Analysis
-
max time kernel
146s -
max time network
131s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-01-2021 20:12
Static task
static1
Behavioral task
behavioral1
Sample
SKM_C36821010708320.exe
Resource
win7v20201028
General
-
Target
SKM_C36821010708320.exe
-
Size
766KB
-
MD5
15d8096422d137c7388908bb2be61ec4
-
SHA1
e67d261ef38eb251fb97a466d83c95e75d286ebe
-
SHA256
fae57c2f185899220dff608004ab571822fc14cc02aa7e30b1cd5db7be4beea8
-
SHA512
83d38e2e5540d1a2790f834e62bd1cc6978eae92c6d70ca875b72e0d33852473b68b36b99c4fe05e3c100283dee6353e45f907eecbb9369d730c17c5c20bb1f5
Malware Config
Extracted
formbook
http://www.ameeraglow.com/6bu2/
shuttergame.com
beyondregions.com
cuttingedgetinting.com
riveraspanishfoods.com
jfksn.com
rtplay2020.com
idahofallsobituaries.com
qf432.com
magandaconfections.com
suremlak.com
tuproductividadpersonal.com
ziswmyxaw.icu
howtolovemybody.com
signpartnerpro.com
conservative-forward.com
bhscsh.com
todowine.com
garrettthermaldetector.com
bunbook.com
ehealthla.com
mojacreations.com
2kantxt.com
aqustea.com
sheilataman.com
phymath.science
sctuba.com
columbusestatesseniorliving.com
opyalliy.pro
bestgiftforu.com
cad-office-iserlohn.com
gorgeus-girl-full-service.today
easthaus-modern.com
snoozefest.online
service-xwcrvxsz.icu
flavourcosmetics.com
news247alert.com
944ka.xyz
bcheap3dmall.com
crepkonnect.com
purelili.com
pushupbras.net
ctsafaris.com
sprinkleforever.com
engagingsci.coach
aihint.com
icxrus.com
7vitrines.com
mrsgariepy.com
bikewitha.pro
adv-assist.com
youlacka.com
languagekickstart.com
commonscentsbychloe.com
o-tanemaki.com
wlgdrs.com
imbentaryo.com
winwithrundlemall.com
jumben.xyz
24k88lotto.com
bundlesofjoihair.com
bukannyaterbuai31.com
essentialeatscatering.com
brasseriedufayard.com
trumpvotr.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3164-11-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3164-12-0x000000000041ED10-mapping.dmp formbook behavioral2/memory/2428-13-0x0000000000000000-mapping.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
SKM_C36821010708320.exeSKM_C36821010708320.execmmon32.exedescription pid process target process PID 3980 set thread context of 3164 3980 SKM_C36821010708320.exe SKM_C36821010708320.exe PID 3164 set thread context of 2092 3164 SKM_C36821010708320.exe Explorer.EXE PID 3164 set thread context of 2092 3164 SKM_C36821010708320.exe Explorer.EXE PID 2428 set thread context of 2092 2428 cmmon32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 38 IoCs
Processes:
SKM_C36821010708320.execmmon32.exepid process 3164 SKM_C36821010708320.exe 3164 SKM_C36821010708320.exe 3164 SKM_C36821010708320.exe 3164 SKM_C36821010708320.exe 3164 SKM_C36821010708320.exe 3164 SKM_C36821010708320.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe 2428 cmmon32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
SKM_C36821010708320.execmmon32.exepid process 3164 SKM_C36821010708320.exe 3164 SKM_C36821010708320.exe 3164 SKM_C36821010708320.exe 3164 SKM_C36821010708320.exe 2428 cmmon32.exe 2428 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SKM_C36821010708320.execmmon32.exedescription pid process Token: SeDebugPrivilege 3164 SKM_C36821010708320.exe Token: SeDebugPrivilege 2428 cmmon32.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2092 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
SKM_C36821010708320.exeExplorer.EXEcmmon32.exedescription pid process target process PID 3980 wrote to memory of 3164 3980 SKM_C36821010708320.exe SKM_C36821010708320.exe PID 3980 wrote to memory of 3164 3980 SKM_C36821010708320.exe SKM_C36821010708320.exe PID 3980 wrote to memory of 3164 3980 SKM_C36821010708320.exe SKM_C36821010708320.exe PID 3980 wrote to memory of 3164 3980 SKM_C36821010708320.exe SKM_C36821010708320.exe PID 3980 wrote to memory of 3164 3980 SKM_C36821010708320.exe SKM_C36821010708320.exe PID 3980 wrote to memory of 3164 3980 SKM_C36821010708320.exe SKM_C36821010708320.exe PID 2092 wrote to memory of 2428 2092 Explorer.EXE cmmon32.exe PID 2092 wrote to memory of 2428 2092 Explorer.EXE cmmon32.exe PID 2092 wrote to memory of 2428 2092 Explorer.EXE cmmon32.exe PID 2428 wrote to memory of 4076 2428 cmmon32.exe cmd.exe PID 2428 wrote to memory of 4076 2428 cmmon32.exe cmd.exe PID 2428 wrote to memory of 4076 2428 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SKM_C36821010708320.exe"C:\Users\Admin\AppData\Local\Temp\SKM_C36821010708320.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SKM_C36821010708320.exe"C:\Users\Admin\AppData\Local\Temp\SKM_C36821010708320.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SKM_C36821010708320.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2428-17-0x00000000055B0000-0x000000000565F000-memory.dmpFilesize
700KB
-
memory/2428-15-0x00000000000A0000-0x00000000000AC000-memory.dmpFilesize
48KB
-
memory/2428-14-0x00000000000A0000-0x00000000000AC000-memory.dmpFilesize
48KB
-
memory/2428-13-0x0000000000000000-mapping.dmp
-
memory/3164-11-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3164-12-0x000000000041ED10-mapping.dmp
-
memory/3980-6-0x0000000005920000-0x0000000005921000-memory.dmpFilesize
4KB
-
memory/3980-10-0x0000000006600000-0x000000000666A000-memory.dmpFilesize
424KB
-
memory/3980-9-0x00000000058E0000-0x00000000058F2000-memory.dmpFilesize
72KB
-
memory/3980-8-0x00000000058D0000-0x00000000058D1000-memory.dmpFilesize
4KB
-
memory/3980-7-0x00000000059C0000-0x00000000059C1000-memory.dmpFilesize
4KB
-
memory/3980-2-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/3980-5-0x0000000005D80000-0x0000000005D81000-memory.dmpFilesize
4KB
-
memory/3980-3-0x0000000000FE0000-0x0000000000FE1000-memory.dmpFilesize
4KB
-
memory/4076-16-0x0000000000000000-mapping.dmp