Analysis
-
max time kernel
148s -
max time network
14s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
26-11-2020 06:45
Static task
static1
Behavioral task
behavioral1
Sample
PO# 4415902670.exe
Resource
win7v20201028
General
-
Target
PO# 4415902670.exe
-
Size
542KB
-
MD5
058e6f06a51e22bbc975eecf35c34844
-
SHA1
638f4727a99bb389e8e6a77c4fbee17bdc19fc60
-
SHA256
ad644da69f848609475d2a3d773eadf646d4c1e1cb20e4b87422d224e2ccbe32
-
SHA512
0b04ed15c05b5c5791c8cc5478219e82e9f5def8d9d4f445ef03f3b39a8a76b7e28e7312914624c35b578a74927230e5e0f52c2039cd45db0047da255e15669e
Malware Config
Extracted
formbook
http://www.klingenwacht.com/mlg/
xintianpx.com
chrispsheehan.com
sensationallyot.com
veloceda.com
fanoosbattery.com
wenda7.com
cultivatecultura.com
mersinci.com
makeupbrushhes.com
vptexpediters.com
hispoemin.com
mikeshouseofathousandlegs.com
dealclosersplayback.com
knightdalesleeps.com
1uprealestate.com
showeraccessory.com
perthpanelbeaters.com
novergi.com
directmultiservice.com
mi-miftahurrohmah.com
thiswordpress.com
5gtelephonics.com
laprude.com
iyojuzn.com
delibroysusoficios.com
waterloowools.com
cleva21travels.com
origogin.com
packalunchandbreakfasttoo.com
zeusorg.com
icyblossom.com
mhs1.online
heatherseeds.com
dulichdanang365.com
thtattoo.com
rethinkingusers.com
pornumb.com
accountrestorer.com
alohabeautybaracademy.net
shoesiin.com
foxlawgroupus.com
tiempodepartida.com
todoparazurdos.store
virtual-tokyotower.com
masteringrwe.com
katrinehorn-coaching.com
enviroid.com
bienliveryleasing.com
nwflworkcomp.com
pineridgepark-mhp.com
xrecalverk.com
comfortablelifestyle.net
berkeleyreese.com
xperienciasdigitales.online
suzukazerunnadiet.com
healthyguthealthyhorse.com
arappbuilder.com
newyorksustainability.com
adaptiveetfs.com
peteasmus.com
collegecheergear.com
cdesign.digital
sonicetalon.com
espidargym.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2036-6-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/2036-7-0x000000000041EB50-mapping.dmp formbook behavioral1/memory/1372-8-0x0000000000000000-mapping.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO# 4415902670.exemscorsvw.exemsdt.exedescription pid process target process PID 1764 set thread context of 2036 1764 PO# 4415902670.exe mscorsvw.exe PID 2036 set thread context of 1212 2036 mscorsvw.exe Explorer.EXE PID 1372 set thread context of 1212 1372 msdt.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
mscorsvw.exemsdt.exepid process 2036 mscorsvw.exe 2036 mscorsvw.exe 1372 msdt.exe 1372 msdt.exe 1372 msdt.exe 1372 msdt.exe 1372 msdt.exe 1372 msdt.exe 1372 msdt.exe 1372 msdt.exe 1372 msdt.exe 1372 msdt.exe 1372 msdt.exe 1372 msdt.exe 1372 msdt.exe 1372 msdt.exe 1372 msdt.exe 1372 msdt.exe 1372 msdt.exe 1372 msdt.exe 1372 msdt.exe 1372 msdt.exe 1372 msdt.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
mscorsvw.exemsdt.exepid process 2036 mscorsvw.exe 2036 mscorsvw.exe 2036 mscorsvw.exe 1372 msdt.exe 1372 msdt.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PO# 4415902670.exemscorsvw.exemsdt.exedescription pid process Token: SeDebugPrivilege 1764 PO# 4415902670.exe Token: SeDebugPrivilege 2036 mscorsvw.exe Token: SeDebugPrivilege 1372 msdt.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
PO# 4415902670.exeExplorer.EXEmsdt.exedescription pid process target process PID 1764 wrote to memory of 2036 1764 PO# 4415902670.exe mscorsvw.exe PID 1764 wrote to memory of 2036 1764 PO# 4415902670.exe mscorsvw.exe PID 1764 wrote to memory of 2036 1764 PO# 4415902670.exe mscorsvw.exe PID 1764 wrote to memory of 2036 1764 PO# 4415902670.exe mscorsvw.exe PID 1764 wrote to memory of 2036 1764 PO# 4415902670.exe mscorsvw.exe PID 1764 wrote to memory of 2036 1764 PO# 4415902670.exe mscorsvw.exe PID 1764 wrote to memory of 2036 1764 PO# 4415902670.exe mscorsvw.exe PID 1212 wrote to memory of 1372 1212 Explorer.EXE msdt.exe PID 1212 wrote to memory of 1372 1212 Explorer.EXE msdt.exe PID 1212 wrote to memory of 1372 1212 Explorer.EXE msdt.exe PID 1212 wrote to memory of 1372 1212 Explorer.EXE msdt.exe PID 1372 wrote to memory of 1456 1372 msdt.exe cmd.exe PID 1372 wrote to memory of 1456 1372 msdt.exe cmd.exe PID 1372 wrote to memory of 1456 1372 msdt.exe cmd.exe PID 1372 wrote to memory of 1456 1372 msdt.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO# 4415902670.exe"C:\Users\Admin\AppData\Local\Temp\PO# 4415902670.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1372-8-0x0000000000000000-mapping.dmp
-
memory/1372-9-0x00000000004D0000-0x00000000005C4000-memory.dmpFilesize
976KB
-
memory/1372-11-0x0000000003280000-0x000000000337C000-memory.dmpFilesize
1008KB
-
memory/1456-10-0x0000000000000000-mapping.dmp
-
memory/1764-0-0x0000000074DD0000-0x00000000754BE000-memory.dmpFilesize
6.9MB
-
memory/1764-1-0x0000000000E80000-0x0000000000E81000-memory.dmpFilesize
4KB
-
memory/1764-3-0x0000000000200000-0x0000000000217000-memory.dmpFilesize
92KB
-
memory/1764-4-0x0000000000490000-0x00000000004AF000-memory.dmpFilesize
124KB
-
memory/1764-5-0x00000000005B0000-0x00000000005BA000-memory.dmpFilesize
40KB
-
memory/2036-6-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2036-7-0x000000000041EB50-mapping.dmp