Analysis
-
max time kernel
146s -
max time network
145s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
13-01-2021 20:13
Static task
static1
Behavioral task
behavioral1
Sample
RRW9901200241.exe
Resource
win7v20201028
General
-
Target
RRW9901200241.exe
-
Size
325KB
-
MD5
61ffb4ad4721f51413075923b2e9468d
-
SHA1
aa9ca98955157ca28bdbb1d8d29c3d1af2e28023
-
SHA256
546e873e9e746eeee9cbed391ff7463ce192091ee0ff51c076291da5d836f64f
-
SHA512
fe49b3771c704c8ab65cb7eb54e6a6e29abb96d0f6e2a9e1d3838d99370d2d868b51111a4ff5e04b181c1f12f42a296a56c5a1e3afb4fa05540ae632d592dbd7
Malware Config
Extracted
formbook
http://www.unitvn.com/krc/
grayfoxden.com
drupadhyayashomoeopathy.com
coordinatedcare-ok.com
the-legend-update3.com
remoteworkoffer.com
r3dprojects.com
banhuaihangschool.com
7852bigbucktrail.info
villagepizzafloralpark.com
sgtradingusa.com
evolvestephanieperreault.com
timelessbeautylessons.com
monkeytrivia.com
bsf.xyz
canda.design
recetasnutribullet.com
olenfex.com
catatan-matematika.com
roeltecnologiadigital.com
jutoxnatural.com
euroticie.info
tmxinc-chemicals.com
futurehawick.com
xaxzwz.com
kitfal.com
mickey2nd.com
world10plus.com
harkinstheates.com
conceptpowder.com
aeshahcosmetics.com
netglog.net
mystery-enigma.net
packerssandmover.online
weinsurehumans.com
estrade-monschau.com
poinintiteknologi.com
zipdelta.com
thibau4.xyz
immobiliervaldoingt.com
superherospirit.com
c-vital33.com
dydongyuan.com
glamatomy.com
campingpt.com
wozhebank.com
citestaccnt1597754710.com
localcryptod.com
celinemnique.com
broderies-admc.com
watdomenrendi03.net
dehaochu.com
missbeehavn.com
ryangyoung.com
kcspantry.com
posdonanim.com
directtestingservice.com
toastxpress.com
kingdommarketinguniversity.com
quantumtoday.xyz
modernhomespa.com
peakeventsservices.com
dellvn.net
maryjoyllc.com
trentog.com
Signatures
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1644-2-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1644-3-0x000000000041EB60-mapping.dmp formbook behavioral1/memory/1408-4-0x0000000001C80000-0x0000000001CA9000-memory.dmp formbook behavioral1/memory/804-5-0x0000000000000000-mapping.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 684 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
RRW9901200241.exeRRW9901200241.exesvchost.exedescription pid process target process PID 1408 set thread context of 1644 1408 RRW9901200241.exe RRW9901200241.exe PID 1644 set thread context of 1276 1644 RRW9901200241.exe Explorer.EXE PID 804 set thread context of 1276 804 svchost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
RRW9901200241.exesvchost.exepid process 1644 RRW9901200241.exe 1644 RRW9901200241.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe 804 svchost.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RRW9901200241.exeRRW9901200241.exesvchost.exepid process 1408 RRW9901200241.exe 1644 RRW9901200241.exe 1644 RRW9901200241.exe 1644 RRW9901200241.exe 804 svchost.exe 804 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RRW9901200241.exesvchost.exedescription pid process Token: SeDebugPrivilege 1644 RRW9901200241.exe Token: SeDebugPrivilege 804 svchost.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
RRW9901200241.exeExplorer.EXEsvchost.exedescription pid process target process PID 1408 wrote to memory of 1644 1408 RRW9901200241.exe RRW9901200241.exe PID 1408 wrote to memory of 1644 1408 RRW9901200241.exe RRW9901200241.exe PID 1408 wrote to memory of 1644 1408 RRW9901200241.exe RRW9901200241.exe PID 1408 wrote to memory of 1644 1408 RRW9901200241.exe RRW9901200241.exe PID 1408 wrote to memory of 1644 1408 RRW9901200241.exe RRW9901200241.exe PID 1276 wrote to memory of 804 1276 Explorer.EXE svchost.exe PID 1276 wrote to memory of 804 1276 Explorer.EXE svchost.exe PID 1276 wrote to memory of 804 1276 Explorer.EXE svchost.exe PID 1276 wrote to memory of 804 1276 Explorer.EXE svchost.exe PID 804 wrote to memory of 684 804 svchost.exe cmd.exe PID 804 wrote to memory of 684 804 svchost.exe cmd.exe PID 804 wrote to memory of 684 804 svchost.exe cmd.exe PID 804 wrote to memory of 684 804 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RRW9901200241.exe"C:\Users\Admin\AppData\Local\Temp\RRW9901200241.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RRW9901200241.exe"C:\Users\Admin\AppData\Local\Temp\RRW9901200241.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RRW9901200241.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/684-7-0x0000000000000000-mapping.dmp
-
memory/804-5-0x0000000000000000-mapping.dmp
-
memory/804-6-0x00000000000D0000-0x00000000000D8000-memory.dmpFilesize
32KB
-
memory/804-8-0x0000000001880000-0x0000000001940000-memory.dmpFilesize
768KB
-
memory/1408-4-0x0000000001C80000-0x0000000001CA9000-memory.dmpFilesize
164KB
-
memory/1644-2-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1644-3-0x000000000041EB60-mapping.dmp