Analysis
- max time kernel
146s - max time network
139s - platform
windows10_x64 - resource
win10v20201028 - submitted
14/12/2020, 10:43
Static task
static1
Behavioral task
behavioral1
Sample
DHL DOCS..exe
Resource
win7v20201028
windows7_x64
General
- Target DHL DOCS..exe
- Size 269KB
- Sample201214-2lqljyb2wa
- SHA256 cfa7189e67e325a2893d1b50cb4e6e477e30a012fb462bdf3d19b7e9e4ab8778
- MD5 3b73cdfddb80d14b360df205c210ef28
- SHA1 98ed55d056f5bb421090dac00534769dd1b01fff
- SHA512 4f76c373d265a80793d67d64c84f96277ed665fa6c751ef34df94a5c1a3dacf42459c72383438a6804ad98035395dcb16ceaa83195c439bdc8a0e9839dc621a9
- MD5 SHA1 SHA512
Malware Config
Extracted
-
formbook
-
http://www.newenglandredsox.com/lsa/
-
funeralplansguide.com
-
weilandconstruction.com
-
newbiecasinos.com
-
xyzcomis.com
-
tequilasportfishingteam.com
-
lifesiizebeauty.com
-
consultoriostimbe.com
-
thedoughmad.com
-
lametserlx.com
-
tuchiasobi.com
-
polimarktrade.com
-
indicatormarket.com
-
bizbajar.site
-
toptimesharetalents.com
-
morrobaywindowcleaning.com
-
rare-snare.com
-
dnascreener.com
-
askwhat.space
-
toutsurlebio-nature.com
-
insidetauck.com
-
primesnooker.com
-
huoduola.com
-
pinistat.com
-
silkyrobe.com
-
coinbetgames.com
-
surptalb.xyz
-
dylanfry.com
-
pediapanel.com
-
huangming123.com
-
id-support-verification.com
-
trail.energy
-
writenowpress.com
-
industriousgame.net
-
adventuresofbusiness.com
-
hairperfectionist.com
-
tamilmentor.online
-
gordonswellrv.com
-
bohemiangoddessvibes.com
-
szly9188.com
-
homesellingqueen.com
-
jeffkong95.com
-
thelaundering.com
-
overheadview.com
-
grandslamhandyman.com
-
mammoth4runner.com
-
andrewflora.com
-
wonderpit.com
-
yarus.host
-
transglobeblog.com
-
fearnotsecurity.net
-
meedaz.com
-
arielkowalski.com
-
longhornsfangear.com
-
awakeandaware.today
-
jusimpress.com
-
sbkrecharge.com
-
go4itinternational.com
-
parkonurdrive.com
-
poywuo.com
-
transcriptionworker.com
-
seasonsofsoul.com
-
sorted2020.com
-
umbay.info
-
semisolutionsusa.info
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/3184-2-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3184-3-0x000000000041EBB0-mapping.dmp formbook behavioral2/memory/3188-5-0x0000000000000000-mapping.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 816 set thread context of 3184 816 DHL DOCS..exe 76 PID 3184 set thread context of 3048 3184 DHL DOCS..exe 13 PID 3188 set thread context of 3048 3188 wlanext.exe 13 - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 3184 DHL DOCS..exe 3184 DHL DOCS..exe 3184 DHL DOCS..exe 3184 DHL DOCS..exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe 3188 wlanext.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 816 DHL DOCS..exe 3184 DHL DOCS..exe 3184 DHL DOCS..exe 3184 DHL DOCS..exe 3188 wlanext.exe 3188 wlanext.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 3184 DHL DOCS..exe Token: SeDebugPrivilege 3188 wlanext.exe Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3048 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 816 wrote to memory of 3184 816 DHL DOCS..exe 76 PID 816 wrote to memory of 3184 816 DHL DOCS..exe 76 PID 816 wrote to memory of 3184 816 DHL DOCS..exe 76 PID 816 wrote to memory of 3184 816 DHL DOCS..exe 76 PID 3048 wrote to memory of 3188 3048 Explorer.EXE 77 PID 3048 wrote to memory of 3188 3048 Explorer.EXE 77 PID 3048 wrote to memory of 3188 3048 Explorer.EXE 77 PID 3188 wrote to memory of 184 3188 wlanext.exe 81 PID 3188 wrote to memory of 184 3188 wlanext.exe 81 PID 3188 wrote to memory of 184 3188 wlanext.exe 81
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\DHL DOCS..exe"C:\Users\Admin\AppData\Local\Temp\DHL DOCS..exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\DHL DOCS..exe"C:\Users\Admin\AppData\Local\Temp\DHL DOCS..exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3184
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DHL DOCS..exe"3⤵PID:184
-
-