Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-01-2021 20:05
Static task
static1
Behavioral task
behavioral1
Sample
PO101420.exe
Resource
win7v20201028
General
-
Target
PO101420.exe
-
Size
837KB
-
MD5
ff9de567dd3c2aa2ebcb5e0450964875
-
SHA1
aeb352d5031fa9cd1f5a3e1a69c4c4740634956c
-
SHA256
709b457160612a42a7714a517690760f05b09fb55f61570632500aa14328deec
-
SHA512
b850406f9db839d5678997713034106c94c36d500f774ae222a086dcb9e693f450ba686f6ab13f6e9a07bf91e9aa92626a49e73a761d80c502c89f2ab3be279e
Malware Config
Extracted
formbook
http://www.hundsprobleme.com/fcxy/
3dimex.com
heartgem.net
jhfctzdsna.club
lurapures.com
musclegirlfix.com
zebragenetics.com
evyneellis.com
jiaxiaozx.com
kayanmag.com
ufomars.com
liverepaire.com
hitspluz.com
regulargirlhair.com
lafleurdulis.com
secretsseniorengineersknow.com
zoerichards.photos
alphaappraisal.net
southernrussia.com
jbskatingmuseum.com
lawxorder.art
savvykidworld.com
arjohuntleigh.sucks
topchoicemen.net
velvetmuonline.com
asen4d.com
chenqiao.site
wooowweb.com
islamicmoneypedia.com
vacadilloscarneseca.com
ultikrons.com
turanvipturizm.com
kegelbahnkeeper.net
les-crafteurs.com
theourworld.foundation
fortislifesciences.com
gforcestocks.com
bgfetgr.net
densichi-shop.website
careercanny.com
germluxclean.com
ubsumberbarokah.com
yqmagic.com
atelierbeaumur.site
rocketopinions.net
kardgo.com
jumben.xyz
zoomenglish.icu
shcrkx.com
imedicineq.online
cityloras.com
quraanpro.net
mudkingdom.com
scarvesandseas.com
pipsbp.net
materialarchives.press
weselltoday.com
suprimy.pro
buybrouhaha.com
ssxinwenw.com
ificanhelp.com
gabrielesv.com
denverdefensejobs.com
386215.com
californiaculinarywellness.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/932-11-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/932-12-0x000000000041ECE0-mapping.dmp formbook behavioral2/memory/2828-13-0x0000000000000000-mapping.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO101420.exeMSBuild.execmstp.exedescription pid process target process PID 4040 set thread context of 932 4040 PO101420.exe MSBuild.exe PID 932 set thread context of 3068 932 MSBuild.exe Explorer.EXE PID 2828 set thread context of 3068 2828 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
MSBuild.execmstp.exepid process 932 MSBuild.exe 932 MSBuild.exe 932 MSBuild.exe 932 MSBuild.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe 2828 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
MSBuild.execmstp.exepid process 932 MSBuild.exe 932 MSBuild.exe 932 MSBuild.exe 2828 cmstp.exe 2828 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
MSBuild.execmstp.exedescription pid process Token: SeDebugPrivilege 932 MSBuild.exe Token: SeDebugPrivilege 2828 cmstp.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3068 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PO101420.exeExplorer.EXEcmstp.exedescription pid process target process PID 4040 wrote to memory of 932 4040 PO101420.exe MSBuild.exe PID 4040 wrote to memory of 932 4040 PO101420.exe MSBuild.exe PID 4040 wrote to memory of 932 4040 PO101420.exe MSBuild.exe PID 4040 wrote to memory of 932 4040 PO101420.exe MSBuild.exe PID 4040 wrote to memory of 932 4040 PO101420.exe MSBuild.exe PID 4040 wrote to memory of 932 4040 PO101420.exe MSBuild.exe PID 3068 wrote to memory of 2828 3068 Explorer.EXE cmstp.exe PID 3068 wrote to memory of 2828 3068 Explorer.EXE cmstp.exe PID 3068 wrote to memory of 2828 3068 Explorer.EXE cmstp.exe PID 2828 wrote to memory of 1516 2828 cmstp.exe cmd.exe PID 2828 wrote to memory of 1516 2828 cmstp.exe cmd.exe PID 2828 wrote to memory of 1516 2828 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO101420.exe"C:\Users\Admin\AppData\Local\Temp\PO101420.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/932-11-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/932-12-0x000000000041ECE0-mapping.dmp
-
memory/1516-16-0x0000000000000000-mapping.dmp
-
memory/2828-17-0x0000000005A20000-0x0000000005B49000-memory.dmpFilesize
1.2MB
-
memory/2828-15-0x0000000001040000-0x0000000001056000-memory.dmpFilesize
88KB
-
memory/2828-14-0x0000000001040000-0x0000000001056000-memory.dmpFilesize
88KB
-
memory/2828-13-0x0000000000000000-mapping.dmp
-
memory/4040-6-0x0000000004F20000-0x0000000004F21000-memory.dmpFilesize
4KB
-
memory/4040-10-0x0000000007490000-0x0000000007491000-memory.dmpFilesize
4KB
-
memory/4040-9-0x0000000007350000-0x00000000073DD000-memory.dmpFilesize
564KB
-
memory/4040-8-0x0000000005190000-0x000000000519E000-memory.dmpFilesize
56KB
-
memory/4040-7-0x0000000004F00000-0x0000000004F01000-memory.dmpFilesize
4KB
-
memory/4040-2-0x00000000733D0000-0x0000000073ABE000-memory.dmpFilesize
6.9MB
-
memory/4040-5-0x0000000005420000-0x0000000005421000-memory.dmpFilesize
4KB
-
memory/4040-3-0x00000000005E0000-0x00000000005E1000-memory.dmpFilesize
4KB