Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-01-2021 20:15
Static task
static1
Behavioral task
behavioral1
Sample
HOPEFUL.exe
Resource
win7v20201028
General
-
Target
HOPEFUL.exe
-
Size
3.3MB
-
MD5
9c15af175868121cc014666189d52dae
-
SHA1
3ba03f47a8762368538e47806353f55da43d46ac
-
SHA256
7c8f873fc34661a785875f76a1f3b1aff6719e69d2a4ea5d2d94f849282b623a
-
SHA512
48fb5c66bda58fa8b76e276e61afc36576cddb9e27a601767e10f2d554c669613249aca6908191cb30a850b8ef207a69bb1a73c1fe25c93e7ef40379a3950a02
Malware Config
Extracted
formbook
http://www.registeredagentfirm.com/jqc/
strahlenschutz.digital
soterppe.com
wlw-hnlt.com
topheadlinetowitness-today.info
droriginals.com
baculatechie.online
definity.finance
weddingmustgoon.com
ludisenofloral.com
kenniscourtureconsignments.com
dl888.net
singledynamics.com
internetmarkaching.com
solidconstruct.site
ip-freight.com
11sxsx.com
incomecontent.com
the343radio.com
kimberlygoedhart.net
dgdoughnuts.net
vivethk.com
st-reet.com
luxusgrotte.com
hareland.info
fitdramas.com
shakahats.com
cositasdepachecos.com
lhc965.com
5hnjy.com
zoommedicaremeetings.com
bebywye.site
ravenlewis.com
avia-sales.xyz
screwtaped.com
xaustock.com
hongreng.xyz
lokalised.com
neosolutionsllc.com
ecandkllc.com
sistertravelalliance.com
brotherhoodoffathers.com
mybestme.store
vigilantdis.com
sqatzx.com
kornteengoods.com
miamiwaterworld.com
mywillandmylife.com
novergi.com
eaglesnestpropheticministry.com
sterlworldshop.com
gabriellagullberg.com
toweroflifeinc.com
tiendazoom.com
dividupe.com
szyulics.com
theorangepearl.com
hotvidzhub.download
asacal.com
systemedalarmebe.com
margosbest.com
kathymusic.com
quintred.com
mad54.art
simplification.business
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/344-11-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/344-12-0x000000000041EB50-mapping.dmp formbook behavioral2/memory/1540-14-0x0000000000000000-mapping.dmp formbook -
Executes dropped EXE 1 IoCs
Processes:
AddInProcess32.exepid process 344 AddInProcess32.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
HOPEFUL.exeAddInProcess32.exesystray.exedescription pid process target process PID 1812 set thread context of 344 1812 HOPEFUL.exe AddInProcess32.exe PID 344 set thread context of 3020 344 AddInProcess32.exe Explorer.EXE PID 344 set thread context of 3020 344 AddInProcess32.exe Explorer.EXE PID 1540 set thread context of 3020 1540 systray.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
HOPEFUL.exeAddInProcess32.exesystray.exepid process 1812 HOPEFUL.exe 1812 HOPEFUL.exe 344 AddInProcess32.exe 344 AddInProcess32.exe 344 AddInProcess32.exe 344 AddInProcess32.exe 344 AddInProcess32.exe 344 AddInProcess32.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe 1540 systray.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
AddInProcess32.exesystray.exepid process 344 AddInProcess32.exe 344 AddInProcess32.exe 344 AddInProcess32.exe 344 AddInProcess32.exe 1540 systray.exe 1540 systray.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
HOPEFUL.exeAddInProcess32.exesystray.exedescription pid process Token: SeDebugPrivilege 1812 HOPEFUL.exe Token: SeDebugPrivilege 344 AddInProcess32.exe Token: SeDebugPrivilege 1540 systray.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3020 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
HOPEFUL.exeExplorer.EXEsystray.exedescription pid process target process PID 1812 wrote to memory of 344 1812 HOPEFUL.exe AddInProcess32.exe PID 1812 wrote to memory of 344 1812 HOPEFUL.exe AddInProcess32.exe PID 1812 wrote to memory of 344 1812 HOPEFUL.exe AddInProcess32.exe PID 1812 wrote to memory of 344 1812 HOPEFUL.exe AddInProcess32.exe PID 1812 wrote to memory of 344 1812 HOPEFUL.exe AddInProcess32.exe PID 1812 wrote to memory of 344 1812 HOPEFUL.exe AddInProcess32.exe PID 3020 wrote to memory of 1540 3020 Explorer.EXE systray.exe PID 3020 wrote to memory of 1540 3020 Explorer.EXE systray.exe PID 3020 wrote to memory of 1540 3020 Explorer.EXE systray.exe PID 1540 wrote to memory of 1280 1540 systray.exe cmd.exe PID 1540 wrote to memory of 1280 1540 systray.exe cmd.exe PID 1540 wrote to memory of 1280 1540 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\HOPEFUL.exe"C:\Users\Admin\AppData\Local\Temp\HOPEFUL.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeMD5
6a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeMD5
6a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
memory/344-11-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/344-12-0x000000000041EB50-mapping.dmp
-
memory/1280-18-0x0000000000000000-mapping.dmp
-
memory/1540-15-0x0000000000EE0000-0x0000000000EE6000-memory.dmpFilesize
24KB
-
memory/1540-14-0x0000000000000000-mapping.dmp
-
memory/1540-16-0x0000000000EE0000-0x0000000000EE6000-memory.dmpFilesize
24KB
-
memory/1540-19-0x0000000004F70000-0x0000000005085000-memory.dmpFilesize
1.1MB
-
memory/1812-9-0x0000000005B00000-0x0000000005B0B000-memory.dmpFilesize
44KB
-
memory/1812-10-0x0000000005B20000-0x0000000005B21000-memory.dmpFilesize
4KB
-
memory/1812-8-0x0000000008360000-0x0000000008361000-memory.dmpFilesize
4KB
-
memory/1812-7-0x00000000032B0000-0x00000000032B1000-memory.dmpFilesize
4KB
-
memory/1812-6-0x0000000003280000-0x000000000329E000-memory.dmpFilesize
120KB
-
memory/1812-2-0x0000000073300000-0x00000000739EE000-memory.dmpFilesize
6.9MB
-
memory/1812-5-0x0000000005950000-0x0000000005951000-memory.dmpFilesize
4KB
-
memory/1812-3-0x0000000000DE0000-0x0000000000DE1000-memory.dmpFilesize
4KB