Analysis
-
max time kernel
38s -
max time network
14s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
12-01-2021 07:04
Static task
static1
Behavioral task
behavioral1
Sample
763a170d8db1c54b150a0d2891b3fead.exe
Resource
win7v20201028
General
-
Target
763a170d8db1c54b150a0d2891b3fead.exe
-
Size
879KB
-
MD5
763a170d8db1c54b150a0d2891b3fead
-
SHA1
a5e70c7ef5c972a5507b679c573e677ec7ba28a6
-
SHA256
f53df4e1f9405d98a02cf34bedf2ee5df88437c130eb339eb6da9850f14ad443
-
SHA512
c42af58504d08fdc7b62b84fbddc059f375aa97652b02627c93063d3940ebec33381fc08522f9e5dca09058237232933da6b62786ea800ff1c7591d6a815ce9b
Malware Config
Extracted
formbook
http://www.zglvyouzaixian.com/nki/
igo-digiworld.com
infrahiit.com
herhealingwater.com
inspiredbytradition.com
onlinepropertyworld.com
rvwdj.com
mudahbikinsuhi.online
multipleofferonline.com
striveyouthministry.com
affectiveneuro.net
f21m.com
perfumefashion.icu
instantcash4rvs.com
help-verifiedbadge.com
solomonislandsblog.com
vipshoppingwizard.com
doggybargains.com
fjyaoxi.net
luxpropertyandassociates.com
companyfinders.com
alifeflooring.com
watermeloncrypto.com
internationalaid.global
petrosu.net
fireyourschool.com
gofawerunebe.com
lazystorage.com
tgasstore.com
adoniskitchenbath.com
it4cracks.com
revsharez.com
radioroutiers.com
szalun.com
theacademylife.com
jackcdoherty.com
theselfcaremenu.com
arentist.com
skyfun.asia
kroumoda.com
brodskikonetejneri.com
citestmansoon3445.com
laalianza.net
lwfenterprises.com
changeledger.com
x-box2send15.club
postraducion.xyz
kpybevx.icu
lolamind.com
jaipurethnic.com
candixenergy.com
degreespoint.com
311tac.com
donationwheel.com
ps3e.com
hyderabadcycles.com
nehyam.com
eversouthhangzhou.com
modaemira.com
k2bsi.com
jiopan.com
wheelerfamilyhistory.net
htaxbiz.com
somethinggotmestarted.com
aprilsbookkeeping.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1464-8-0x000000000041EB70-mapping.dmp formbook behavioral1/memory/1464-7-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
763a170d8db1c54b150a0d2891b3fead.exedescription pid process target process PID 1756 set thread context of 1464 1756 763a170d8db1c54b150a0d2891b3fead.exe 763a170d8db1c54b150a0d2891b3fead.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
763a170d8db1c54b150a0d2891b3fead.exepid process 1464 763a170d8db1c54b150a0d2891b3fead.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
763a170d8db1c54b150a0d2891b3fead.exedescription pid process target process PID 1756 wrote to memory of 1464 1756 763a170d8db1c54b150a0d2891b3fead.exe 763a170d8db1c54b150a0d2891b3fead.exe PID 1756 wrote to memory of 1464 1756 763a170d8db1c54b150a0d2891b3fead.exe 763a170d8db1c54b150a0d2891b3fead.exe PID 1756 wrote to memory of 1464 1756 763a170d8db1c54b150a0d2891b3fead.exe 763a170d8db1c54b150a0d2891b3fead.exe PID 1756 wrote to memory of 1464 1756 763a170d8db1c54b150a0d2891b3fead.exe 763a170d8db1c54b150a0d2891b3fead.exe PID 1756 wrote to memory of 1464 1756 763a170d8db1c54b150a0d2891b3fead.exe 763a170d8db1c54b150a0d2891b3fead.exe PID 1756 wrote to memory of 1464 1756 763a170d8db1c54b150a0d2891b3fead.exe 763a170d8db1c54b150a0d2891b3fead.exe PID 1756 wrote to memory of 1464 1756 763a170d8db1c54b150a0d2891b3fead.exe 763a170d8db1c54b150a0d2891b3fead.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\763a170d8db1c54b150a0d2891b3fead.exe"C:\Users\Admin\AppData\Local\Temp\763a170d8db1c54b150a0d2891b3fead.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\763a170d8db1c54b150a0d2891b3fead.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1464
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1464-8-0x000000000041EB70-mapping.dmp
-
memory/1464-7-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1756-2-0x00000000749D0000-0x00000000750BE000-memory.dmpFilesize
6.9MB
-
memory/1756-3-0x0000000000A30000-0x0000000000A31000-memory.dmpFilesize
4KB
-
memory/1756-5-0x0000000000580000-0x000000000058E000-memory.dmpFilesize
56KB
-
memory/1756-6-0x00000000053E0000-0x000000000547B000-memory.dmpFilesize
620KB