Analysis
-
max time kernel
149s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
20-11-2020 18:46
Static task
static1
Behavioral task
behavioral1
Sample
bb30a5dd4130b071fb4ca5f005371c63.exe
Resource
win7v20201028
General
-
Target
bb30a5dd4130b071fb4ca5f005371c63.exe
-
Size
694KB
-
MD5
bb30a5dd4130b071fb4ca5f005371c63
-
SHA1
52c3ca02828a4ad8e8dbf790a61b3d77379ad391
-
SHA256
4c73fd4286e76a094eefafe5369f3a184ca4a38d567ae6dfad61645bf968a83f
-
SHA512
062f184dea6b1327418b7030b114cc40bf21072408fb9408bc18b823bce73534cf513a566ef16f90c0379581fb9e189d8d39614334c04c1607afbc02089ac0d1
Malware Config
Extracted
formbook
http://www.digitalcashteam.com/glt/
blingenterprises.net
opalthemovie.com
auctionpros.club
simplyfluffy.com
nanbuild.net
1extrafast.com
active-connector.xyz
ocewnbank.com
zekmer.com
6755e.com
ryry-s1.com
pastrami.house
shivamall.com
activateportusaludybelleza.com
homeprosrva.com
tessuto.net
christopherspecht.com
ti-an-dossen.com
universe.icu
healthmixtt.com
tipsrated.com
findoffline.com
we11studio.com
rbnfnleoba.club
oghomeinfoa6.club
lgdmotor.com
zhiyoubin.com
fapemlogisticsc.com
santoshafacemasks.com
zettrackgpstracker.com
blogtalkraio.com
procyon.design
myvirtualmision.com
bamnlife.love
msksoft.net
outrage-lefilm.com
singlepebbles.com
straightaheadflixgroup.com
everychildnisanartist.com
collagenika.com
biohazardmethcleanup.com
ftehfb.com
europeic.com
themaskedstitcher.com
edxar.xyz
yenciaceves.com
show-jumps.com
creatincountries.com
tripleedelights.com
zuriadesign.com
mcjuirisit.com
reem.pro
sgbanfang.com
ally-app.com
organizationfun.net
findingthefaceofgod.com
barbellsandbarns.com
cttmall.com
s-f.club
magnoliamamas.com
kalkulatorweb.com
dearsropes.store
paytofindmebro.cheap
auykypznj.club
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1664-7-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1664-8-0x000000000041EAE0-mapping.dmp formbook behavioral1/memory/2008-9-0x0000000000000000-mapping.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
bb30a5dd4130b071fb4ca5f005371c63.exeRegSvcs.exehelp.exedescription pid process target process PID 2036 set thread context of 1664 2036 bb30a5dd4130b071fb4ca5f005371c63.exe RegSvcs.exe PID 1664 set thread context of 1252 1664 RegSvcs.exe Explorer.EXE PID 2008 set thread context of 1252 2008 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
bb30a5dd4130b071fb4ca5f005371c63.exeRegSvcs.exehelp.exepid process 2036 bb30a5dd4130b071fb4ca5f005371c63.exe 1664 RegSvcs.exe 1664 RegSvcs.exe 2008 help.exe 2008 help.exe 2008 help.exe 2008 help.exe 2008 help.exe 2008 help.exe 2008 help.exe 2008 help.exe 2008 help.exe 2008 help.exe 2008 help.exe 2008 help.exe 2008 help.exe 2008 help.exe 2008 help.exe 2008 help.exe 2008 help.exe 2008 help.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exehelp.exepid process 1664 RegSvcs.exe 1664 RegSvcs.exe 1664 RegSvcs.exe 2008 help.exe 2008 help.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
bb30a5dd4130b071fb4ca5f005371c63.exeRegSvcs.exehelp.exedescription pid process Token: SeDebugPrivilege 2036 bb30a5dd4130b071fb4ca5f005371c63.exe Token: SeDebugPrivilege 1664 RegSvcs.exe Token: SeDebugPrivilege 2008 help.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
bb30a5dd4130b071fb4ca5f005371c63.exeExplorer.EXEhelp.exedescription pid process target process PID 2036 wrote to memory of 1664 2036 bb30a5dd4130b071fb4ca5f005371c63.exe RegSvcs.exe PID 2036 wrote to memory of 1664 2036 bb30a5dd4130b071fb4ca5f005371c63.exe RegSvcs.exe PID 2036 wrote to memory of 1664 2036 bb30a5dd4130b071fb4ca5f005371c63.exe RegSvcs.exe PID 2036 wrote to memory of 1664 2036 bb30a5dd4130b071fb4ca5f005371c63.exe RegSvcs.exe PID 2036 wrote to memory of 1664 2036 bb30a5dd4130b071fb4ca5f005371c63.exe RegSvcs.exe PID 2036 wrote to memory of 1664 2036 bb30a5dd4130b071fb4ca5f005371c63.exe RegSvcs.exe PID 2036 wrote to memory of 1664 2036 bb30a5dd4130b071fb4ca5f005371c63.exe RegSvcs.exe PID 2036 wrote to memory of 1664 2036 bb30a5dd4130b071fb4ca5f005371c63.exe RegSvcs.exe PID 2036 wrote to memory of 1664 2036 bb30a5dd4130b071fb4ca5f005371c63.exe RegSvcs.exe PID 2036 wrote to memory of 1664 2036 bb30a5dd4130b071fb4ca5f005371c63.exe RegSvcs.exe PID 1252 wrote to memory of 2008 1252 Explorer.EXE help.exe PID 1252 wrote to memory of 2008 1252 Explorer.EXE help.exe PID 1252 wrote to memory of 2008 1252 Explorer.EXE help.exe PID 1252 wrote to memory of 2008 1252 Explorer.EXE help.exe PID 2008 wrote to memory of 436 2008 help.exe cmd.exe PID 2008 wrote to memory of 436 2008 help.exe cmd.exe PID 2008 wrote to memory of 436 2008 help.exe cmd.exe PID 2008 wrote to memory of 436 2008 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bb30a5dd4130b071fb4ca5f005371c63.exe"C:\Users\Admin\AppData\Local\Temp\bb30a5dd4130b071fb4ca5f005371c63.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/436-11-0x0000000000000000-mapping.dmp
-
memory/1664-7-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1664-8-0x000000000041EAE0-mapping.dmp
-
memory/2008-9-0x0000000000000000-mapping.dmp
-
memory/2008-10-0x0000000000870000-0x0000000000876000-memory.dmpFilesize
24KB
-
memory/2008-12-0x0000000001760000-0x00000000018D2000-memory.dmpFilesize
1.4MB
-
memory/2036-0-0x0000000074EE0000-0x00000000755CE000-memory.dmpFilesize
6.9MB
-
memory/2036-1-0x0000000000BB0000-0x0000000000BB1000-memory.dmpFilesize
4KB
-
memory/2036-3-0x0000000000210000-0x0000000000224000-memory.dmpFilesize
80KB
-
memory/2036-4-0x0000000004E00000-0x0000000004E65000-memory.dmpFilesize
404KB
-
memory/2036-5-0x0000000000520000-0x0000000000526000-memory.dmpFilesize
24KB
-
memory/2036-6-0x0000000000B10000-0x0000000000B40000-memory.dmpFilesize
192KB