Analysis
-
max time kernel
145s -
max time network
130s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
20-11-2020 18:46
Static task
static1
Behavioral task
behavioral1
Sample
bb30a5dd4130b071fb4ca5f005371c63.exe
Resource
win7v20201028
General
-
Target
bb30a5dd4130b071fb4ca5f005371c63.exe
-
Size
694KB
-
MD5
bb30a5dd4130b071fb4ca5f005371c63
-
SHA1
52c3ca02828a4ad8e8dbf790a61b3d77379ad391
-
SHA256
4c73fd4286e76a094eefafe5369f3a184ca4a38d567ae6dfad61645bf968a83f
-
SHA512
062f184dea6b1327418b7030b114cc40bf21072408fb9408bc18b823bce73534cf513a566ef16f90c0379581fb9e189d8d39614334c04c1607afbc02089ac0d1
Malware Config
Extracted
formbook
http://www.digitalcashteam.com/glt/
blingenterprises.net
opalthemovie.com
auctionpros.club
simplyfluffy.com
nanbuild.net
1extrafast.com
active-connector.xyz
ocewnbank.com
zekmer.com
6755e.com
ryry-s1.com
pastrami.house
shivamall.com
activateportusaludybelleza.com
homeprosrva.com
tessuto.net
christopherspecht.com
ti-an-dossen.com
universe.icu
healthmixtt.com
tipsrated.com
findoffline.com
we11studio.com
rbnfnleoba.club
oghomeinfoa6.club
lgdmotor.com
zhiyoubin.com
fapemlogisticsc.com
santoshafacemasks.com
zettrackgpstracker.com
blogtalkraio.com
procyon.design
myvirtualmision.com
bamnlife.love
msksoft.net
outrage-lefilm.com
singlepebbles.com
straightaheadflixgroup.com
everychildnisanartist.com
collagenika.com
biohazardmethcleanup.com
ftehfb.com
europeic.com
themaskedstitcher.com
edxar.xyz
yenciaceves.com
show-jumps.com
creatincountries.com
tripleedelights.com
zuriadesign.com
mcjuirisit.com
reem.pro
sgbanfang.com
ally-app.com
organizationfun.net
findingthefaceofgod.com
barbellsandbarns.com
cttmall.com
s-f.club
magnoliamamas.com
kalkulatorweb.com
dearsropes.store
paytofindmebro.cheap
auykypznj.club
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2896-12-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2896-13-0x000000000041EAE0-mapping.dmp formbook behavioral2/memory/2292-14-0x0000000000000000-mapping.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
bb30a5dd4130b071fb4ca5f005371c63.exeRegSvcs.execmmon32.exedescription pid process target process PID 2484 set thread context of 2896 2484 bb30a5dd4130b071fb4ca5f005371c63.exe RegSvcs.exe PID 2896 set thread context of 2876 2896 RegSvcs.exe Explorer.EXE PID 2292 set thread context of 2876 2292 cmmon32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 41 IoCs
Processes:
bb30a5dd4130b071fb4ca5f005371c63.exeRegSvcs.execmmon32.exepid process 2484 bb30a5dd4130b071fb4ca5f005371c63.exe 2484 bb30a5dd4130b071fb4ca5f005371c63.exe 2484 bb30a5dd4130b071fb4ca5f005371c63.exe 2896 RegSvcs.exe 2896 RegSvcs.exe 2896 RegSvcs.exe 2896 RegSvcs.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe 2292 cmmon32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.execmmon32.exepid process 2896 RegSvcs.exe 2896 RegSvcs.exe 2896 RegSvcs.exe 2292 cmmon32.exe 2292 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
