Analysis
-
max time kernel
148s -
max time network
9s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-01-2021 07:16
Static task
static1
Behavioral task
behavioral1
Sample
15012021.exe
Resource
win7v20201028
General
-
Target
15012021.exe
-
Size
901KB
-
MD5
250975865bf0cc75d7b05c3a8e9fcbe2
-
SHA1
3e2cf4300dd07a2662f552b18438895e75486d9a
-
SHA256
e10a18344876f44eea40708f80322df6ec17eea4fec0b7de74c97aab23421600
-
SHA512
9bbdb7ad1d4e8abbb195114e2771532e98fda18762a96e55cbdf7cf25337c82e780492f54f59f6c9fe475871c43abab6be4a73e7aeb78025dc00bb1986654136
Malware Config
Extracted
formbook
http://www.timoniks.com/rbg/
fingermode.com
parkplace.finance
hollandgreen2020.com
starbets.site
vehiculesfrigorifiques.com
sydiifinancial.com
rpivuenation.com
freesubdirectory.com
independencepartynyc.com
dogruparti.info
independencecountyclub.com
midnightlashesbykim.com
digitalsept.com
whatilikeabouttoday.com
marktplaatsaccount.info
13400667334.com
xinwei-ge.com
login-appleid.info
momashands.com
kennyxpress.com
yushin2733.com
olenfex.com
agorabookstore.com
iotajinn.com
511tea.com
sullian.com
virtuallawyerservices.com
machineryhunters.online
mintamuntaz.com
sunflowerhybrid.com
hocbai24h.com
bundletvdeal.com
engjape.com
villamariaapartments.com
arabaozellikleri.net
fortheloveofdawg.com
mullinsmusicministry.com
rescuecellphones.com
infinityenterpriselr.com
humormug.com
summitplazagurgaon.com
rogo24.com
apluspartybus.com
chernliyfashion.com
presentvaluecore.com
bangbangfactory.com
leandroresolve.com
hk6628.com
anotherheadache.com
jiemanwu.com
a1dandyhandyman.com
pennsylvaniacraft.com
vrank.icu
avivemg.icu
littlestarenglish.com
jrprofessionale.com
belze.net
svtrbu.com
healthpassportasia.com
kadakudu.com
rahatindir.com
seamssewmuchbetter.com
brancusi.net
ido.lgbt
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1348-8-0x000000000041EB40-mapping.dmp formbook behavioral1/memory/1348-7-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/980-10-0x0000000000000000-mapping.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1060 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
15012021.exe15012021.exenetsh.exedescription pid process target process PID 476 set thread context of 1348 476 15012021.exe 15012021.exe PID 1348 set thread context of 1272 1348 15012021.exe Explorer.EXE PID 1348 set thread context of 1272 1348 15012021.exe Explorer.EXE PID 980 set thread context of 1272 980 netsh.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
15012021.exenetsh.exepid process 1348 15012021.exe 1348 15012021.exe 1348 15012021.exe 980 netsh.exe 980 netsh.exe 980 netsh.exe 980 netsh.exe 980 netsh.exe 980 netsh.exe 980 netsh.exe 980 netsh.exe 980 netsh.exe 980 netsh.exe 980 netsh.exe 980 netsh.exe 980 netsh.exe 980 netsh.exe 980 netsh.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
15012021.exenetsh.exepid process 1348 15012021.exe 1348 15012021.exe 1348 15012021.exe 1348 15012021.exe 980 netsh.exe 980 netsh.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
15012021.exenetsh.exedescription pid process Token: SeDebugPrivilege 1348 15012021.exe Token: SeDebugPrivilege 980 netsh.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
15012021.exe15012021.exenetsh.exedescription pid process target process PID 476 wrote to memory of 1348 476 15012021.exe 15012021.exe PID 476 wrote to memory of 1348 476 15012021.exe 15012021.exe PID 476 wrote to memory of 1348 476 15012021.exe 15012021.exe PID 476 wrote to memory of 1348 476 15012021.exe 15012021.exe PID 476 wrote to memory of 1348 476 15012021.exe 15012021.exe PID 476 wrote to memory of 1348 476 15012021.exe 15012021.exe PID 476 wrote to memory of 1348 476 15012021.exe 15012021.exe PID 1348 wrote to memory of 980 1348 15012021.exe netsh.exe PID 1348 wrote to memory of 980 1348 15012021.exe netsh.exe PID 1348 wrote to memory of 980 1348 15012021.exe netsh.exe PID 1348 wrote to memory of 980 1348 15012021.exe netsh.exe PID 980 wrote to memory of 1060 980 netsh.exe cmd.exe PID 980 wrote to memory of 1060 980 netsh.exe cmd.exe PID 980 wrote to memory of 1060 980 netsh.exe cmd.exe PID 980 wrote to memory of 1060 980 netsh.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\15012021.exe"C:\Users\Admin\AppData\Local\Temp\15012021.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\15012021.exe"C:\Users\Admin\AppData\Local\Temp\15012021.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"4⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"4⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\15012021.exe"5⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/476-2-0x0000000073F20000-0x000000007460E000-memory.dmpFilesize
6.9MB
-
memory/476-3-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/476-5-0x0000000000490000-0x00000000004A2000-memory.dmpFilesize
72KB
-
memory/476-6-0x0000000004D90000-0x0000000004DF5000-memory.dmpFilesize
404KB
-
memory/980-10-0x0000000000000000-mapping.dmp
-
memory/980-11-0x00000000010E0000-0x00000000010FB000-memory.dmpFilesize
108KB
-
memory/980-13-0x0000000000FD0000-0x00000000010D4000-memory.dmpFilesize
1.0MB
-
memory/1060-12-0x0000000000000000-mapping.dmp
-
memory/1272-9-0x0000000005030000-0x0000000005102000-memory.dmpFilesize
840KB
-
memory/1272-14-0x0000000006F20000-0x0000000007017000-memory.dmpFilesize
988KB
-
memory/1348-8-0x000000000041EB40-mapping.dmp
-
memory/1348-7-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB