Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-01-2021 08:47
Static task
static1
Behavioral task
behavioral1
Sample
mTF1eRdnr0OV8c4.exe
Resource
win7v20201028
General
-
Target
mTF1eRdnr0OV8c4.exe
-
Size
863KB
-
MD5
109a86a9bff8c2bed48d2538fc38f45a
-
SHA1
8ecb82a010603806273c4c76d374cf53c622c0ed
-
SHA256
bae8d59b05bc0896419e973105103ada842908c24340e88e7444b7c640664b83
-
SHA512
1eef1d45689f8080cc9d8a2ebc19aefabe0e52ac6bf9653522e4116d9eff19047b5032a205fd78867a710f18842e0befe141044f0b1194df9ce84144ce626b0c
Malware Config
Extracted
formbook
http://www.badstar.net/tmz/
easywebplacenetlaramie.com
kushions.today
wallsbilplat.com
csgetdegrees.com
wujuenong.net
bhsentertainmentnews.com
worpar.com
ivappsglobal.com
talktogiamfoods.com
nagoyasteakandsushi.com
blockchaininfo.site
unitylinkonlie.com
sofiavoz.com
livesportsite.com
wishesandmessages.com
diningroomspaintcolorsideas.com
landnlushscents.com
metrosdahospitals.com
coast2coastrent.com
turkhristiyanbirligi.com
bootyindex.com
techinvestor.net
monitribe.com
eternallyremember.com
hsedorganics.com
cyberxyno.com
sorbo-balance.xyz
zhtthb.com
threeseedsjewelry.com
h678ui.com
paginaswebpro.com
coffreauxtissus.com
geraloheseuine.com
jvspin-casino.net
nabis27.com
artismart.com
pinewoodshop.site
littlestickdesigns.com
wvvvo.com
billiards-elite.net
mossbergenterprises.com
pdfbookplanet.com
hangerb2b.com
freisaq.com
asnomayritys.com
tbluedotlivewdmall.com
gaberivescorbett.com
innertwinearts.com
furniturevision.com
belle.productions
jabaki.com
shopcryptocurrency247.com
citestaccnt1597752045.com
eni-corp.com
shopkingbodhi.com
voques-tfr.xyz
zhxtt.space
webspicebd.com
outletinmuebles.com
mymoneyoil.com
slingshotct.com
mmcllcbiz.com
petrawie.com
misuperblog.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2220-11-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2220-12-0x000000000041EB70-mapping.dmp formbook behavioral2/memory/2532-13-0x0000000000000000-mapping.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
mTF1eRdnr0OV8c4.exemTF1eRdnr0OV8c4.execolorcpl.exedescription pid process target process PID 648 set thread context of 2220 648 mTF1eRdnr0OV8c4.exe mTF1eRdnr0OV8c4.exe PID 2220 set thread context of 2580 2220 mTF1eRdnr0OV8c4.exe Explorer.EXE PID 2532 set thread context of 2580 2532 colorcpl.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
mTF1eRdnr0OV8c4.execolorcpl.exepid process 2220 mTF1eRdnr0OV8c4.exe 2220 mTF1eRdnr0OV8c4.exe 2220 mTF1eRdnr0OV8c4.exe 2220 mTF1eRdnr0OV8c4.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe 2532 colorcpl.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
mTF1eRdnr0OV8c4.execolorcpl.exepid process 2220 mTF1eRdnr0OV8c4.exe 2220 mTF1eRdnr0OV8c4.exe 2220 mTF1eRdnr0OV8c4.exe 2532 colorcpl.exe 2532 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
mTF1eRdnr0OV8c4.execolorcpl.exedescription pid process Token: SeDebugPrivilege 2220 mTF1eRdnr0OV8c4.exe Token: SeDebugPrivilege 2532 colorcpl.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2580 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
mTF1eRdnr0OV8c4.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 648 wrote to memory of 2220 648 mTF1eRdnr0OV8c4.exe mTF1eRdnr0OV8c4.exe PID 648 wrote to memory of 2220 648 mTF1eRdnr0OV8c4.exe mTF1eRdnr0OV8c4.exe PID 648 wrote to memory of 2220 648 mTF1eRdnr0OV8c4.exe mTF1eRdnr0OV8c4.exe PID 648 wrote to memory of 2220 648 mTF1eRdnr0OV8c4.exe mTF1eRdnr0OV8c4.exe PID 648 wrote to memory of 2220 648 mTF1eRdnr0OV8c4.exe mTF1eRdnr0OV8c4.exe PID 648 wrote to memory of 2220 648 mTF1eRdnr0OV8c4.exe mTF1eRdnr0OV8c4.exe PID 2580 wrote to memory of 2532 2580 Explorer.EXE colorcpl.exe PID 2580 wrote to memory of 2532 2580 Explorer.EXE colorcpl.exe PID 2580 wrote to memory of 2532 2580 Explorer.EXE colorcpl.exe PID 2532 wrote to memory of 3472 2532 colorcpl.exe cmd.exe PID 2532 wrote to memory of 3472 2532 colorcpl.exe cmd.exe PID 2532 wrote to memory of 3472 2532 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mTF1eRdnr0OV8c4.exe"C:\Users\Admin\AppData\Local\Temp\mTF1eRdnr0OV8c4.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mTF1eRdnr0OV8c4.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\mTF1eRdnr0OV8c4.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/648-9-0x0000000007AC0000-0x0000000007B50000-memory.dmpFilesize
576KB
-
memory/648-2-0x0000000073F80000-0x000000007466E000-memory.dmpFilesize
6.9MB
-
memory/648-5-0x0000000005BD0000-0x0000000005BD1000-memory.dmpFilesize
4KB
-
memory/648-6-0x0000000005620000-0x0000000005621000-memory.dmpFilesize
4KB
-
memory/648-7-0x00000000056D0000-0x00000000056D1000-memory.dmpFilesize
4KB
-
memory/648-8-0x0000000005BB0000-0x0000000005BBE000-memory.dmpFilesize
56KB
-
memory/648-3-0x0000000000D20000-0x0000000000D21000-memory.dmpFilesize
4KB
-
memory/648-10-0x0000000007BF0000-0x0000000007BF1000-memory.dmpFilesize
4KB
-
memory/2220-11-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2220-12-0x000000000041EB70-mapping.dmp
-
memory/2532-13-0x0000000000000000-mapping.dmp
-
memory/2532-14-0x0000000000CB0000-0x0000000000CC9000-memory.dmpFilesize
100KB
-
memory/2532-15-0x0000000000CB0000-0x0000000000CC9000-memory.dmpFilesize
100KB
-
memory/2532-17-0x0000000005D60000-0x0000000005EC0000-memory.dmpFilesize
1.4MB
-
memory/3472-16-0x0000000000000000-mapping.dmp