Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-01-2021 17:55
Static task
static1
Behavioral task
behavioral1
Sample
Confirm!!.exe
Resource
win7v20201028
General
-
Target
Confirm!!.exe
-
Size
822KB
-
MD5
7fe88cceaddc558f6c812a574dd7d2d8
-
SHA1
feea6851987dec87602c10633c7748bb1a184b5a
-
SHA256
005051028cd70b06d41a9703a87b07dfd779d03395073edf6d43aaa10a719040
-
SHA512
7fc4a802bb5703a8b23853739f1a3c1a986f9fa623d0a7327243cad31c3a2cbcf31555f875e8b4ab707a336912707f5814ddfb0ee4540fe4a1d1e89131bef362
Malware Config
Extracted
formbook
http://www.deuxus.com/t052/
ladybug-learning.com
unforgottenstory.com
oldmopaiv.xyz
natashaexim.com
hannahmcelgunn.com
retargetingmachines.info
njoconline.com
unicornlankadelivery.com
giftkerala.com
englishfordoctors.online
schatzilandrvresort.com
brujoisaac.com
basiccampinggear.com
escapees.today
dgyxsy888.com
stevebana.xyz
mimozakebap.com
ezdoff.com
pluumyspalace.com
shaoshanshan.com
crazyvine.wine
sfjt55.com
xjgqh.com
netverificatie-home.info
efnew.com
welderweb.com
2ndstars.com
parrotpink.com
sarahjanehammock.com
pizzawestpalmbeach.com
pivot-branding.com
bribiebootcamp.com
floridaincontinencetherapy.com
muddanyc.com
pflegedienst-24-7.com
kunstradar.com
coolgadgetsdominate.com
comedynationlive.com
workoutandlawn.com
orangecountyvolvolease.com
sunrisemath.com
premiumenterprisegroup.com
mnglobalplatform.com
bijie.xyz
christiandailyusa.com
kismetestatestjohn.com
bobyworks.com
h2cooker.com
kimquint.com
torturechamberproductions.com
superbbsuper.com
bibleandkoran.net
oncuecollective.com
strat-fundamentals.info
taichi.chat
beautyroomgreenwich.com
686761.com
prostatamrt.net
medicina-genomica.com
hl022.com
forestlawnfunerals.com
charismayachts.com
sublimequalitystore.com
bowvacare.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3628-13-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3628-14-0x000000000041ECC0-mapping.dmp formbook behavioral2/memory/2136-21-0x0000000000E30000-0x0000000000E5E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Confirm!!.exeConfirm!!.exeexplorer.exedescription pid process target process PID 4076 set thread context of 3628 4076 Confirm!!.exe Confirm!!.exe PID 3628 set thread context of 2756 3628 Confirm!!.exe Explorer.EXE PID 2136 set thread context of 2756 2136 explorer.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
Confirm!!.exeConfirm!!.exeexplorer.exepid process 4076 Confirm!!.exe 4076 Confirm!!.exe 4076 Confirm!!.exe 3628 Confirm!!.exe 3628 Confirm!!.exe 3628 Confirm!!.exe 3628 Confirm!!.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Confirm!!.exeexplorer.exepid process 3628 Confirm!!.exe 3628 Confirm!!.exe 3628 Confirm!!.exe 2136 explorer.exe 2136 explorer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Confirm!!.exeConfirm!!.exeexplorer.exedescription pid process Token: SeDebugPrivilege 4076 Confirm!!.exe Token: SeDebugPrivilege 3628 Confirm!!.exe Token: SeDebugPrivilege 2136 explorer.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Confirm!!.exeExplorer.EXEexplorer.exedescription pid process target process PID 4076 wrote to memory of 1096 4076 Confirm!!.exe Confirm!!.exe PID 4076 wrote to memory of 1096 4076 Confirm!!.exe Confirm!!.exe PID 4076 wrote to memory of 1096 4076 Confirm!!.exe Confirm!!.exe PID 4076 wrote to memory of 3628 4076 Confirm!!.exe Confirm!!.exe PID 4076 wrote to memory of 3628 4076 Confirm!!.exe Confirm!!.exe PID 4076 wrote to memory of 3628 4076 Confirm!!.exe Confirm!!.exe PID 4076 wrote to memory of 3628 4076 Confirm!!.exe Confirm!!.exe PID 4076 wrote to memory of 3628 4076 Confirm!!.exe Confirm!!.exe PID 4076 wrote to memory of 3628 4076 Confirm!!.exe Confirm!!.exe PID 2756 wrote to memory of 2136 2756 Explorer.EXE explorer.exe PID 2756 wrote to memory of 2136 2756 Explorer.EXE explorer.exe PID 2756 wrote to memory of 2136 2756 Explorer.EXE explorer.exe PID 2136 wrote to memory of 3980 2136 explorer.exe cmd.exe PID 2136 wrote to memory of 3980 2136 explorer.exe cmd.exe PID 2136 wrote to memory of 3980 2136 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Confirm!!.exe"C:\Users\Admin\AppData\Local\Temp\Confirm!!.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Confirm!!.exe"C:\Users\Admin\AppData\Local\Temp\Confirm!!.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Confirm!!.exe"C:\Users\Admin\AppData\Local\Temp\Confirm!!.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Confirm!!.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2136-24-0x00000000050E0000-0x0000000005173000-memory.dmpFilesize
588KB
-
memory/2136-23-0x00000000051A0000-0x00000000054C0000-memory.dmpFilesize
3.1MB
-
memory/2136-21-0x0000000000E30000-0x0000000000E5E000-memory.dmpFilesize
184KB
-
memory/2136-20-0x0000000001010000-0x000000000144F000-memory.dmpFilesize
4.2MB
-
memory/2136-19-0x0000000000000000-mapping.dmp
-
memory/2756-18-0x0000000002B60000-0x0000000002C74000-memory.dmpFilesize
1.1MB
-
memory/2756-25-0x00000000065A0000-0x0000000006727000-memory.dmpFilesize
1.5MB
-
memory/3628-13-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3628-16-0x0000000000F10000-0x0000000001230000-memory.dmpFilesize
3.1MB
-
memory/3628-17-0x0000000001250000-0x0000000001264000-memory.dmpFilesize
80KB
-
memory/3628-14-0x000000000041ECC0-mapping.dmp
-
memory/3980-22-0x0000000000000000-mapping.dmp
-
memory/4076-10-0x0000000005710000-0x0000000005711000-memory.dmpFilesize
4KB
-
memory/4076-2-0x00000000739A0000-0x000000007408E000-memory.dmpFilesize
6.9MB
-
memory/4076-11-0x0000000005600000-0x0000000005613000-memory.dmpFilesize
76KB
-
memory/4076-9-0x0000000005640000-0x0000000005641000-memory.dmpFilesize
4KB
-
memory/4076-8-0x0000000005340000-0x0000000005341000-memory.dmpFilesize
4KB
-
memory/4076-7-0x00000000054A0000-0x00000000054A1000-memory.dmpFilesize
4KB
-
memory/4076-12-0x0000000001380000-0x00000000013EB000-memory.dmpFilesize
428KB
-
memory/4076-6-0x0000000005900000-0x0000000005901000-memory.dmpFilesize
4KB
-
memory/4076-5-0x0000000005360000-0x0000000005361000-memory.dmpFilesize
4KB
-
memory/4076-3-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB