Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-01-2021 07:43
Static task
static1
Behavioral task
behavioral1
Sample
13012021.exe
Resource
win7v20201028
General
-
Target
13012021.exe
-
Size
1.0MB
-
MD5
2178794f0f12d01f85d909a5131e12c8
-
SHA1
f39ae8144d690f439d5eda69c74bfe6ed9de4513
-
SHA256
2449800b54909498a549817cc5bd9b8fc610a0d7ef6fd2bfda0d370783da8d32
-
SHA512
c4226dbc8935e464fa052c8457951375fdef3a50ead3d6207ba9906211c0876d3ae573698dc39919bc5027fa08233e79159edf2706ac9bc2e6b376b3f2c9e3b4
Malware Config
Extracted
formbook
http://www.timoniks.com/rbg/
fingermode.com
parkplace.finance
hollandgreen2020.com
starbets.site
vehiculesfrigorifiques.com
sydiifinancial.com
rpivuenation.com
freesubdirectory.com
independencepartynyc.com
dogruparti.info
independencecountyclub.com
midnightlashesbykim.com
digitalsept.com
whatilikeabouttoday.com
marktplaatsaccount.info
13400667334.com
xinwei-ge.com
login-appleid.info
momashands.com
kennyxpress.com
yushin2733.com
olenfex.com
agorabookstore.com
iotajinn.com
511tea.com
sullian.com
virtuallawyerservices.com
machineryhunters.online
mintamuntaz.com
sunflowerhybrid.com
hocbai24h.com
bundletvdeal.com
engjape.com
villamariaapartments.com
arabaozellikleri.net
fortheloveofdawg.com
mullinsmusicministry.com
rescuecellphones.com
infinityenterpriselr.com
humormug.com
summitplazagurgaon.com
rogo24.com
apluspartybus.com
chernliyfashion.com
presentvaluecore.com
bangbangfactory.com
leandroresolve.com
hk6628.com
anotherheadache.com
jiemanwu.com
a1dandyhandyman.com
pennsylvaniacraft.com
vrank.icu
avivemg.icu
littlestarenglish.com
jrprofessionale.com
belze.net
svtrbu.com
healthpassportasia.com
kadakudu.com
rahatindir.com
seamssewmuchbetter.com
brancusi.net
ido.lgbt
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2984-12-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2984-13-0x000000000041EB40-mapping.dmp formbook behavioral2/memory/1332-15-0x0000000000000000-mapping.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
13012021.exe13012021.exewscript.exedescription pid process target process PID 812 set thread context of 2984 812 13012021.exe 13012021.exe PID 2984 set thread context of 3048 2984 13012021.exe Explorer.EXE PID 1332 set thread context of 3048 1332 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
13012021.exe13012021.exewscript.exepid process 812 13012021.exe 812 13012021.exe 2984 13012021.exe 2984 13012021.exe 2984 13012021.exe 2984 13012021.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe 1332 wscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
13012021.exewscript.exepid process 2984 13012021.exe 2984 13012021.exe 2984 13012021.exe 1332 wscript.exe 1332 wscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
13012021.exe13012021.exewscript.exedescription pid process Token: SeDebugPrivilege 812 13012021.exe Token: SeDebugPrivilege 2984 13012021.exe Token: SeDebugPrivilege 1332 wscript.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3048 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
13012021.exeExplorer.EXEwscript.exedescription pid process target process PID 812 wrote to memory of 1976 812 13012021.exe 13012021.exe PID 812 wrote to memory of 1976 812 13012021.exe 13012021.exe PID 812 wrote to memory of 1976 812 13012021.exe 13012021.exe PID 812 wrote to memory of 2984 812 13012021.exe 13012021.exe PID 812 wrote to memory of 2984 812 13012021.exe 13012021.exe PID 812 wrote to memory of 2984 812 13012021.exe 13012021.exe PID 812 wrote to memory of 2984 812 13012021.exe 13012021.exe PID 812 wrote to memory of 2984 812 13012021.exe 13012021.exe PID 812 wrote to memory of 2984 812 13012021.exe 13012021.exe PID 3048 wrote to memory of 1332 3048 Explorer.EXE wscript.exe PID 3048 wrote to memory of 1332 3048 Explorer.EXE wscript.exe PID 3048 wrote to memory of 1332 3048 Explorer.EXE wscript.exe PID 1332 wrote to memory of 3488 1332 wscript.exe cmd.exe PID 1332 wrote to memory of 3488 1332 wscript.exe cmd.exe PID 1332 wrote to memory of 3488 1332 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\13012021.exe"C:\Users\Admin\AppData\Local\Temp\13012021.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\13012021.exe"C:\Users\Admin\AppData\Local\Temp\13012021.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\13012021.exe"C:\Users\Admin\AppData\Local\Temp\13012021.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\13012021.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/812-11-0x00000000064C0000-0x000000000652A000-memory.dmpFilesize
424KB
-
memory/812-9-0x0000000005950000-0x0000000005951000-memory.dmpFilesize
4KB
-
memory/812-5-0x0000000005690000-0x0000000005691000-memory.dmpFilesize
4KB
-
memory/812-6-0x0000000005C30000-0x0000000005C31000-memory.dmpFilesize
4KB
-
memory/812-2-0x0000000074070000-0x000000007475E000-memory.dmpFilesize
6.9MB
-
memory/812-8-0x0000000005630000-0x0000000005631000-memory.dmpFilesize
4KB
-
memory/812-3-0x0000000000D10000-0x0000000000D11000-memory.dmpFilesize
4KB
-
memory/812-10-0x0000000005900000-0x0000000005912000-memory.dmpFilesize
72KB
-
memory/812-7-0x0000000005730000-0x0000000005731000-memory.dmpFilesize
4KB
-
memory/1332-15-0x0000000000000000-mapping.dmp
-
memory/1332-16-0x00000000000F0000-0x0000000000117000-memory.dmpFilesize
156KB
-
memory/1332-17-0x00000000000F0000-0x0000000000117000-memory.dmpFilesize
156KB
-
memory/1332-19-0x00000000057B0000-0x0000000005912000-memory.dmpFilesize
1.4MB
-
memory/2984-12-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2984-13-0x000000000041EB40-mapping.dmp
-
memory/3488-18-0x0000000000000000-mapping.dmp