Analysis
-
max time kernel
35s -
max time network
104s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-01-2021 19:44
Static task
static1
Behavioral task
behavioral1
Sample
e58bbe8181fc690e1b6d806514afaa6d.exe
Resource
win7v20201028
General
-
Target
e58bbe8181fc690e1b6d806514afaa6d.exe
-
Size
871KB
-
MD5
e58bbe8181fc690e1b6d806514afaa6d
-
SHA1
351a819674f7293a00dfed0f9e8c08a1dadad562
-
SHA256
30dd3160b2a93b2b20726e2707ad4781b8e6e3802865fc1f0582a3b9eb1644e0
-
SHA512
717ff39223e387d82e7b2fee06f9866bdcf86bfbaf5c7d42c435a568d7998810dd18a8703d345657badb13a54b4620cb2201739c28b08a4c0e52185c609e64d1
Malware Config
Extracted
formbook
http://www.bytecommunication.com/aky/
jeiksaoeklea.com
sagame-auto.net
soloseriolavoro.com
thecreatorsbook.com
superskritch.com
oroxequipment.com
heart-of-art.online
liwedfg.com
fisherofsouls.com
jota.xyz
nehyam.com
smart-contact-delivery.com
hoom.guru
dgryds.com
thesoakcpd.com
mishv.com
rings-factory.info
bero-craft-beers.com
podcastnamegenerators.com
856379813.xyz
ruinfectious.com
wdcsupport.com
youngbrokeandeducated.com
shpments75.com
louisbmartinez100th.com
shining.ink
hkexpresswaterford.com
quickcashoffersatl.com
180cliniconline.com
mainriskintl.com
clinicadosorriso.com
kuxueyunkeji.com
smart-acumen.com
maisonkerlann.com
jewishposter.com
xn--w52b77ujva.com
antoniodevivo.com
diversitypatriots.com
tiotacos.company
ventumgi.com
ip-tv.online
smithvilletexashistory.com
amruta-varshini.com
wildpositive.com
alifezap.com
nczjt.net
palmsvillaswhitneyranch.com
experiencemoretogether.com
dewitfire.com
scruffynotfluffy.online
bazarsurtidorico.com
dayscosmetics.com
tpsvegas.com
externalboard.com
2125lynchmere.com
agroplenty.com
easterneuropemall.com
whtoys888.com
writehousepoint.com
ppeaceandgloves.com
sadtire.press
jj3994.com
smokenengines.com
offplanprojects-re.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4400-11-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/4400-12-0x000000000041EB60-mapping.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e58bbe8181fc690e1b6d806514afaa6d.exedescription pid process target process PID 4760 set thread context of 4400 4760 e58bbe8181fc690e1b6d806514afaa6d.exe e58bbe8181fc690e1b6d806514afaa6d.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
e58bbe8181fc690e1b6d806514afaa6d.exepid process 4400 e58bbe8181fc690e1b6d806514afaa6d.exe 4400 e58bbe8181fc690e1b6d806514afaa6d.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
e58bbe8181fc690e1b6d806514afaa6d.exedescription pid process target process PID 4760 wrote to memory of 4400 4760 e58bbe8181fc690e1b6d806514afaa6d.exe e58bbe8181fc690e1b6d806514afaa6d.exe PID 4760 wrote to memory of 4400 4760 e58bbe8181fc690e1b6d806514afaa6d.exe e58bbe8181fc690e1b6d806514afaa6d.exe PID 4760 wrote to memory of 4400 4760 e58bbe8181fc690e1b6d806514afaa6d.exe e58bbe8181fc690e1b6d806514afaa6d.exe PID 4760 wrote to memory of 4400 4760 e58bbe8181fc690e1b6d806514afaa6d.exe e58bbe8181fc690e1b6d806514afaa6d.exe PID 4760 wrote to memory of 4400 4760 e58bbe8181fc690e1b6d806514afaa6d.exe e58bbe8181fc690e1b6d806514afaa6d.exe PID 4760 wrote to memory of 4400 4760 e58bbe8181fc690e1b6d806514afaa6d.exe e58bbe8181fc690e1b6d806514afaa6d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e58bbe8181fc690e1b6d806514afaa6d.exe"C:\Users\Admin\AppData\Local\Temp\e58bbe8181fc690e1b6d806514afaa6d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e58bbe8181fc690e1b6d806514afaa6d.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4400-11-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/4400-12-0x000000000041EB60-mapping.dmp
-
memory/4760-2-0x0000000073150000-0x000000007383E000-memory.dmpFilesize
6.9MB
-
memory/4760-3-0x00000000005E0000-0x00000000005E1000-memory.dmpFilesize
4KB
-
memory/4760-5-0x0000000005410000-0x0000000005411000-memory.dmpFilesize
4KB
-
memory/4760-6-0x0000000004FB0000-0x0000000004FB1000-memory.dmpFilesize
4KB
-
memory/4760-7-0x0000000004EF0000-0x0000000004EF1000-memory.dmpFilesize
4KB
-
memory/4760-8-0x00000000050C0000-0x00000000050CE000-memory.dmpFilesize
56KB
-
memory/4760-9-0x0000000007360000-0x00000000073F3000-memory.dmpFilesize
588KB
-
memory/4760-10-0x00000000074A0000-0x00000000074A1000-memory.dmpFilesize
4KB