Analysis
-
max time kernel
146s -
max time network
16s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
13-01-2021 20:12
Static task
static1
Behavioral task
behavioral1
Sample
SKM_C36821010708320.exe
Resource
win7v20201028
General
-
Target
SKM_C36821010708320.exe
-
Size
766KB
-
MD5
15d8096422d137c7388908bb2be61ec4
-
SHA1
e67d261ef38eb251fb97a466d83c95e75d286ebe
-
SHA256
fae57c2f185899220dff608004ab571822fc14cc02aa7e30b1cd5db7be4beea8
-
SHA512
83d38e2e5540d1a2790f834e62bd1cc6978eae92c6d70ca875b72e0d33852473b68b36b99c4fe05e3c100283dee6353e45f907eecbb9369d730c17c5c20bb1f5
Malware Config
Extracted
formbook
http://www.ameeraglow.com/6bu2/
shuttergame.com
beyondregions.com
cuttingedgetinting.com
riveraspanishfoods.com
jfksn.com
rtplay2020.com
idahofallsobituaries.com
qf432.com
magandaconfections.com
suremlak.com
tuproductividadpersonal.com
ziswmyxaw.icu
howtolovemybody.com
signpartnerpro.com
conservative-forward.com
bhscsh.com
todowine.com
garrettthermaldetector.com
bunbook.com
ehealthla.com
mojacreations.com
2kantxt.com
aqustea.com
sheilataman.com
phymath.science
sctuba.com
columbusestatesseniorliving.com
opyalliy.pro
bestgiftforu.com
cad-office-iserlohn.com
gorgeus-girl-full-service.today
easthaus-modern.com
snoozefest.online
service-xwcrvxsz.icu
flavourcosmetics.com
news247alert.com
944ka.xyz
bcheap3dmall.com
crepkonnect.com
purelili.com
pushupbras.net
ctsafaris.com
sprinkleforever.com
engagingsci.coach
aihint.com
icxrus.com
7vitrines.com
mrsgariepy.com
bikewitha.pro
adv-assist.com
youlacka.com
languagekickstart.com
commonscentsbychloe.com
o-tanemaki.com
wlgdrs.com
imbentaryo.com
winwithrundlemall.com
jumben.xyz
24k88lotto.com
bundlesofjoihair.com
bukannyaterbuai31.com
essentialeatscatering.com
brasseriedufayard.com
trumpvotr.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1564-7-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1564-8-0x000000000041ED10-mapping.dmp formbook behavioral1/memory/520-9-0x0000000000000000-mapping.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 532 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
SKM_C36821010708320.exeSKM_C36821010708320.exeexplorer.exedescription pid process target process PID 1088 set thread context of 1564 1088 SKM_C36821010708320.exe SKM_C36821010708320.exe PID 1564 set thread context of 1256 1564 SKM_C36821010708320.exe Explorer.EXE PID 520 set thread context of 1256 520 explorer.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
SKM_C36821010708320.exeexplorer.exepid process 1564 SKM_C36821010708320.exe 1564 SKM_C36821010708320.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
SKM_C36821010708320.exeexplorer.exepid process 1564 SKM_C36821010708320.exe 1564 SKM_C36821010708320.exe 1564 SKM_C36821010708320.exe 520 explorer.exe 520 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SKM_C36821010708320.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1564 SKM_C36821010708320.exe Token: SeDebugPrivilege 520 explorer.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
SKM_C36821010708320.exeExplorer.EXEexplorer.exedescription pid process target process PID 1088 wrote to memory of 1564 1088 SKM_C36821010708320.exe SKM_C36821010708320.exe PID 1088 wrote to memory of 1564 1088 SKM_C36821010708320.exe SKM_C36821010708320.exe PID 1088 wrote to memory of 1564 1088 SKM_C36821010708320.exe SKM_C36821010708320.exe PID 1088 wrote to memory of 1564 1088 SKM_C36821010708320.exe SKM_C36821010708320.exe PID 1088 wrote to memory of 1564 1088 SKM_C36821010708320.exe SKM_C36821010708320.exe PID 1088 wrote to memory of 1564 1088 SKM_C36821010708320.exe SKM_C36821010708320.exe PID 1088 wrote to memory of 1564 1088 SKM_C36821010708320.exe SKM_C36821010708320.exe PID 1256 wrote to memory of 520 1256 Explorer.EXE explorer.exe PID 1256 wrote to memory of 520 1256 Explorer.EXE explorer.exe PID 1256 wrote to memory of 520 1256 Explorer.EXE explorer.exe PID 1256 wrote to memory of 520 1256 Explorer.EXE explorer.exe PID 520 wrote to memory of 532 520 explorer.exe cmd.exe PID 520 wrote to memory of 532 520 explorer.exe cmd.exe PID 520 wrote to memory of 532 520 explorer.exe cmd.exe PID 520 wrote to memory of 532 520 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SKM_C36821010708320.exe"C:\Users\Admin\AppData\Local\Temp\SKM_C36821010708320.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SKM_C36821010708320.exe"C:\Users\Admin\AppData\Local\Temp\SKM_C36821010708320.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SKM_C36821010708320.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/520-9-0x0000000000000000-mapping.dmp
-
memory/520-10-0x0000000000A40000-0x0000000000CC1000-memory.dmpFilesize
2.5MB
-
memory/520-12-0x0000000003480000-0x000000000356E000-memory.dmpFilesize
952KB
-
memory/532-11-0x0000000000000000-mapping.dmp
-
memory/1088-2-0x0000000074CC0000-0x00000000753AE000-memory.dmpFilesize
6.9MB
-
memory/1088-3-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/1088-5-0x0000000000410000-0x0000000000422000-memory.dmpFilesize
72KB
-
memory/1088-6-0x0000000005530000-0x000000000559A000-memory.dmpFilesize
424KB
-
memory/1564-7-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1564-8-0x000000000041ED10-mapping.dmp