Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-01-2021 04:58
Static task
static1
Behavioral task
behavioral1
Sample
15012021.exe
Resource
win7v20201028
General
-
Target
15012021.exe
-
Size
896KB
-
MD5
49eaef0a7cb0cb134803b5f0697dde4b
-
SHA1
74c9d06f4ffb47f349e68aeafa7d599ce240815b
-
SHA256
9a9ac9671ba6e6954776498cf28264d6c1742bc52fb070d7736d83a3582a14c8
-
SHA512
6d03e0521eac228a5077a2c994a2d3a6660940b2415c3e5f2642baeddbc7ff2f814c11f99e16a43c11f62dca5a0ced647d903ff4a75cedfd792e7d98cf1b66c9
Malware Config
Extracted
formbook
http://www.timoniks.com/rbg/
fingermode.com
parkplace.finance
hollandgreen2020.com
starbets.site
vehiculesfrigorifiques.com
sydiifinancial.com
rpivuenation.com
freesubdirectory.com
independencepartynyc.com
dogruparti.info
independencecountyclub.com
midnightlashesbykim.com
digitalsept.com
whatilikeabouttoday.com
marktplaatsaccount.info
13400667334.com
xinwei-ge.com
login-appleid.info
momashands.com
kennyxpress.com
yushin2733.com
olenfex.com
agorabookstore.com
iotajinn.com
511tea.com
sullian.com
virtuallawyerservices.com
machineryhunters.online
mintamuntaz.com
sunflowerhybrid.com
hocbai24h.com
bundletvdeal.com
engjape.com
villamariaapartments.com
arabaozellikleri.net
fortheloveofdawg.com
mullinsmusicministry.com
rescuecellphones.com
infinityenterpriselr.com
humormug.com
summitplazagurgaon.com
rogo24.com
apluspartybus.com
chernliyfashion.com
presentvaluecore.com
bangbangfactory.com
leandroresolve.com
hk6628.com
anotherheadache.com
jiemanwu.com
a1dandyhandyman.com
pennsylvaniacraft.com
vrank.icu
avivemg.icu
littlestarenglish.com
jrprofessionale.com
belze.net
svtrbu.com
healthpassportasia.com
kadakudu.com
rahatindir.com
seamssewmuchbetter.com
brancusi.net
ido.lgbt
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1524-12-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/1524-13-0x000000000041EB40-mapping.dmp formbook behavioral2/memory/3600-14-0x0000000000000000-mapping.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
15012021.exe15012021.execscript.exedescription pid process target process PID 576 set thread context of 1524 576 15012021.exe 15012021.exe PID 1524 set thread context of 3040 1524 15012021.exe Explorer.EXE PID 3600 set thread context of 3040 3600 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 38 IoCs
Processes:
15012021.execscript.exepid process 1524 15012021.exe 1524 15012021.exe 1524 15012021.exe 1524 15012021.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe 3600 cscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
15012021.execscript.exepid process 1524 15012021.exe 1524 15012021.exe 1524 15012021.exe 3600 cscript.exe 3600 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
15012021.execscript.exedescription pid process Token: SeDebugPrivilege 1524 15012021.exe Token: SeDebugPrivilege 3600 cscript.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3040 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
15012021.exeExplorer.EXEcscript.exedescription pid process target process PID 576 wrote to memory of 1524 576 15012021.exe 15012021.exe PID 576 wrote to memory of 1524 576 15012021.exe 15012021.exe PID 576 wrote to memory of 1524 576 15012021.exe 15012021.exe PID 576 wrote to memory of 1524 576 15012021.exe 15012021.exe PID 576 wrote to memory of 1524 576 15012021.exe 15012021.exe PID 576 wrote to memory of 1524 576 15012021.exe 15012021.exe PID 3040 wrote to memory of 3600 3040 Explorer.EXE cscript.exe PID 3040 wrote to memory of 3600 3040 Explorer.EXE cscript.exe PID 3040 wrote to memory of 3600 3040 Explorer.EXE cscript.exe PID 3600 wrote to memory of 1336 3600 cscript.exe cmd.exe PID 3600 wrote to memory of 1336 3600 cscript.exe cmd.exe PID 3600 wrote to memory of 1336 3600 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\15012021.exe"C:\Users\Admin\AppData\Local\Temp\15012021.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\15012021.exe"C:\Users\Admin\AppData\Local\Temp\15012021.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\15012021.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/576-11-0x0000000005810000-0x0000000005875000-memory.dmpFilesize
404KB
-
memory/576-9-0x0000000005550000-0x0000000005551000-memory.dmpFilesize
4KB
-
memory/576-5-0x00000000052F0000-0x00000000052F1000-memory.dmpFilesize
4KB
-
memory/576-6-0x0000000005890000-0x0000000005891000-memory.dmpFilesize
4KB
-
memory/576-2-0x0000000073190000-0x000000007387E000-memory.dmpFilesize
6.9MB
-
memory/576-8-0x0000000005270000-0x0000000005271000-memory.dmpFilesize
4KB
-
memory/576-3-0x0000000000970000-0x0000000000971000-memory.dmpFilesize
4KB
-
memory/576-10-0x00000000052B0000-0x00000000052C2000-memory.dmpFilesize
72KB
-
memory/576-7-0x0000000005390000-0x0000000005391000-memory.dmpFilesize
4KB
-
memory/1336-17-0x0000000000000000-mapping.dmp
-
memory/1524-12-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1524-13-0x000000000041EB40-mapping.dmp
-
memory/3600-14-0x0000000000000000-mapping.dmp
-
memory/3600-15-0x00000000013C0000-0x00000000013E7000-memory.dmpFilesize
156KB
-
memory/3600-16-0x00000000013C0000-0x00000000013E7000-memory.dmpFilesize
156KB
-
memory/3600-18-0x00000000056E0000-0x00000000057C8000-memory.dmpFilesize
928KB