WhastsAAp Images.exe RFQ-MNAMR-001RB-WhastsAAp Images.exe PID 1180 wrote to memory of 976 1180 RFQ-MNAMR-001RB-WhastsAAp Images.exe RFQ-MNAMR-001RB-WhastsAAp Images.exe PID 1180 wrote to memory of 976 1180 RFQ-MNAMR-001RB-WhastsAAp Images.exe RFQ-MNAMR-001RB-WhastsAAp Images.exe PID 1180 wrote to memory of 976 1180 RFQ-MNAMR-001RB-WhastsAAp Images.exe RFQ-MNAMR-001RB-WhastsAAp Images.exe PID 1180 wrote to memory of 976 1180 RFQ-MNAMR-001RB-WhastsAAp Images.exe RFQ-MNAMR-001RB-WhastsAAp Images.exe PID 1180 wrote to memory of 976 1180 RFQ-MNAMR-001RB-WhastsAAp Images.exe RFQ-MNAMR-001RB-WhastsAAp Images.exe PID 2836 wrote to memory of 772 2836 Explorer.EXE systray.exe PID 2836 wrote to memory of 772 2836 Explorer.EXE systray.exe PID 2836 wrote to memory of 772 2836 Explorer.EXE systray.exe PID 772 wrote to memory of 3868 772 systray.exe cmd.exe PID 772 wrote to memory of 3868 772 systray.exe cmd.exe PID 772 wrote to memory of 3868 772 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ-MNAMR-001RB-WhastsAAp Images.exe"C:\Users\Admin\AppData\Local\Temp\RFQ-MNAMR-001RB-WhastsAAp Images.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fgySYm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7F86.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\RFQ-MNAMR-001RB-WhastsAAp Images.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ-MNAMR-001RB-WhastsAAp Images.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp7F86.tmpMD5
c9fca7ef75b2da26b9afbd8db51e91ce
SHA1ef87bb5e629e3694aae383ee7e4492005fcf1797
SHA256d4594e8efccdbd873d9fa9a9fbcba2b2c583a55e7c476cf24264acd32652e6fb
SHA5121b0ee511434c6db866e899b5ee2a2522f36f39a15aa4376d0de12e58374f25e510b6e0534c4c8e4fd2c35662b5e717cd34aa7e7746307b66ace89be104336c8a
-
C:\Users\Admin\AppData\Roaming\LL2105RU\LL2logim.jpegMD5
d27371f5c45f5641a9fe24cabddf6d63
SHA12759f8a7105e5faba9f0ac59960c88bc80289c07
SHA256bfbe03b1860ab92c7efe786e04ede39bfcaeb5615161ba413462304e724ac6c6
SHA51258a9cfecdcb41c47528ac87d5b8bf458342b461c83ebc35bde64e2e1abb8b578394921f7ca087415b9eb4a3d2c159a2e788e241d78a1b866a713b577071805b1
-
C:\Users\Admin\AppData\Roaming\LL2105RU\LL2logri.iniMD5
d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\LL2105RU\LL2logrv.iniMD5
bbc41c78bae6c71e63cb544a6a284d94
SHA133f2c1d9fa0e9c99b80bc2500621e95af38b1f9a
SHA256ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb
SHA5120aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4
-
memory/772-8-0x0000000000000000-mapping.dmp
-
memory/772-9-0x00000000012A0000-0x00000000012A6000-memory.dmpFilesize
24KB
-
memory/772-10-0x00000000012A0000-0x00000000012A6000-memory.dmpFilesize
24KB
-
memory/772-12-0x00000000061E0000-0x0000000006319000-memory.dmpFilesize
1.2MB
-
memory/976-5-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/976-6-0x000000000041B6F0-mapping.dmp
-
memory/3476-3-0x0000000000000000-mapping.dmp
-
memory/3868-11-0x0000000000000000-mapping.dmp