Analysis
- max time kernel
150s - max time network
126s - platform
windows7_x64 - resource
win7v20201028 - submitted
03/12/2020, 14:33
Static task
static1
Behavioral task
behavioral1
Sample
ef7a4266f7bddf855d86e5431268e182.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target ef7a4266f7bddf855d86e5431268e182.exe
- Size 396KB
- Sample201203-3a148calrn
- SHA256 90ce350a15e0ca0d408b4b8744e51e7c87b6962eee67f1aca9bfb167ddb5106e
- MD5 ef7a4266f7bddf855d86e5431268e182
- SHA1 ce9ac083d9310cd62dcb4d94d948acc0bbdd206f
- SHA512 473a70306db70bcb8bd0d1da70663fc2feb2043732b866031e91b284526bfed01cf5b73ba69a7d15a337f9289117282bac383e9d6e1fb259abd1216cbda17250
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.fuentenebro.wine/ugk/
Decoy
-
okaytoreopen.com
-
landscaperestorationtn.com
-
activ8.pro
-
funhomedecor.info
-
856379727.xyz
-
universoavenue.com
-
hnxinghong.com
-
ministryfornutrition.com
-
brettjcole.com
-
allcleanwindowcleaners.com
-
areftec.com
-
danjsiemon.com
-
pradopneuserodas.com
-
thuduccity.net
-
janiruk.com
-
010-beijing.com
-
for-the-love-of-film.com
-
zje6wc48g.xyz
-
friarventures.com
-
aminabwaxing.com
-
siobekym.com
-
bunsekihyo.net
-
sansoomaster.com
-
togetherun.net
-
karlarobledo.com
-
rafflemeup.com
-
phillipsmarinegroup.com
-
drycreekwineryforsale.com
-
detestmediocrity.net
-
stither.com
-
ffzye.com
-
gmcentrocomercial.com
-
ddlplay0016.xyz
-
jhxhotei.com
-
avinashgarden.com
-
fototinte.com
-
accompanyhealing.com
-
jwg.xyz
-
tongkhothoitrang.com
-
grupovrv.com
-
d100productions.com
-
nanigators.com
-
sunapple.net
-
stuartcampbelltt.com
-
skyzonesterling.com
-
pulaofactory.com
-
morebankablesession.com
-
californiapoolloans.com
-
artbyjosh.com
-
digstee.com
-
rootcauseresolutionrx.com
-
katetrips.com
-
bloodygoodbooks.com
-
blacklumberjack.mobi
-
venframe.com
-
warmandwonderfulknitwear.com
-
people-search.pro
-
calmpicture.guru
-
e3330.xyz
-
maribelhome.com
-
forenvid.com
-
medicostoday.com
-
groovette.com
-
evakinga.net
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral1/memory/1208-7-0x00000000007B0000-0x00000000007DE000-memory.dmp formbook behavioral1/memory/1852-8-0x0000000000000000-mapping.dmp formbook behavioral1/memory/2012-9-0x0000000000000000-mapping.dmp formbook - Loads dropped DLL 1 IoCs
pid Process 1208 rundll32.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1852 set thread context of 1260 1852 cmd.exe 13 PID 1852 set thread context of 1260 1852 cmd.exe 13 PID 2012 set thread context of 1260 2012 NAPSTAT.EXE 13 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 1208 rundll32.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 2012 NAPSTAT.EXE 2012 NAPSTAT.EXE 2012 NAPSTAT.EXE 2012 NAPSTAT.EXE 2012 NAPSTAT.EXE 2012 NAPSTAT.EXE 2012 NAPSTAT.EXE 2012 NAPSTAT.EXE 2012 NAPSTAT.EXE 2012 NAPSTAT.EXE 2012 NAPSTAT.EXE 2012 NAPSTAT.EXE 2012 NAPSTAT.EXE 2012 NAPSTAT.EXE 2012 NAPSTAT.EXE 2012 NAPSTAT.EXE 2012 NAPSTAT.EXE 2012 NAPSTAT.EXE 2012 NAPSTAT.EXE 2012 NAPSTAT.EXE 2012 NAPSTAT.EXE 2012 NAPSTAT.EXE - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1208 rundll32.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 2012 NAPSTAT.EXE 2012 NAPSTAT.EXE - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1852 cmd.exe Token: SeDebugPrivilege 2012 NAPSTAT.EXE - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE - Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 1424 wrote to memory of 1208 1424 ef7a4266f7bddf855d86e5431268e182.exe 26 PID 1424 wrote to memory of 1208 1424 ef7a4266f7bddf855d86e5431268e182.exe 26 PID 1424 wrote to memory of 1208 1424 ef7a4266f7bddf855d86e5431268e182.exe 26 PID 1424 wrote to memory of 1208 1424 ef7a4266f7bddf855d86e5431268e182.exe 26 PID 1424 wrote to memory of 1208 1424 ef7a4266f7bddf855d86e5431268e182.exe 26 PID 1424 wrote to memory of 1208 1424 ef7a4266f7bddf855d86e5431268e182.exe 26 PID 1424 wrote to memory of 1208 1424 ef7a4266f7bddf855d86e5431268e182.exe 26 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1208 wrote to memory of 1852 1208 rundll32.exe 30 PID 1260 wrote to memory of 2012 1260 Explorer.EXE 31 PID 1260 wrote to memory of 2012 1260 Explorer.EXE 31 PID 1260 wrote to memory of 2012 1260 Explorer.EXE 31 PID 1260 wrote to memory of 2012 1260 Explorer.EXE 31 PID 2012 wrote to memory of 1224 2012 NAPSTAT.EXE 32 PID 2012 wrote to memory of 1224 2012 NAPSTAT.EXE 32 PID 2012 wrote to memory of 1224 2012 NAPSTAT.EXE 32 PID 2012 wrote to memory of 1224 2012 NAPSTAT.EXE 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\ef7a4266f7bddf855d86e5431268e182.exe"C:\Users\Admin\AppData\Local\Temp\ef7a4266f7bddf855d86e5431268e182.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe CyborgAncon,Spinny3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1852
-
-
-
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"3⤵PID:1224
-
-