Analysis
-
max time kernel
151s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-01-2021 07:17
Static task
static1
Behavioral task
behavioral1
Sample
Mitsubishi Japan XN501.exe
Resource
win7v20201028
General
-
Target
Mitsubishi Japan XN501.exe
-
Size
959KB
-
MD5
420a7a5ed66a75a7ede35f63cab3ab9c
-
SHA1
474b0ef1e7dab85ebd7296c408de13a18afd3870
-
SHA256
75f2a2a20e73b7e0c53d499b883a403c2b8cfbf17c5923d58e0167daa4c019c1
-
SHA512
cafe8be480487d71115512894798775d3eb4e3219f3e0d5395d5c6a098d51515fb85a1224c12ce22d0fb8bacc612d48fdc417fe077d4bfbbf35fd7f53c47df20
Malware Config
Extracted
formbook
http://www.9dgevjb.net/gtl/
45687g.net
graveimport.com
bulldogsgear.com
service-support.email
uhzcflg.icu
zebradefensefund.com
make10xhappen.com
ecotegral.online
stillatwink.site
onwardatlanta.com
real-optionstheory.com
madbearcustomwoodworking.com
adelinekaczmarek.com
elia-lca.com
tinykreations.com
rawlinsrealty.info
ubcholdings.com
searko.com
lepinedoree.com
fundsrecoveryexperts.com
hdbymaggie.com
melhoresradios.com
natachez.com
nosquitos.com
skfashion-bd.com
healthyhabitsdiary.com
figcondos.com
torontobet109.xyz
k5759.com
everythingnitro.com
yolocraft.online
girlsweet88.online
beiser-sa.com
blackcardofsuccess.com
aprodigaldaughter.com
nxjiuding.com
objetboiscreative.com
angelinafurusho.com
uavphotoworld.com
melbet-official-bk-info.com
besthalalguide.com
samsungbtb.com
illawarrablinds.com
ratgeber-aktuell.info
tiktokmerch.club
zx565.com
sit-techno.com
leveragewholesaler.com
mymailtek.com
xb-xsy.com
caileygrunhard.com
pibyx.com
rnshaircare.com
todopilates.com
aureusgoldcorp.com
lblcclkchain.com
starlyconsulting.com
ndjamua.com
ahoradanoticia.net
mtcrosbyphotography.com
cutecvv.business
dach-realestate.com
assetmanagmentservices.com
sainu.website
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1192-7-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1192-8-0x000000000041EAF0-mapping.dmp formbook behavioral1/memory/476-9-0x0000000000000000-mapping.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 280 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Mitsubishi Japan XN501.exeMitsubishi Japan XN501.exewininit.exedescription pid process target process PID 1204 set thread context of 1192 1204 Mitsubishi Japan XN501.exe Mitsubishi Japan XN501.exe PID 1192 set thread context of 1264 1192 Mitsubishi Japan XN501.exe Explorer.EXE PID 1192 set thread context of 1264 1192 Mitsubishi Japan XN501.exe Explorer.EXE PID 476 set thread context of 1264 476 wininit.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
Mitsubishi Japan XN501.exeMitsubishi Japan XN501.exewininit.exepid process 1204 Mitsubishi Japan XN501.exe 1204 Mitsubishi Japan XN501.exe 1204 Mitsubishi Japan XN501.exe 1204 Mitsubishi Japan XN501.exe 1192 Mitsubishi Japan XN501.exe 1192 Mitsubishi Japan XN501.exe 1192 Mitsubishi Japan XN501.exe 476 wininit.exe 476 wininit.exe 476 wininit.exe 476 wininit.exe 476 wininit.exe 476 wininit.exe 476 wininit.exe 476 wininit.exe 476 wininit.exe 476 wininit.exe 476 wininit.exe 476 wininit.exe 476 wininit.exe 476 wininit.exe 476 wininit.exe 476 wininit.exe 476 wininit.exe 476 wininit.exe 476 wininit.exe 476 wininit.exe 476 wininit.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Mitsubishi Japan XN501.exewininit.exepid process 1192 Mitsubishi Japan XN501.exe 1192 Mitsubishi Japan XN501.exe 1192 Mitsubishi Japan XN501.exe 1192 Mitsubishi Japan XN501.exe 476 wininit.exe 476 wininit.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Mitsubishi Japan XN501.exeMitsubishi Japan XN501.exewininit.exedescription pid process Token: SeDebugPrivilege 1204 Mitsubishi Japan XN501.exe Token: SeDebugPrivilege 1192 Mitsubishi Japan XN501.exe Token: SeDebugPrivilege 476 wininit.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
Mitsubishi Japan XN501.exeExplorer.EXEwininit.exedescription pid process target process PID 1204 wrote to memory of 1556 1204 Mitsubishi Japan XN501.exe Mitsubishi Japan XN501.exe PID 1204 wrote to memory of 1556 1204 Mitsubishi Japan XN501.exe Mitsubishi Japan XN501.exe PID 1204 wrote to memory of 1556 1204 Mitsubishi Japan XN501.exe Mitsubishi Japan XN501.exe PID 1204 wrote to memory of 1556 1204 Mitsubishi Japan XN501.exe Mitsubishi Japan XN501.exe PID 1204 wrote to memory of 1440 1204 Mitsubishi Japan XN501.exe Mitsubishi Japan XN501.exe PID 1204 wrote to memory of 1440 1204 Mitsubishi Japan XN501.exe Mitsubishi Japan XN501.exe PID 1204 wrote to memory of 1440 1204 Mitsubishi Japan XN501.exe Mitsubishi Japan XN501.exe PID 1204 wrote to memory of 1440 1204 Mitsubishi Japan XN501.exe Mitsubishi Japan XN501.exe PID 1204 wrote to memory of 1192 1204 Mitsubishi Japan XN501.exe Mitsubishi Japan XN501.exe PID 1204 wrote to memory of 1192 1204 Mitsubishi Japan XN501.exe Mitsubishi Japan XN501.exe PID 1204 wrote to memory of 1192 1204 Mitsubishi Japan XN501.exe Mitsubishi Japan XN501.exe PID 1204 wrote to memory of 1192 1204 Mitsubishi Japan XN501.exe Mitsubishi Japan XN501.exe PID 1204 wrote to memory of 1192 1204 Mitsubishi Japan XN501.exe Mitsubishi Japan XN501.exe PID 1204 wrote to memory of 1192 1204 Mitsubishi Japan XN501.exe Mitsubishi Japan XN501.exe PID 1204 wrote to memory of 1192 1204 Mitsubishi Japan XN501.exe Mitsubishi Japan XN501.exe PID 1264 wrote to memory of 476 1264 Explorer.EXE wininit.exe PID 1264 wrote to memory of 476 1264 Explorer.EXE wininit.exe PID 1264 wrote to memory of 476 1264 Explorer.EXE wininit.exe PID 1264 wrote to memory of 476 1264 Explorer.EXE wininit.exe PID 476 wrote to memory of 280 476 wininit.exe cmd.exe PID 476 wrote to memory of 280 476 wininit.exe cmd.exe PID 476 wrote to memory of 280 476 wininit.exe cmd.exe PID 476 wrote to memory of 280 476 wininit.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\Mitsubishi Japan XN501.exe"C:\Users\Admin\AppData\Local\Temp\Mitsubishi Japan XN501.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\Mitsubishi Japan XN501.exe"{path}"3⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\Mitsubishi Japan XN501.exe"{path}"3⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\Mitsubishi Japan XN501.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1192 -
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Mitsubishi Japan XN501.exe"3⤵
- Deletes itself
PID:280