Analysis
-
max time kernel
149s -
max time network
132s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-01-2021 07:17
Static task
static1
Behavioral task
behavioral1
Sample
PO2836#NZ232.exe
Resource
win7v20201028
General
-
Target
PO2836#NZ232.exe
-
Size
1.2MB
-
MD5
8b9f701b5feeb6d1fc76b9a45ef33695
-
SHA1
c50e76a3bc942145b6d73e7d0fe3d34f2627df10
-
SHA256
1498cb2f9fa31c5126db058a10187fa76040789d257ac2b61f4d4bbbe77a986c
-
SHA512
c0e51d97e681c3d4b89d6e451e2fd908b92085359464088b3ef0f8446ffc9291d2fba5b9673b951ee84921ce62b3a4d7c0959e55baf5586c552e430d55da1f8c
Malware Config
Extracted
formbook
http://www.styrelseforum.com/p95n/
kimberlyrutledge.com
auctus.agency
johnemotions.com
guilt-brilliant.com
wxshangdian.com
theolivetreeonline.com
stellarfranchisebrands.com
every1no1.com
hoangthanhgroup.com
psm-gen.com
kingdomwow.com
digitalksr.com
karynpolitoforlg.com
youthdaycalgary.com
libertyhandymanservicesllc.com
breatheohio.com
allenleather.com
transformafter50.info
hnhsylsb.com
hmtradebd.com
besrhodislandhomes.com
zuwozo.com
southernhighlandsnails.com
kaaxg.com
bauer-cobolt.com
steelyourselfshop.net
linksoflondoncharmscheap.com
groundwork-pt.com
beautifulangelicskin.com
aduhelmfinancialsupport.com
xn--carpinteratarifa-hsb.com
thekingink.net
ocotegrill.com
gilbertdodge.com
insuranceinquirer.com
withagentcy.com
deeparchivesvpn.com
blamekd.com
acsdealta.xyz
dsxcj.com
kimonoshihan.com
bosquefamily.com
5587sk.com
integrative.life
unitedjournal.info
lynxdeck.com
onlyfanyou.com
aminomedicalscience.com
rachenstern-technik.com
thejewelrybox.net
stopcolleges.com
thesaltlifestyle.com
tappesupportservices.com
andrewgreenhomes.com
meidiansc.com
gobalexporter.com
rvpji571m.xyz
alwekalaaladabeya.com
scientificimaginetics.com
skaizenpharma.com
balloonpost.club
thefunnythingabout.com
premium-vitality.com
businesscalmcoaching.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2620-11-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2620-12-0x000000000041EDF0-mapping.dmp formbook behavioral2/memory/3588-13-0x0000000000000000-mapping.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO2836#NZ232.exePO2836#NZ232.exemstsc.exedescription pid process target process PID 1192 set thread context of 2620 1192 PO2836#NZ232.exe PO2836#NZ232.exe PID 2620 set thread context of 2836 2620 PO2836#NZ232.exe Explorer.EXE PID 3588 set thread context of 2836 3588 mstsc.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
PO2836#NZ232.exemstsc.exepid process 2620 PO2836#NZ232.exe 2620 PO2836#NZ232.exe 2620 PO2836#NZ232.exe 2620 PO2836#NZ232.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe 3588 mstsc.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PO2836#NZ232.exemstsc.exepid process 2620 PO2836#NZ232.exe 2620 PO2836#NZ232.exe 2620 PO2836#NZ232.exe 3588 mstsc.exe 3588 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO2836#NZ232.exemstsc.exedescription pid process Token: SeDebugPrivilege 2620 PO2836#NZ232.exe Token: SeDebugPrivilege 3588 mstsc.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2836 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PO2836#NZ232.exeExplorer.EXEmstsc.exedescription pid process target process PID 1192 wrote to memory of 2620 1192 PO2836#NZ232.exe PO2836#NZ232.exe PID 1192 wrote to memory of 2620 1192 PO2836#NZ232.exe PO2836#NZ232.exe PID 1192 wrote to memory of 2620 1192 PO2836#NZ232.exe PO2836#NZ232.exe PID 1192 wrote to memory of 2620 1192 PO2836#NZ232.exe PO2836#NZ232.exe PID 1192 wrote to memory of 2620 1192 PO2836#NZ232.exe PO2836#NZ232.exe PID 1192 wrote to memory of 2620 1192 PO2836#NZ232.exe PO2836#NZ232.exe PID 2836 wrote to memory of 3588 2836 Explorer.EXE mstsc.exe PID 2836 wrote to memory of 3588 2836 Explorer.EXE mstsc.exe PID 2836 wrote to memory of 3588 2836 Explorer.EXE mstsc.exe PID 3588 wrote to memory of 1512 3588 mstsc.exe cmd.exe PID 3588 wrote to memory of 1512 3588 mstsc.exe cmd.exe PID 3588 wrote to memory of 1512 3588 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO2836#NZ232.exe"C:\Users\Admin\AppData\Local\Temp\PO2836#NZ232.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO2836#NZ232.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO2836#NZ232.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1192-9-0x0000000005840000-0x000000000588C000-memory.dmpFilesize
304KB
-
memory/1192-5-0x0000000004FE0000-0x0000000004FE1000-memory.dmpFilesize
4KB
-
memory/1192-6-0x0000000004BD0000-0x0000000004BD1000-memory.dmpFilesize
4KB
-
memory/1192-7-0x0000000004D40000-0x0000000004D41000-memory.dmpFilesize
4KB
-
memory/1192-8-0x0000000004DC0000-0x0000000004DCE000-memory.dmpFilesize
56KB
-
memory/1192-3-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/1192-10-0x0000000005930000-0x0000000005931000-memory.dmpFilesize
4KB
-
memory/1192-2-0x0000000073D20000-0x000000007440E000-memory.dmpFilesize
6.9MB
-
memory/1512-16-0x0000000000000000-mapping.dmp
-
memory/2620-11-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2620-12-0x000000000041EDF0-mapping.dmp
-
memory/3588-13-0x0000000000000000-mapping.dmp
-
memory/3588-14-0x0000000001340000-0x000000000163C000-memory.dmpFilesize
3.0MB
-
memory/3588-15-0x0000000001340000-0x000000000163C000-memory.dmpFilesize
3.0MB
-
memory/3588-17-0x0000000006480000-0x00000000065DE000-memory.dmpFilesize
1.4MB