Analysis
- max time kernel
147s - max time network
150s - platform
windows10_x64 - resource
win10v20201028 - submitted
04/12/2020, 21:15
Static task
static1
Behavioral task
behavioral1
Sample
SKY POUNDS.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target SKY POUNDS.exe
- Size 30KB
- Sample201204-2lrf6n3w6e
- SHA256 2919a5d96ade5e0f2967d98a7b49b1f612435ed6a6b3843424a8c1e99ea0e9ab
- MD5 a803f4d55bdc06aee301ff972ea06b05
- SHA1 8cc8b7f9772637fb0d6df77423ae833e66587cc0
- SHA512 f7152faf2f9aeaed417b0f38dc7bb9b8dad50002c56e455b64654bfeb984ebe94c19541fd673e08b6954960958ac7b476eb5a9ed38524278ef87653d8df855e7
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.runwithit.media/bu43/
Decoy
-
bearrootstherapy.com
-
odmpay.com
-
johnfornmgov.com
-
astrodhaam.com
-
pumavps.com
-
empireconstructiontx.com
-
theboujeestop.com
-
indictthem.com
-
plantationbarnof1810.com
-
nsxs.xyz
-
lgshowroom.com
-
allinlifestyle.club
-
ik-com.net
-
saitamacity-sports.com
-
neuromuscularmassagetherapy.com
-
freespiritnutrition.com
-
alexanderhamilton.computer
-
happysay.co.uk
-
nndesignpr.com
-
lightweightmouldings.com
-
sparkassen-oekosystem.finance
-
majestikflix.com
-
xbox360vpn.com
-
rivareservadapraca.com
-
waldherr.one
-
soluzionigare.com
-
personalizedsportsz.com
-
mycapecrusade.com
-
escrapedia.com
-
defineliberal.net
-
xn--54qt7bmzf8pw82mnmogwd.com
-
cookies-x.info
-
38buu.com
-
nirv.tech
-
isabellelodo.com
-
myquickmedia.com
-
luxuryevim.net
-
kimmycakesmore.com
-
akasyaofistasima.com
-
markhatesfreedom.com
-
stock-ology.com
-
opel-occasions-ales.com
-
lunajurado.com
-
musmarservices.com
-
editionsfeuvert.com
-
mizusukenikko.com
-
coaching-dreams.com
-
bentleyandraesdecorandmore.com
-
mr-mrsramirez.com
-
junarmusic.com
-
jesed72.com
-
serviceelectriccablevision1.com
-
e-capakistan.com
-
thedentalplanner.com
-
mohasaffron.com
-
tciclinics.info
-
rockinrranchpuntademita.com
-
gubbelspaprika.com
-
citizenspride.com
-
compprogedu.com
-
prierejanaza.com
-
toyotamotor360.com
-
academiadosaberdagrios.com
-
burakcelikkapi.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/508-12-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/508-13-0x000000000041D0B0-mapping.dmp formbook behavioral2/memory/3200-16-0x0000000000000000-mapping.dmp formbook - Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
pid Process 2604 SKY POUNDS.exe 2604 SKY POUNDS.exe 2604 SKY POUNDS.exe 2604 SKY POUNDS.exe 2604 SKY POUNDS.exe 2604 SKY POUNDS.exe 2604 SKY POUNDS.exe 2604 SKY POUNDS.exe 2604 SKY POUNDS.exe 2604 SKY POUNDS.exe 2604 SKY POUNDS.exe 2604 SKY POUNDS.exe 2604 SKY POUNDS.exe 2604 SKY POUNDS.exe 2604 SKY POUNDS.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2604 set thread context of 508 2604 SKY POUNDS.exe 80 PID 508 set thread context of 2828 508 SKY POUNDS.exe 56 PID 3200 set thread context of 2828 3200 help.exe 56 - Program crash 1 IoCs
pid pid_target Process procid_target 1124 2604 WerFault.exe 67 - Delays execution with timeout.exe 1 IoCs
pid Process 2684 timeout.exe - Suspicious behavior: EnumeratesProcesses 76 IoCs
pid Process 2604 SKY POUNDS.exe 2604 SKY POUNDS.exe 2604 SKY POUNDS.exe 508 SKY POUNDS.exe 508 SKY POUNDS.exe 508 SKY POUNDS.exe 508 SKY POUNDS.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 1124 WerFault.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe 3200 help.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 508 SKY POUNDS.exe 508 SKY POUNDS.exe 508 SKY POUNDS.exe 3200 help.exe 3200 help.exe - Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 2604 SKY POUNDS.exe Token: SeDebugPrivilege 508 SKY POUNDS.exe Token: SeRestorePrivilege 1124 WerFault.exe Token: SeBackupPrivilege 1124 WerFault.exe Token: SeDebugPrivilege 1124 WerFault.exe Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeDebugPrivilege 3200 help.exe Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2604 wrote to memory of 4052 2604 SKY POUNDS.exe 75 PID 2604 wrote to memory of 4052 2604 SKY POUNDS.exe 75 PID 2604 wrote to memory of 4052 2604 SKY POUNDS.exe 75 PID 4052 wrote to memory of 2684 4052 cmd.exe 77 PID 4052 wrote to memory of 2684 4052 cmd.exe 77 PID 4052 wrote to memory of 2684 4052 cmd.exe 77 PID 2604 wrote to memory of 508 2604 SKY POUNDS.exe 80 PID 2604 wrote to memory of 508 2604 SKY POUNDS.exe 80 PID 2604 wrote to memory of 508 2604 SKY POUNDS.exe 80 PID 2604 wrote to memory of 508 2604 SKY POUNDS.exe 80 PID 2604 wrote to memory of 508 2604 SKY POUNDS.exe 80 PID 2604 wrote to memory of 508 2604 SKY POUNDS.exe 80 PID 2604 wrote to memory of 508 2604 SKY POUNDS.exe 80 PID 2828 wrote to memory of 3200 2828 Explorer.EXE 84 PID 2828 wrote to memory of 3200 2828 Explorer.EXE 84 PID 2828 wrote to memory of 3200 2828 Explorer.EXE 84 PID 3200 wrote to memory of 2696 3200 help.exe 85 PID 3200 wrote to memory of 2696 3200 help.exe 85 PID 3200 wrote to memory of 2696 3200 help.exe 85
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\SKY POUNDS.exe"C:\Users\Admin\AppData\Local\Temp\SKY POUNDS.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 4.3693⤵
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\SysWOW64\timeout.exetimeout 4.3694⤵
- Delays execution with timeout.exe
PID:2684
-
-
-
C:\Users\Admin\AppData\Local\Temp\SKY POUNDS.exe"C:\Users\Admin\AppData\Local\Temp\SKY POUNDS.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:508
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 20723⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1124
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SKY POUNDS.exe"3⤵PID:2696
-
-