Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-01-2021 07:37
Static task
static1
Behavioral task
behavioral1
Sample
Po-covid19 2372#w2..exe
Resource
win7v20201028
General
-
Target
Po-covid19 2372#w2..exe
-
Size
1.2MB
-
MD5
bf53c9dc0d0f032033c318aceef906c6
-
SHA1
eeba1ef352c09979dfdfb4afdcdc5f41fe2a0119
-
SHA256
a1558391914f4235dfdcdddcdf0de915a800541a4271feb4aff34af82b83a935
-
SHA512
7db00f26f4c0e6e6865ff4561ace1d6af4c8804e8534b29d6b1977f48c1863b7fbbd766a360e9d400aad4070568d33247e832b07da69a482004f14eab7c61383
Malware Config
Extracted
formbook
http://www.styrelseforum.com/p95n/
kimberlyrutledge.com
auctus.agency
johnemotions.com
guilt-brilliant.com
wxshangdian.com
theolivetreeonline.com
stellarfranchisebrands.com
every1no1.com
hoangthanhgroup.com
psm-gen.com
kingdomwow.com
digitalksr.com
karynpolitoforlg.com
youthdaycalgary.com
libertyhandymanservicesllc.com
breatheohio.com
allenleather.com
transformafter50.info
hnhsylsb.com
hmtradebd.com
besrhodislandhomes.com
zuwozo.com
southernhighlandsnails.com
kaaxg.com
bauer-cobolt.com
steelyourselfshop.net
linksoflondoncharmscheap.com
groundwork-pt.com
beautifulangelicskin.com
aduhelmfinancialsupport.com
xn--carpinteratarifa-hsb.com
thekingink.net
ocotegrill.com
gilbertdodge.com
insuranceinquirer.com
withagentcy.com
deeparchivesvpn.com
blamekd.com
acsdealta.xyz
dsxcj.com
kimonoshihan.com
bosquefamily.com
5587sk.com
integrative.life
unitedjournal.info
lynxdeck.com
onlyfanyou.com
aminomedicalscience.com
rachenstern-technik.com
thejewelrybox.net
stopcolleges.com
thesaltlifestyle.com
tappesupportservices.com
andrewgreenhomes.com
meidiansc.com
gobalexporter.com
rvpji571m.xyz
alwekalaaladabeya.com
scientificimaginetics.com
skaizenpharma.com
balloonpost.club
thefunnythingabout.com
premium-vitality.com
businesscalmcoaching.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/580-11-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/580-12-0x000000000041EDF0-mapping.dmp formbook behavioral2/memory/832-13-0x0000000000000000-mapping.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Po-covid19 2372#w2..exePo-covid19 2372#w2..execolorcpl.exedescription pid process target process PID 4756 set thread context of 580 4756 Po-covid19 2372#w2..exe Po-covid19 2372#w2..exe PID 580 set thread context of 3012 580 Po-covid19 2372#w2..exe Explorer.EXE PID 580 set thread context of 3012 580 Po-covid19 2372#w2..exe Explorer.EXE PID 832 set thread context of 3012 832 colorcpl.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 52 IoCs
Processes:
Po-covid19 2372#w2..exePo-covid19 2372#w2..execolorcpl.exepid process 4756 Po-covid19 2372#w2..exe 4756 Po-covid19 2372#w2..exe 4756 Po-covid19 2372#w2..exe 4756 Po-covid19 2372#w2..exe 580 Po-covid19 2372#w2..exe 580 Po-covid19 2372#w2..exe 580 Po-covid19 2372#w2..exe 580 Po-covid19 2372#w2..exe 580 Po-covid19 2372#w2..exe 580 Po-covid19 2372#w2..exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe 832 colorcpl.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Po-covid19 2372#w2..execolorcpl.exepid process 580 Po-covid19 2372#w2..exe 580 Po-covid19 2372#w2..exe 580 Po-covid19 2372#w2..exe 580 Po-covid19 2372#w2..exe 832 colorcpl.exe 832 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Po-covid19 2372#w2..exePo-covid19 2372#w2..execolorcpl.exedescription pid process Token: SeDebugPrivilege 4756 Po-covid19 2372#w2..exe Token: SeDebugPrivilege 580 Po-covid19 2372#w2..exe Token: SeDebugPrivilege 832 colorcpl.