bb30a5dd4130b071fb4ca5f005371c63.exeRegSvcs.execmmon32.exedescription pid process Token: SeDebugPrivilege 2484 bb30a5dd4130b071fb4ca5f005371c63.exe Token: SeDebugPrivilege 2896 RegSvcs.exe Token: SeDebugPrivilege 2292 cmmon32.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2876 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
bb30a5dd4130b071fb4ca5f005371c63.exeExplorer.EXEcmmon32.exedescription pid process target process PID 2484 wrote to memory of 2892 2484 bb30a5dd4130b071fb4ca5f005371c63.exe RegSvcs.exe PID 2484 wrote to memory of 2892 2484 bb30a5dd4130b071fb4ca5f005371c63.exe RegSvcs.exe PID 2484 wrote to memory of 2892 2484 bb30a5dd4130b071fb4ca5f005371c63.exe RegSvcs.exe PID 2484 wrote to memory of 2896 2484 bb30a5dd4130b071fb4ca5f005371c63.exe RegSvcs.exe PID 2484 wrote to memory of 2896 2484 bb30a5dd4130b071fb4ca5f005371c63.exe RegSvcs.exe PID 2484 wrote to memory of 2896 2484 bb30a5dd4130b071fb4ca5f005371c63.exe RegSvcs.exe PID 2484 wrote to memory of 2896 2484 bb30a5dd4130b071fb4ca5f005371c63.exe RegSvcs.exe PID 2484 wrote to memory of 2896 2484 bb30a5dd4130b071fb4ca5f005371c63.exe RegSvcs.exe PID 2484 wrote to memory of 2896 2484 bb30a5dd4130b071fb4ca5f005371c63.exe RegSvcs.exe PID 2876 wrote to memory of 2292 2876 Explorer.EXE cmmon32.exe PID 2876 wrote to memory of 2292 2876 Explorer.EXE cmmon32.exe PID 2876 wrote to memory of 2292 2876 Explorer.EXE cmmon32.exe PID 2292 wrote to memory of 1532 2292 cmmon32.exe cmd.exe PID 2292 wrote to memory of 1532 2292 cmmon32.exe cmd.exe PID 2292 wrote to memory of 1532 2292 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bb30a5dd4130b071fb4ca5f005371c63.exe"C:\Users\Admin\AppData\Local\Temp\bb30a5dd4130b071fb4ca5f005371c63.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1532-17-0x0000000000000000-mapping.dmp
-
memory/2292-14-0x0000000000000000-mapping.dmp
-
memory/2292-18-0x0000000004100000-0x00000000041B3000-memory.dmpFilesize
716KB
-
memory/2292-16-0x0000000000990000-0x000000000099C000-memory.dmpFilesize
48KB
-
memory/2292-15-0x0000000000990000-0x000000000099C000-memory.dmpFilesize
48KB
-
memory/2484-9-0x0000000006380000-0x00000000063E5000-memory.dmpFilesize
404KB
-
memory/2484-7-0x00000000057C0000-0x00000000057C1000-memory.dmpFilesize
4KB
-
memory/2484-8-0x0000000005790000-0x00000000057A4000-memory.dmpFilesize
80KB
-
memory/2484-0-0x0000000073D40000-0x000000007442E000-memory.dmpFilesize
6.9MB
-
memory/2484-10-0x0000000005A60000-0x0000000005A66000-memory.dmpFilesize
24KB
-
memory/2484-11-0x00000000063F0000-0x0000000006420000-memory.dmpFilesize
192KB
-
memory/2484-6-0x0000000005570000-0x0000000005571000-memory.dmpFilesize
4KB
-
memory/2484-5-0x0000000005630000-0x0000000005631000-memory.dmpFilesize
4KB
-
memory/2484-4-0x0000000005A90000-0x0000000005A91000-memory.dmpFilesize
4KB
-
memory/2484-3-0x00000000054C0000-0x00000000054C1000-memory.dmpFilesize
4KB
-
memory/2484-1-0x0000000000C00000-0x0000000000C01000-memory.dmpFilesize
4KB
-
memory/2896-12-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2896-13-0x000000000041EAE0-mapping.dmp