Analysis
- max time kernel
149s - max time network
147s - platform
windows10_x64 - resource
win10v20201028 - submitted
03/12/2020, 14:33
Static task
static1
Behavioral task
behavioral1
Sample
ef7a4266f7bddf855d86e5431268e182.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target ef7a4266f7bddf855d86e5431268e182.exe
- Size 396KB
- Sample201203-3a148calrn
- SHA256 90ce350a15e0ca0d408b4b8744e51e7c87b6962eee67f1aca9bfb167ddb5106e
- MD5 ef7a4266f7bddf855d86e5431268e182
- SHA1 ce9ac083d9310cd62dcb4d94d948acc0bbdd206f
- SHA512 473a70306db70bcb8bd0d1da70663fc2feb2043732b866031e91b284526bfed01cf5b73ba69a7d15a337f9289117282bac383e9d6e1fb259abd1216cbda17250
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.fuentenebro.wine/ugk/
Decoy
-
okaytoreopen.com
-
landscaperestorationtn.com
-
activ8.pro
-
funhomedecor.info
-
856379727.xyz
-
universoavenue.com
-
hnxinghong.com
-
ministryfornutrition.com
-
brettjcole.com
-
allcleanwindowcleaners.com
-
areftec.com
-
danjsiemon.com
-
pradopneuserodas.com
-
thuduccity.net
-
janiruk.com
-
010-beijing.com
-
for-the-love-of-film.com
-
zje6wc48g.xyz
-
friarventures.com
-
aminabwaxing.com
-
siobekym.com
-
bunsekihyo.net
-
sansoomaster.com
-
togetherun.net
-
karlarobledo.com
-
rafflemeup.com
-
phillipsmarinegroup.com
-
drycreekwineryforsale.com
-
detestmediocrity.net
-
stither.com
-
ffzye.com
-
gmcentrocomercial.com
-
ddlplay0016.xyz
-
jhxhotei.com
-
avinashgarden.com
-
fototinte.com
-
accompanyhealing.com
-
jwg.xyz
-
tongkhothoitrang.com
-
grupovrv.com
-
d100productions.com
-
nanigators.com
-
sunapple.net
-
stuartcampbelltt.com
-
skyzonesterling.com
-
pulaofactory.com
-
morebankablesession.com
-
californiapoolloans.com
-
artbyjosh.com
-
digstee.com
-
rootcauseresolutionrx.com
-
katetrips.com
-
bloodygoodbooks.com
-
blacklumberjack.mobi
-
venframe.com
-
warmandwonderfulknitwear.com
-
people-search.pro
-
calmpicture.guru
-
e3330.xyz
-
maribelhome.com
-
forenvid.com
-
medicostoday.com
-
groovette.com
-
evakinga.net
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/3104-7-0x0000000004B60000-0x0000000004B8E000-memory.dmp formbook behavioral2/memory/3908-8-0x0000000000000000-mapping.dmp formbook behavioral2/memory/1100-9-0x0000000000000000-mapping.dmp formbook - Loads dropped DLL 1 IoCs
pid Process 3104 rundll32.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3908 set thread context of 2756 3908 cmd.exe 25 PID 1100 set thread context of 2756 1100 control.exe 25 - Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 3104 rundll32.exe 3104 rundll32.exe 3908 cmd.exe 3908 cmd.exe 3908 cmd.exe 3908 cmd.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe 1100 control.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 3104 rundll32.exe 3104 rundll32.exe 3908 cmd.exe 3908 cmd.exe 3908 cmd.exe 1100 control.exe 1100 control.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3908 cmd.exe Token: SeDebugPrivilege 1100 control.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2756 Explorer.EXE - Suspicious use of WriteProcessMemory 93 IoCs
description pid Process procid_target PID 756 wrote to memory of 3104 756 ef7a4266f7bddf855d86e5431268e182.exe 74 PID 756 wrote to memory of 3104 756 ef7a4266f7bddf855d86e5431268e182.exe 74 PID 756 wrote to memory of 3104 756 ef7a4266f7bddf855d86e5431268e182.exe 74 PID 3104 wrote to memory of 2812 3104 rundll32.exe 76 PID 3104 wrote to memory of 2812 3104 rundll32.exe 76 PID 3104 wrote to memory of 2812 3104 rundll32.exe 76 PID 3104 wrote to memory of 2812 3104 rundll32.exe 76 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 3104 wrote to memory of 3908 3104 rundll32.exe 77 PID 2756 wrote to memory of 1100 2756 Explorer.EXE 81 PID 2756 wrote to memory of 1100 2756 Explorer.EXE 81 PID 2756 wrote to memory of 1100 2756 Explorer.EXE 81 PID 1100 wrote to memory of 2116 1100 control.exe 82 PID 1100 wrote to memory of 2116 1100 control.exe 82 PID 1100 wrote to memory of 2116 1100 control.exe 82
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\ef7a4266f7bddf855d86e5431268e182.exe"C:\Users\Admin\AppData\Local\Temp\ef7a4266f7bddf855d86e5431268e182.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe CyborgAncon,Spinny3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:2812
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3908
-
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1100 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"3⤵PID:2116
-
-