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Po-covid19 2372#w2..exeExplorer.EXEcolorcpl.exedescription pid process target process PID 4756 wrote to memory of 520 4756 Po-covid19 2372#w2..exe Po-covid19 2372#w2..exe PID 4756 wrote to memory of 520 4756 Po-covid19 2372#w2..exe Po-covid19 2372#w2..exe PID 4756 wrote to memory of 520 4756 Po-covid19 2372#w2..exe Po-covid19 2372#w2..exe PID 4756 wrote to memory of 584 4756 Po-covid19 2372#w2..exe Po-covid19 2372#w2..exe PID 4756 wrote to memory of 584 4756 Po-covid19 2372#w2..exe Po-covid19 2372#w2..exe PID 4756 wrote to memory of 584 4756 Po-covid19 2372#w2..exe Po-covid19 2372#w2..exe PID 4756 wrote to memory of 580 4756 Po-covid19 2372#w2..exe Po-covid19 2372#w2..exe PID 4756 wrote to memory of 580 4756 Po-covid19 2372#w2..exe Po-covid19 2372#w2..exe PID 4756 wrote to memory of 580 4756 Po-covid19 2372#w2..exe Po-covid19 2372#w2..exe PID 4756 wrote to memory of 580 4756 Po-covid19 2372#w2..exe Po-covid19 2372#w2..exe PID 4756 wrote to memory of 580 4756 Po-covid19 2372#w2..exe Po-covid19 2372#w2..exe PID 4756 wrote to memory of 580 4756 Po-covid19 2372#w2..exe Po-covid19 2372#w2..exe PID 3012 wrote to memory of 832 3012 Explorer.EXE colorcpl.exe PID 3012 wrote to memory of 832 3012 Explorer.EXE colorcpl.exe PID 3012 wrote to memory of 832 3012 Explorer.EXE colorcpl.exe PID 832 wrote to memory of 1004 832 colorcpl.exe cmd.exe PID 832 wrote to memory of 1004 832 colorcpl.exe cmd.exe PID 832 wrote to memory of 1004 832 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Po-covid19 2372#w2..exe"C:\Users\Admin\AppData\Local\Temp\Po-covid19 2372#w2..exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Po-covid19 2372#w2..exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Po-covid19 2372#w2..exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Po-covid19 2372#w2..exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Po-covid19 2372#w2..exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/580-11-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/580-12-0x000000000041EDF0-mapping.dmp
-
memory/832-15-0x0000000000D20000-0x0000000000D39000-memory.dmpFilesize
100KB
-
memory/832-13-0x0000000000000000-mapping.dmp
-
memory/832-17-0x0000000005790000-0x000000000591A000-memory.dmpFilesize
1.5MB
-
memory/832-14-0x0000000000D20000-0x0000000000D39000-memory.dmpFilesize
100KB
-
memory/1004-16-0x0000000000000000-mapping.dmp
-
memory/3012-18-0x00000000065E0000-0x00000000066F1000-memory.dmpFilesize
1.1MB
-
memory/4756-3-0x0000000000F10000-0x0000000000F11000-memory.dmpFilesize
4KB
-
memory/4756-6-0x0000000007DA0000-0x0000000007DA1000-memory.dmpFilesize
4KB
-
memory/4756-5-0x0000000008200000-0x0000000008201000-memory.dmpFilesize
4KB
-
memory/4756-10-0x000000000A2F0000-0x000000000A2F1000-memory.dmpFilesize
4KB
-
memory/4756-2-0x0000000073150000-0x000000007383E000-memory.dmpFilesize
6.9MB
-
memory/4756-9-0x0000000003170000-0x00000000031EF000-memory.dmpFilesize
508KB
-
memory/4756-8-0x000000000A2E0000-0x000000000A2EE000-memory.dmpFilesize
56KB
-
memory/4756-7-0x0000000007D80000-0x0000000007D81000-memory.dmpFilesize
4KB