Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-01-2021 06:54
Static task
static1
Behavioral task
behavioral1
Sample
Request a quote Mitsubishi Japan XN501.exe
Resource
win7v20201028
General
-
Target
Request a quote Mitsubishi Japan XN501.exe
-
Size
858KB
-
MD5
d5079ba6252ba0df47a279c217f79abe
-
SHA1
1088019f6828d3b01dbaa44a7f27cad6d00bbcd2
-
SHA256
b6dc1192212d0ae4c5509491a96602f9c3da82694097372e9bf5ae03ca86adba
-
SHA512
629fce6fa602b30e8d82b980de1a777e87840b2377757fbef18c5037b7d47a54c3c3eec5872da0eec1573807815d45192ccf9b8f8daf53b56dda41baf5ce9193
Malware Config
Extracted
formbook
http://www.9dgevjb.net/gtl/
45687g.net
graveimport.com
bulldogsgear.com
service-support.email
uhzcflg.icu
zebradefensefund.com
make10xhappen.com
ecotegral.online
stillatwink.site
onwardatlanta.com
real-optionstheory.com
madbearcustomwoodworking.com
adelinekaczmarek.com
elia-lca.com
tinykreations.com
rawlinsrealty.info
ubcholdings.com
searko.com
lepinedoree.com
fundsrecoveryexperts.com
hdbymaggie.com
melhoresradios.com
natachez.com
nosquitos.com
skfashion-bd.com
healthyhabitsdiary.com
figcondos.com
torontobet109.xyz
k5759.com
everythingnitro.com
yolocraft.online
girlsweet88.online
beiser-sa.com
blackcardofsuccess.com
aprodigaldaughter.com
nxjiuding.com
objetboiscreative.com
angelinafurusho.com
uavphotoworld.com
melbet-official-bk-info.com
besthalalguide.com
samsungbtb.com
illawarrablinds.com
ratgeber-aktuell.info
tiktokmerch.club
zx565.com
sit-techno.com
leveragewholesaler.com
mymailtek.com
xb-xsy.com
caileygrunhard.com
pibyx.com
rnshaircare.com
todopilates.com
aureusgoldcorp.com
lblcclkchain.com
starlyconsulting.com
ndjamua.com
ahoradanoticia.net
mtcrosbyphotography.com
cutecvv.business
dach-realestate.com
assetmanagmentservices.com
sainu.website
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1336-11-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/1336-12-0x000000000041EAF0-mapping.dmp formbook behavioral2/memory/2748-13-0x0000000000000000-mapping.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Request a quote Mitsubishi Japan XN501.exeRequest a quote Mitsubishi Japan XN501.exemsiexec.exedescription pid process target process PID 2604 set thread context of 1336 2604 Request a quote Mitsubishi Japan XN501.exe Request a quote Mitsubishi Japan XN501.exe PID 1336 set thread context of 2828 1336 Request a quote Mitsubishi Japan XN501.exe Explorer.EXE PID 2748 set thread context of 2828 2748 msiexec.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
Request a quote Mitsubishi Japan XN501.exeRequest a quote Mitsubishi Japan XN501.exemsiexec.exepid process 2604 Request a quote Mitsubishi Japan XN501.exe 2604 Request a quote Mitsubishi Japan XN501.exe 1336 Request a quote Mitsubishi Japan XN501.exe 1336 Request a quote Mitsubishi Japan XN501.exe 1336 Request a quote Mitsubishi Japan XN501.exe 1336 Request a quote Mitsubishi Japan XN501.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe 2748 msiexec.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Request a quote Mitsubishi Japan XN501.exemsiexec.exepid process 1336 Request a quote Mitsubishi Japan XN501.exe 1336 Request a quote Mitsubishi Japan XN501.exe 1336 Request a quote Mitsubishi Japan XN501.exe 2748 msiexec.exe 2748 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Request a quote Mitsubishi Japan XN501.exeRequest a quote Mitsubishi Japan XN501.exemsiexec.exedescription pid process Token: SeDebugPrivilege 2604 Request a quote Mitsubishi Japan XN501.exe Token: SeDebugPrivilege 1336 Request a quote Mitsubishi Japan XN501.exe Token: SeDebugPrivilege 2748 msiexec.