Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
16-01-2021 07:36
Static task
static1
Behavioral task
behavioral1
Sample
Confirm.exe
Resource
win7v20201028
General
-
Target
Confirm.exe
-
Size
1011KB
-
MD5
6350717e7a76e3c7a926f5e1e123b819
-
SHA1
93e3b8299963504ccd6d623b1814d9df69fcec5c
-
SHA256
3dcb1921c04d6f8e9974127b4ed2d691021dae212fd4b2e9d82e3d83e7537733
-
SHA512
e1c7198f72e40fa653f50a23279345bd88826bc05f75c292c82c1efba959cb62a14c084c58ec715a836c50b3278cc628eb8502b3ecd17bd5c8a81eb96e686793
Malware Config
Extracted
formbook
http://www.deuxus.com/t052/
ladybug-learning.com
unforgottenstory.com
oldmopaiv.xyz
natashaexim.com
hannahmcelgunn.com
retargetingmachines.info
njoconline.com
unicornlankadelivery.com
giftkerala.com
englishfordoctors.online
schatzilandrvresort.com
brujoisaac.com
basiccampinggear.com
escapees.today
dgyxsy888.com
stevebana.xyz
mimozakebap.com
ezdoff.com
pluumyspalace.com
shaoshanshan.com
crazyvine.wine
sfjt55.com
xjgqh.com
netverificatie-home.info
efnew.com
welderweb.com
2ndstars.com
parrotpink.com
sarahjanehammock.com
pizzawestpalmbeach.com
pivot-branding.com
bribiebootcamp.com
floridaincontinencetherapy.com
muddanyc.com
pflegedienst-24-7.com
kunstradar.com
coolgadgetsdominate.com
comedynationlive.com
workoutandlawn.com
orangecountyvolvolease.com
sunrisemath.com
premiumenterprisegroup.com
mnglobalplatform.com
bijie.xyz
christiandailyusa.com
kismetestatestjohn.com
bobyworks.com
h2cooker.com
kimquint.com
torturechamberproductions.com
superbbsuper.com
bibleandkoran.net
oncuecollective.com
strat-fundamentals.info
taichi.chat
beautyroomgreenwich.com
686761.com
prostatamrt.net
medicina-genomica.com
hl022.com
forestlawnfunerals.com
charismayachts.com
sublimequalitystore.com
bowvacare.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/584-12-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/584-13-0x000000000041ECC0-mapping.dmp formbook behavioral2/memory/844-14-0x0000000000000000-mapping.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Confirm.exeConfirm.execmstp.exedescription pid process target process PID 4804 set thread context of 584 4804 Confirm.exe Confirm.exe PID 584 set thread context of 3152 584 Confirm.exe Explorer.EXE PID 844 set thread context of 3152 844 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
Confirm.execmstp.exepid process 584 Confirm.exe 584 Confirm.exe 584 Confirm.exe 584 Confirm.exe 844 cmstp.exe 844 cmstp.exe 844 cmstp.exe 844 cmstp.exe 844 cmstp.exe 844 cmstp.exe 844 cmstp.exe 844 cmstp.exe 844 cmstp.exe 844 cmstp.exe 844 cmstp.exe 844 cmstp.exe 844 cmstp.exe 844 cmstp.exe 844 cmstp.exe 844 cmstp.exe 844 cmstp.exe 844 cmstp.exe 844 cmstp.exe 844 cmstp.exe 844 cmstp.exe 844 cmstp.exe 844 cmstp.exe 844 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Confirm.execmstp.exepid process 584 Confirm.exe 584 Confirm.exe 584 Confirm.exe 844 cmstp.exe 844 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Confirm.exeConfirm.execmstp.exedescription pid process Token: SeDebugPrivilege 4804 Confirm.exe Token: SeDebugPrivilege 584 Confirm.exe Token: SeDebugPrivilege 844 cmstp.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Confirm.exeExplorer.EXEcmstp.exedescription pid process target process PID 4804 wrote to memory of 584 4804 Confirm.exe Confirm.exe PID 4804 wrote to memory of 584 4804 Confirm.exe Confirm.exe PID 4804 wrote to memory of 584 4804 Confirm.exe Confirm.exe PID 4804 wrote to memory of 584 4804 Confirm.exe Confirm.exe PID 4804 wrote to memory of 584 4804 Confirm.exe Confirm.exe PID 4804 wrote to memory of 584 4804 Confirm.exe Confirm.exe PID 3152 wrote to memory of 844 3152 Explorer.EXE cmstp.exe PID 3152 wrote to memory of 844 3152 Explorer.EXE cmstp.exe PID 3152 wrote to memory of 844 3152 Explorer.EXE cmstp.exe PID 844 wrote to memory of 652 844 cmstp.exe cmd.exe PID 844 wrote to memory of 652 844 cmstp.exe cmd.exe PID 844 wrote to memory of 652 844 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Confirm.exe"C:\Users\Admin\AppData\Local\Temp\Confirm.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Confirm.exe"C:\Users\Admin\AppData\Local\Temp\Confirm.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Confirm.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/584-12-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/584-13-0x000000000041ECC0-mapping.dmp
-
memory/652-17-0x0000000000000000-mapping.dmp
-
memory/844-16-0x0000000000D30000-0x0000000000D46000-memory.dmpFilesize
88KB
-
memory/844-15-0x0000000000D30000-0x0000000000D46000-memory.dmpFilesize
88KB
-
memory/844-14-0x0000000000000000-mapping.dmp
-
memory/4804-6-0x00000000057A0000-0x00000000057A1000-memory.dmpFilesize
4KB
-
memory/4804-10-0x0000000005780000-0x0000000005793000-memory.dmpFilesize
76KB
-
memory/4804-11-0x0000000000E80000-0x0000000000EEA000-memory.dmpFilesize
424KB
-
memory/4804-9-0x00000000054A0000-0x00000000054A1000-memory.dmpFilesize
4KB
-
memory/4804-8-0x00000000051F0000-0x00000000051F1000-memory.dmpFilesize
4KB
-
memory/4804-7-0x0000000005340000-0x0000000005341000-memory.dmpFilesize
4KB
-
memory/4804-2-0x00000000739D0000-0x00000000740BE000-memory.dmpFilesize
6.9MB
-
memory/4804-5-0x0000000005200000-0x0000000005201000-memory.dmpFilesize
4KB
-
memory/4804-3-0x00000000008D0000-0x00000000008D1000-memory.dmpFilesize
4KB