Analysis
-
max time kernel
37s -
max time network
13s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-01-2021 06:47
Static task
static1
Behavioral task
behavioral1
Sample
c343b0f63b6c4dc9d3f5dd7864f6edd6.exe
Resource
win7v20201028
General
-
Target
c343b0f63b6c4dc9d3f5dd7864f6edd6.exe
-
Size
955KB
-
MD5
c343b0f63b6c4dc9d3f5dd7864f6edd6
-
SHA1
d28b97bb29685705b0b38f3d955a0ddb33b414dc
-
SHA256
c58e2d245f99b53a5d4006c4f1daac8085b622eeab9958a576e7b82ae8e8380d
-
SHA512
e3737d85c8ecb2ceb47ee6dc6505f38f4a4b467780fabf0bb179f35175264b1b4114fd9e368af186b774500cc9d67fc5919c1b90d6c0f377a7a2b3de09d69c52
Malware Config
Extracted
formbook
http://www.bytecommunication.com/aky/
jeiksaoeklea.com
sagame-auto.net
soloseriolavoro.com
thecreatorsbook.com
superskritch.com
oroxequipment.com
heart-of-art.online
liwedfg.com
fisherofsouls.com
jota.xyz
nehyam.com
smart-contact-delivery.com
hoom.guru
dgryds.com
thesoakcpd.com
mishv.com
rings-factory.info
bero-craft-beers.com
podcastnamegenerators.com
856379813.xyz
ruinfectious.com
wdcsupport.com
youngbrokeandeducated.com
shpments75.com
louisbmartinez100th.com
shining.ink
hkexpresswaterford.com
quickcashoffersatl.com
180cliniconline.com
mainriskintl.com
clinicadosorriso.com
kuxueyunkeji.com
smart-acumen.com
maisonkerlann.com
jewishposter.com
xn--w52b77ujva.com
antoniodevivo.com
diversitypatriots.com
tiotacos.company
ventumgi.com
ip-tv.online
smithvilletexashistory.com
amruta-varshini.com
wildpositive.com
alifezap.com
nczjt.net
palmsvillaswhitneyranch.com
experiencemoretogether.com
dewitfire.com
scruffynotfluffy.online
bazarsurtidorico.com
dayscosmetics.com
tpsvegas.com
externalboard.com
2125lynchmere.com
agroplenty.com
easterneuropemall.com
whtoys888.com
writehousepoint.com
ppeaceandgloves.com
sadtire.press
jj3994.com
smokenengines.com
offplanprojects-re.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1616-7-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1616-8-0x000000000041EB60-mapping.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c343b0f63b6c4dc9d3f5dd7864f6edd6.exedescription pid process target process PID 1048 set thread context of 1616 1048 c343b0f63b6c4dc9d3f5dd7864f6edd6.exe c343b0f63b6c4dc9d3f5dd7864f6edd6.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
c343b0f63b6c4dc9d3f5dd7864f6edd6.exec343b0f63b6c4dc9d3f5dd7864f6edd6.exepid process 1048 c343b0f63b6c4dc9d3f5dd7864f6edd6.exe 1048 c343b0f63b6c4dc9d3f5dd7864f6edd6.exe 1616 c343b0f63b6c4dc9d3f5dd7864f6edd6.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
c343b0f63b6c4dc9d3f5dd7864f6edd6.exedescription pid process Token: SeDebugPrivilege 1048 c343b0f63b6c4dc9d3f5dd7864f6edd6.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
c343b0f63b6c4dc9d3f5dd7864f6edd6.exedescription pid process target process PID 1048 wrote to memory of 1668 1048 c343b0f63b6c4dc9d3f5dd7864f6edd6.exe c343b0f63b6c4dc9d3f5dd7864f6edd6.exe PID 1048 wrote to memory of 1668 1048 c343b0f63b6c4dc9d3f5dd7864f6edd6.exe c343b0f63b6c4dc9d3f5dd7864f6edd6.exe PID 1048 wrote to memory of 1668 1048 c343b0f63b6c4dc9d3f5dd7864f6edd6.exe c343b0f63b6c4dc9d3f5dd7864f6edd6.exe PID 1048 wrote to memory of 1668 1048 c343b0f63b6c4dc9d3f5dd7864f6edd6.exe c343b0f63b6c4dc9d3f5dd7864f6edd6.exe PID 1048 wrote to memory of 1616 1048 c343b0f63b6c4dc9d3f5dd7864f6edd6.exe c343b0f63b6c4dc9d3f5dd7864f6edd6.exe PID 1048 wrote to memory of 1616 1048 c343b0f63b6c4dc9d3f5dd7864f6edd6.exe c343b0f63b6c4dc9d3f5dd7864f6edd6.exe PID 1048 wrote to memory of 1616 1048 c343b0f63b6c4dc9d3f5dd7864f6edd6.exe c343b0f63b6c4dc9d3f5dd7864f6edd6.exe PID 1048 wrote to memory of 1616 1048 c343b0f63b6c4dc9d3f5dd7864f6edd6.exe c343b0f63b6c4dc9d3f5dd7864f6edd6.exe PID 1048 wrote to memory of 1616 1048 c343b0f63b6c4dc9d3f5dd7864f6edd6.exe c343b0f63b6c4dc9d3f5dd7864f6edd6.exe PID 1048 wrote to memory of 1616 1048 c343b0f63b6c4dc9d3f5dd7864f6edd6.exe c343b0f63b6c4dc9d3f5dd7864f6edd6.exe PID 1048 wrote to memory of 1616 1048 c343b0f63b6c4dc9d3f5dd7864f6edd6.exe c343b0f63b6c4dc9d3f5dd7864f6edd6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c343b0f63b6c4dc9d3f5dd7864f6edd6.exe"C:\Users\Admin\AppData\Local\Temp\c343b0f63b6c4dc9d3f5dd7864f6edd6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c343b0f63b6c4dc9d3f5dd7864f6edd6.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\c343b0f63b6c4dc9d3f5dd7864f6edd6.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1048-2-0x0000000073C60000-0x000000007434E000-memory.dmpFilesize
6.9MB
-
memory/1048-3-0x0000000001180000-0x0000000001181000-memory.dmpFilesize
4KB
-
memory/1048-5-0x0000000000320000-0x000000000032E000-memory.dmpFilesize
56KB
-
memory/1048-6-0x0000000000C60000-0x0000000000CAB000-memory.dmpFilesize
300KB
-
memory/1616-7-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1616-8-0x000000000041EB60-mapping.dmp