Analysis
- max time kernel
150s - max time network
136s - platform
windows10_x64 - resource
win10v20201028 - submitted
17/12/2020, 06:16
Static task
static1
Behavioral task
behavioral1
Sample
ins.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target ins.exe
- Size 197KB
- Sample201217-j2nvr3s4dx
- SHA256 2d5d89747431e9003471e77e757e6c2d3310cbcac7451c1bb8389d0744543e6f
- MD5 d4729568ab5e3fbf947975574cf7ceda
- SHA1 347be1a2c069d3228cfaf43ba4c948f74c87b4fb
- SHA512 36e8907537ba29689bc89db734914dcf0ed2b34bf1169756e8607bed31ff05661648031bf572ca4bc92fc7dd534f1e9f5c07fdbfe955340815d203367ad9a63e
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.nationshiphop.com/hko6/
Decoy
-
apartmentsineverettwa.com
-
forritcu.net
-
hotroodes.com
-
skinnerttc.com
-
royaltrustmyanmar.com
-
adreslog.com
-
kaysbridalboutiques.com
-
multitask-improvements.com
-
geniiforum.com
-
smarthomehatinh.asia
-
banglikeaboss.com
-
javlover.club
-
affiliateclubindia.com
-
mycapecoralhomevalue.com
-
comparamuebles.online
-
newrochellenissan.com
-
nairobi-paris.com
-
fwk.xyz
-
downdepot.com
-
nextgenmemorabilia.com
-
achonabu.com
-
stevebana.xyz
-
jacmkt.com
-
weownthenight187.com
-
divshop.pro
-
wewearceylon.com
-
skyreadymix.net
-
jaffacorner.com
-
bakerlibra.icu
-
femalecoliving.com
-
best20banks.com
-
millcityloam.com
-
signature-office.com
-
qlifepharmacy.com
-
dextermind.net
-
fittcycleacademy.com
-
davidoff.sucks
-
1033393.com
-
tutorsboulder.com
-
bonicc.com
-
goodberryjuice.com
-
zhaowulu.com
-
teryaq.media
-
a-zsolutionsllc.com
-
bitcoincandy.xyz
-
cfmfair.com
-
annefontain.com
-
princesssexyluxwear.com
-
prodigybrushes.com
-
zzhqp.com
-
hwcailing.com
-
translatiions.com
-
azery.site
-
wy1917.com
-
ringohouse.info
-
chartershome.com
-
thongtinhay.net
-
2201virginiacondo5.com
-
laurieryork.net
-
mujeresnegociantes.com
-
anchoriaswimwear.com
-
michaelsala.com
-
esdeportebici.com
-
ninjitsoo.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/1880-2-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/1880-3-0x000000000041ECF0-mapping.dmp formbook behavioral2/memory/4028-6-0x0000000000000000-mapping.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 756 set thread context of 1880 756 ins.exe 74 PID 1880 set thread context of 2756 1880 ins.exe 23 PID 4028 set thread context of 2756 4028 colorcpl.exe 23 - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1880 ins.exe 1880 ins.exe 1880 ins.exe 1880 ins.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe 4028 colorcpl.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 756 ins.exe 1880 ins.exe 1880 ins.exe 1880 ins.exe 4028 colorcpl.exe 4028 colorcpl.exe - Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 1880 ins.exe Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeDebugPrivilege 4028 colorcpl.exe Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2756 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 756 wrote to memory of 1880 756 ins.exe 74 PID 756 wrote to memory of 1880 756 ins.exe 74 PID 756 wrote to memory of 1880 756 ins.exe 74 PID 756 wrote to memory of 1880 756 ins.exe 74 PID 2756 wrote to memory of 4028 2756 Explorer.EXE 77 PID 2756 wrote to memory of 4028 2756 Explorer.EXE 77 PID 2756 wrote to memory of 4028 2756 Explorer.EXE 77 PID 4028 wrote to memory of 796 4028 colorcpl.exe 80 PID 4028 wrote to memory of 796 4028 colorcpl.exe 80 PID 4028 wrote to memory of 796 4028 colorcpl.exe 80
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\ins.exe"C:\Users\Admin\AppData\Local\Temp\ins.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\ins.exe"C:\Users\Admin\AppData\Local\Temp\ins.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1880
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ins.exe"3⤵PID:796
-
-