Analysis
-
max time kernel
147s -
max time network
144s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-01-2021 20:20
Static task
static1
Behavioral task
behavioral1
Sample
ins.exe
Resource
win7v20201028
General
-
Target
ins.exe
-
Size
311KB
-
MD5
689ce116559e5aa27f5b8dcd91406e08
-
SHA1
6092abe31afd20dfaa023bba7d9c0e1c000236b3
-
SHA256
de6f5b39f4129ed442da26837a296a2b2e9573af841cc7fc41a5a72d4c673de7
-
SHA512
d315d45328a6e9b4af40600637f720a8b6df640253284e7f6860333d98b57062bec4c8dc88b195264b398b3e6808bd85ab128e3e6b7c18e99f25e545945a2606
Malware Config
Extracted
formbook
http://www.nationshiphop.com/hko6/
apartmentsineverettwa.com
forritcu.net
hotroodes.com
skinnerttc.com
royaltrustmyanmar.com
adreslog.com
kaysbridalboutiques.com
multitask-improvements.com
geniiforum.com
smarthomehatinh.asia
banglikeaboss.com
javlover.club
affiliateclubindia.com
mycapecoralhomevalue.com
comparamuebles.online
newrochellenissan.com
nairobi-paris.com
fwk.xyz
downdepot.com
nextgenmemorabilia.com
achonabu.com
stevebana.xyz
jacmkt.com
weownthenight187.com
divshop.pro
wewearceylon.com
skyreadymix.net
jaffacorner.com
bakerlibra.icu
femalecoliving.com
best20banks.com
millcityloam.com
signature-office.com
qlifepharmacy.com
dextermind.net
fittcycleacademy.com
davidoff.sucks
1033393.com
tutorsboulder.com
bonicc.com
goodberryjuice.com
zhaowulu.com
teryaq.media
a-zsolutionsllc.com
bitcoincandy.xyz
cfmfair.com
annefontain.com
princesssexyluxwear.com
prodigybrushes.com
zzhqp.com
hwcailing.com
translatiions.com
azery.site
wy1917.com
ringohouse.info
chartershome.com
thongtinhay.net
2201virginiacondo5.com
laurieryork.net
mujeresnegociantes.com
anchoriaswimwear.com
michaelsala.com
esdeportebici.com
ninjitsoo.com
Signatures
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1384-2-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1384-3-0x000000000041ECF0-mapping.dmp formbook behavioral1/memory/596-4-0x00000000004E0000-0x0000000000505000-memory.dmp formbook behavioral1/memory/1792-5-0x0000000000000000-mapping.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1368 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
ins.exeins.execmmon32.exedescription pid process target process PID 596 set thread context of 1384 596 ins.exe ins.exe PID 1384 set thread context of 1248 1384 ins.exe Explorer.EXE PID 1792 set thread context of 1248 1792 cmmon32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
ins.execmmon32.exepid process 1384 ins.exe 1384 ins.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe 1792 cmmon32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
ins.exeins.execmmon32.exepid process 596 ins.exe 1384 ins.exe 1384 ins.exe 1384 ins.exe 1792 cmmon32.exe 1792 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ins.execmmon32.exedescription pid process Token: SeDebugPrivilege 1384 ins.exe Token: SeDebugPrivilege 1792 cmmon32.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
ins.exeExplorer.EXEcmmon32.exedescription pid process target process PID 596 wrote to memory of 1384 596 ins.exe ins.exe PID 596 wrote to memory of 1384 596 ins.exe ins.exe PID 596 wrote to memory of 1384 596 ins.exe ins.exe PID 596 wrote to memory of 1384 596 ins.exe ins.exe PID 596 wrote to memory of 1384 596 ins.exe ins.exe PID 1248 wrote to memory of 1792 1248 Explorer.EXE cmmon32.exe PID 1248 wrote to memory of 1792 1248 Explorer.EXE cmmon32.exe PID 1248 wrote to memory of 1792 1248 Explorer.EXE cmmon32.exe PID 1248 wrote to memory of 1792 1248 Explorer.EXE cmmon32.exe PID 1792 wrote to memory of 1368 1792 cmmon32.exe cmd.exe PID 1792 wrote to memory of 1368 1792 cmmon32.exe cmd.exe PID 1792 wrote to memory of 1368 1792 cmmon32.exe cmd.exe PID 1792 wrote to memory of 1368 1792 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ins.exe"C:\Users\Admin\AppData\Local\Temp\ins.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ins.exe"C:\Users\Admin\AppData\Local\Temp\ins.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ins.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/596-4-0x00000000004E0000-0x0000000000505000-memory.dmpFilesize
148KB
-
memory/1368-7-0x0000000000000000-mapping.dmp
-
memory/1384-2-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1384-3-0x000000000041ECF0-mapping.dmp
-
memory/1792-5-0x0000000000000000-mapping.dmp
-
memory/1792-6-0x0000000000320000-0x000000000032D000-memory.dmpFilesize
52KB
-
memory/1792-8-0x0000000001FD0000-0x000000000209C000-memory.dmpFilesize
816KB