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Request a quote Mitsubishi Japan XN501.exeExplorer.EXEmsiexec.exedescription pid process target process PID 2604 wrote to memory of 2244 2604 Request a quote Mitsubishi Japan XN501.exe Request a quote Mitsubishi Japan XN501.exe PID 2604 wrote to memory of 2244 2604 Request a quote Mitsubishi Japan XN501.exe Request a quote Mitsubishi Japan XN501.exe PID 2604 wrote to memory of 2244 2604 Request a quote Mitsubishi Japan XN501.exe Request a quote Mitsubishi Japan XN501.exe PID 2604 wrote to memory of 1336 2604 Request a quote Mitsubishi Japan XN501.exe Request a quote Mitsubishi Japan XN501.exe PID 2604 wrote to memory of 1336 2604 Request a quote Mitsubishi Japan XN501.exe Request a quote Mitsubishi Japan XN501.exe PID 2604 wrote to memory of 1336 2604 Request a quote Mitsubishi Japan XN501.exe Request a quote Mitsubishi Japan XN501.exe PID 2604 wrote to memory of 1336 2604 Request a quote Mitsubishi Japan XN501.exe Request a quote Mitsubishi Japan XN501.exe PID 2604 wrote to memory of 1336 2604 Request a quote Mitsubishi Japan XN501.exe Request a quote Mitsubishi Japan XN501.exe PID 2604 wrote to memory of 1336 2604 Request a quote Mitsubishi Japan XN501.exe Request a quote Mitsubishi Japan XN501.exe PID 2828 wrote to memory of 2748 2828 Explorer.EXE msiexec.exe PID 2828 wrote to memory of 2748 2828 Explorer.EXE msiexec.exe PID 2828 wrote to memory of 2748 2828 Explorer.EXE msiexec.exe PID 2748 wrote to memory of 748 2748 msiexec.exe cmd.exe PID 2748 wrote to memory of 748 2748 msiexec.exe cmd.exe PID 2748 wrote to memory of 748 2748 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Request a quote Mitsubishi Japan XN501.exe"C:\Users\Admin\AppData\Local\Temp\Request a quote Mitsubishi Japan XN501.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Request a quote Mitsubishi Japan XN501.exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Request a quote Mitsubishi Japan XN501.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Request a quote Mitsubishi Japan XN501.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/748-16-0x0000000000000000-mapping.dmp
-
memory/1336-11-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1336-12-0x000000000041EAF0-mapping.dmp
-
memory/2604-6-0x0000000005640000-0x0000000005641000-memory.dmpFilesize
4KB
-
memory/2604-7-0x00000000056E0000-0x00000000056E1000-memory.dmpFilesize
4KB
-
memory/2604-8-0x0000000005860000-0x000000000586E000-memory.dmpFilesize
56KB
-
memory/2604-9-0x0000000007B00000-0x0000000007B8F000-memory.dmpFilesize
572KB
-
memory/2604-10-0x0000000007C30000-0x0000000007C31000-memory.dmpFilesize
4KB
-
memory/2604-2-0x0000000073940000-0x000000007402E000-memory.dmpFilesize
6.9MB
-
memory/2604-5-0x0000000005C10000-0x0000000005C11000-memory.dmpFilesize
4KB
-
memory/2604-3-0x0000000000D40000-0x0000000000D41000-memory.dmpFilesize
4KB
-
memory/2748-13-0x0000000000000000-mapping.dmp
-
memory/2748-14-0x00000000002A0000-0x00000000002B2000-memory.dmpFilesize
72KB
-
memory/2748-15-0x00000000002A0000-0x00000000002B2000-memory.dmpFilesize
72KB
-
memory/2748-17-0x0000000005670000-0x00000000057C3000-memory.dmpFilesize
1.3MB