Analysis
-
max time kernel
130s -
max time network
133s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
12-01-2021 07:04
Static task
static1
Behavioral task
behavioral1
Sample
4cb2041db0a8696f1853543f5c03b89a.exe
Resource
win7v20201028
General
-
Target
4cb2041db0a8696f1853543f5c03b89a.exe
-
Size
850KB
-
MD5
4cb2041db0a8696f1853543f5c03b89a
-
SHA1
aaa3e737d72504340eeb6111d7d51c8a7e37efe2
-
SHA256
04e7f27915298f09a1486331df3f0e5121e4a7856f41290f48200255b8b82df8
-
SHA512
2d4a07afc9dbb6c1f81c5e6f16c51763f2fd42bba2e77c0310b17ee949aad3e88562e5d13f77c13449585ddd2918512e80b8735e9fbf7155826ee39d566d938a
Malware Config
Extracted
formbook
http://www.thesiromiel.com/kgw/
valentinakasu.com
soyelmatador.com
collaborativeprosperity.com
power8brokers.com
nexus-ink.com
manpasandmeatmarket.com
the-ethical-forums.today
maryannpark.com
bikininbodymommy.com
pxwuo.com
bigbangmerch.com
okaysinger.com
shopcarpe.com
rainbowhillsswimclub.com
crifinmarket.com
ebl-play.net
forceandsonsequipment.com
viagraytqwi.com
latashashop.com
suffocatinglymundanepodcast.com
metanoria.com
camera-kento.com
hotsaledeals.store
outlawgospelshow.com
saisaharashipping.com
buyiprod.com
pestigenix.com
opendesignpodcast.com
patentml.com
covaxbiotech.com
youjar.com
domvy.xyz
remodelmemphis.com
milehighdistributionllc.com
merchandisingpremium.com
fallguysmovile.com
actuelburo.xyz
nedlebow.com
shopcryptocurrency247.com
riellymoore.com
affinitymotorsales.com
akmh.pro
hsrrxs.com
atlanticdentallab.com
sagarpantry.com
murinemodel.com
karybeautycare.com
boshangkeji.com
dailynewstodays.com
oregonpyramids.com
dsjmzyz.com
gidagozlemevi.com
tribelessofficial.com
cyberonica.com
onehourcheckout.com
tenaflypedatrics.com
nbworldfire.com
setyourhead.com
manticore-habitat.com
iqftomatoes.com
fejsearesete.com
gregsgradeaappliancerepair.com
sfmfgco.com
directprnews.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2540-13-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2540-14-0x000000000041EB70-mapping.dmp formbook -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
4cb2041db0a8696f1853543f5c03b89a.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4cb2041db0a8696f1853543f5c03b89a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4cb2041db0a8696f1853543f5c03b89a.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
4cb2041db0a8696f1853543f5c03b89a.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 4cb2041db0a8696f1853543f5c03b89a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 4cb2041db0a8696f1853543f5c03b89a.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4cb2041db0a8696f1853543f5c03b89a.exedescription pid process target process PID 984 set thread context of 2540 984 4cb2041db0a8696f1853543f5c03b89a.exe 4cb2041db0a8696f1853543f5c03b89a.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
4cb2041db0a8696f1853543f5c03b89a.exe4cb2041db0a8696f1853543f5c03b89a.exepid process 984 4cb2041db0a8696f1853543f5c03b89a.exe 984 4cb2041db0a8696f1853543f5c03b89a.exe 984 4cb2041db0a8696f1853543f5c03b89a.exe 2540 4cb2041db0a8696f1853543f5c03b89a.exe 2540 4cb2041db0a8696f1853543f5c03b89a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4cb2041db0a8696f1853543f5c03b89a.exedescription pid process Token: SeDebugPrivilege 984 4cb2041db0a8696f1853543f5c03b89a.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
4cb2041db0a8696f1853543f5c03b89a.exedescription pid process target process PID 984 wrote to memory of 4000 984 4cb2041db0a8696f1853543f5c03b89a.exe 4cb2041db0a8696f1853543f5c03b89a.exe PID 984 wrote to memory of 4000 984 4cb2041db0a8696f1853543f5c03b89a.exe 4cb2041db0a8696f1853543f5c03b89a.exe PID 984 wrote to memory of 4000 984 4cb2041db0a8696f1853543f5c03b89a.exe 4cb2041db0a8696f1853543f5c03b89a.exe PID 984 wrote to memory of 2540 984 4cb2041db0a8696f1853543f5c03b89a.exe 4cb2041db0a8696f1853543f5c03b89a.exe PID 984 wrote to memory of 2540 984 4cb2041db0a8696f1853543f5c03b89a.exe 4cb2041db0a8696f1853543f5c03b89a.exe PID 984 wrote to memory of 2540 984 4cb2041db0a8696f1853543f5c03b89a.exe 4cb2041db0a8696f1853543f5c03b89a.exe PID 984 wrote to memory of 2540 984 4cb2041db0a8696f1853543f5c03b89a.exe 4cb2041db0a8696f1853543f5c03b89a.exe PID 984 wrote to memory of 2540 984 4cb2041db0a8696f1853543f5c03b89a.exe 4cb2041db0a8696f1853543f5c03b89a.exe PID 984 wrote to memory of 2540 984 4cb2041db0a8696f1853543f5c03b89a.exe 4cb2041db0a8696f1853543f5c03b89a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cb2041db0a8696f1853543f5c03b89a.exe"C:\Users\Admin\AppData\Local\Temp\4cb2041db0a8696f1853543f5c03b89a.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\4cb2041db0a8696f1853543f5c03b89a.exe"C:\Users\Admin\AppData\Local\Temp\4cb2041db0a8696f1853543f5c03b89a.exe"2⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\4cb2041db0a8696f1853543f5c03b89a.exe"C:\Users\Admin\AppData\Local\Temp\4cb2041db0a8696f1853543f5c03b89a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2540
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/984-2-0x0000000073840000-0x0000000073F2E000-memory.dmpFilesize
6.9MB
-
memory/984-3-0x0000000000F50000-0x0000000000F51000-memory.dmpFilesize
4KB
-
memory/984-5-0x00000000058A0000-0x00000000058A1000-memory.dmpFilesize
4KB
-
memory/984-6-0x0000000005E40000-0x0000000005E41000-memory.dmpFilesize
4KB
-
memory/984-7-0x0000000005940000-0x0000000005941000-memory.dmpFilesize
4KB
-
memory/984-8-0x0000000005850000-0x0000000005851000-memory.dmpFilesize
4KB
-
memory/984-9-0x0000000005B00000-0x0000000005B01000-memory.dmpFilesize
4KB
-
memory/984-10-0x0000000005860000-0x0000000005872000-memory.dmpFilesize
72KB
-
memory/984-11-0x00000000067D0000-0x000000000683E000-memory.dmpFilesize
440KB
-
memory/984-12-0x0000000006920000-0x0000000006921000-memory.dmpFilesize
4KB
-
memory/2540-13-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2540-14-0x000000000041EB70-mapping.dmp