Analysis
-
max time kernel
148s -
max time network
15s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
13-01-2021 07:37
Static task
static1
Behavioral task
behavioral1
Sample
Po-covid19 2372#w2..exe
Resource
win7v20201028
General
-
Target
Po-covid19 2372#w2..exe
-
Size
1.2MB
-
MD5
bf53c9dc0d0f032033c318aceef906c6
-
SHA1
eeba1ef352c09979dfdfb4afdcdc5f41fe2a0119
-
SHA256
a1558391914f4235dfdcdddcdf0de915a800541a4271feb4aff34af82b83a935
-
SHA512
7db00f26f4c0e6e6865ff4561ace1d6af4c8804e8534b29d6b1977f48c1863b7fbbd766a360e9d400aad4070568d33247e832b07da69a482004f14eab7c61383
Malware Config
Extracted
formbook
http://www.styrelseforum.com/p95n/
kimberlyrutledge.com
auctus.agency
johnemotions.com
guilt-brilliant.com
wxshangdian.com
theolivetreeonline.com
stellarfranchisebrands.com
every1no1.com
hoangthanhgroup.com
psm-gen.com
kingdomwow.com
digitalksr.com
karynpolitoforlg.com
youthdaycalgary.com
libertyhandymanservicesllc.com
breatheohio.com
allenleather.com
transformafter50.info
hnhsylsb.com
hmtradebd.com
besrhodislandhomes.com
zuwozo.com
southernhighlandsnails.com
kaaxg.com
bauer-cobolt.com
steelyourselfshop.net
linksoflondoncharmscheap.com
groundwork-pt.com
beautifulangelicskin.com
aduhelmfinancialsupport.com
xn--carpinteratarifa-hsb.com
thekingink.net
ocotegrill.com
gilbertdodge.com
insuranceinquirer.com
withagentcy.com
deeparchivesvpn.com
blamekd.com
acsdealta.xyz
dsxcj.com
kimonoshihan.com
bosquefamily.com
5587sk.com
integrative.life
unitedjournal.info
lynxdeck.com
onlyfanyou.com
aminomedicalscience.com
rachenstern-technik.com
thejewelrybox.net
stopcolleges.com
thesaltlifestyle.com
tappesupportservices.com
andrewgreenhomes.com
meidiansc.com
gobalexporter.com
rvpji571m.xyz
alwekalaaladabeya.com
scientificimaginetics.com
skaizenpharma.com
balloonpost.club
thefunnythingabout.com
premium-vitality.com
businesscalmcoaching.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1336-7-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1336-8-0x000000000041EDF0-mapping.dmp formbook behavioral1/memory/1712-9-0x0000000000000000-mapping.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1740 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Po-covid19 2372#w2..exePo-covid19 2372#w2..exewlanext.exedescription pid process target process PID 868 set thread context of 1336 868 Po-covid19 2372#w2..exe Po-covid19 2372#w2..exe PID 1336 set thread context of 1200 1336 Po-covid19 2372#w2..exe Explorer.EXE PID 1336 set thread context of 1200 1336 Po-covid19 2372#w2..exe Explorer.EXE PID 1712 set thread context of 1200 1712 wlanext.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
Po-covid19 2372#w2..exewlanext.exepid process 1336 Po-covid19 2372#w2..exe 1336 Po-covid19 2372#w2..exe 1336 Po-covid19 2372#w2..exe 1712 wlanext.exe 1712 wlanext.exe 1712 wlanext.exe 1712 wlanext.exe 1712 wlanext.exe 1712 wlanext.exe 1712 wlanext.exe 1712 wlanext.exe 1712 wlanext.exe 1712 wlanext.exe 1712 wlanext.exe 1712 wlanext.exe 1712 wlanext.exe 1712 wlanext.exe 1712 wlanext.exe 1712 wlanext.exe 1712 wlanext.exe 1712 wlanext.exe 1712 wlanext.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Po-covid19 2372#w2..exewlanext.exepid process 1336 Po-covid19 2372#w2..exe 1336 Po-covid19 2372#w2..exe 1336 Po-covid19 2372#w2..exe 1336 Po-covid19 2372#w2..exe 1712 wlanext.exe 1712 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Po-covid19 2372#w2..exewlanext.exedescription pid process Token: SeDebugPrivilege 1336 Po-covid19 2372#w2..exe Token: SeDebugPrivilege 1712 wlanext.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Po-covid19 2372#w2..exeExplorer.EXEwlanext.exedescription pid process target process PID 868 wrote to memory of 1336 868 Po-covid19 2372#w2..exe Po-covid19 2372#w2..exe PID 868 wrote to memory of 1336 868 Po-covid19 2372#w2..exe Po-covid19 2372#w2..exe PID 868 wrote to memory of 1336 868 Po-covid19 2372#w2..exe Po-covid19 2372#w2..exe PID 868 wrote to memory of 1336 868 Po-covid19 2372#w2..exe Po-covid19 2372#w2..exe PID 868 wrote to memory of 1336 868 Po-covid19 2372#w2..exe Po-covid19 2372#w2..exe PID 868 wrote to memory of 1336 868 Po-covid19 2372#w2..exe Po-covid19 2372#w2..exe PID 868 wrote to memory of 1336 868 Po-covid19 2372#w2..exe Po-covid19 2372#w2..exe PID 1200 wrote to memory of 1712 1200 Explorer.EXE wlanext.exe PID 1200 wrote to memory of 1712 1200 Explorer.EXE wlanext.exe PID 1200 wrote to memory of 1712 1200 Explorer.EXE wlanext.exe PID 1200 wrote to memory of 1712 1200 Explorer.EXE wlanext.exe PID 1712 wrote to memory of 1740 1712 wlanext.exe cmd.exe PID 1712 wrote to memory of 1740 1712 wlanext.exe cmd.exe PID 1712 wrote to memory of 1740 1712 wlanext.exe cmd.exe PID 1712 wrote to memory of 1740 1712 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Po-covid19 2372#w2..exe"C:\Users\Admin\AppData\Local\Temp\Po-covid19 2372#w2..exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Po-covid19 2372#w2..exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Po-covid19 2372#w2..exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/868-2-0x00000000741E0000-0x00000000748CE000-memory.dmpFilesize
6.9MB
-
memory/868-3-0x0000000001390000-0x0000000001391000-memory.dmpFilesize
4KB
-
memory/868-5-0x0000000000380000-0x000000000038E000-memory.dmpFilesize
56KB
-
memory/868-6-0x0000000000420000-0x000000000049F000-memory.dmpFilesize
508KB
-
memory/1336-7-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1336-8-0x000000000041EDF0-mapping.dmp
-
memory/1712-9-0x0000000000000000-mapping.dmp
-
memory/1712-10-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1712-12-0x0000000002060000-0x0000000002180000-memory.dmpFilesize
1.1MB
-
memory/1740-11-0x0000000000000000-mapping.dmp