Analysis
-
max time kernel
146s -
max time network
13s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-01-2021 08:22
Static task
static1
Behavioral task
behavioral1
Sample
Details here.exe
Resource
win7v20201028
General
-
Target
Details here.exe
-
Size
1.2MB
-
MD5
a952c15d26e8b87cce83c842f9c56d71
-
SHA1
734fab89fedb57add80068bc56267512d717c189
-
SHA256
67710323c3dd7ba7cc04081512bdb304b4d7edd72975f2891c1f5893fdb75a8a
-
SHA512
2b433b9670d54b588cd1bd77e302ef6dea911bdb6eb5043653003b2ec30d005fb953c7ec844235203b56e22e3e26b60cadcea7662a9a73471441d64e01b8c696
Malware Config
Extracted
formbook
http://www.deuxus.com/t052/
ladybug-learning.com
unforgottenstory.com
oldmopaiv.xyz
natashaexim.com
hannahmcelgunn.com
retargetingmachines.info
njoconline.com
unicornlankadelivery.com
giftkerala.com
englishfordoctors.online
schatzilandrvresort.com
brujoisaac.com
basiccampinggear.com
escapees.today
dgyxsy888.com
stevebana.xyz
mimozakebap.com
ezdoff.com
pluumyspalace.com
shaoshanshan.com
crazyvine.wine
sfjt55.com
xjgqh.com
netverificatie-home.info
efnew.com
welderweb.com
2ndstars.com
parrotpink.com
sarahjanehammock.com
pizzawestpalmbeach.com
pivot-branding.com
bribiebootcamp.com
floridaincontinencetherapy.com
muddanyc.com
pflegedienst-24-7.com
kunstradar.com
coolgadgetsdominate.com
comedynationlive.com
workoutandlawn.com
orangecountyvolvolease.com
sunrisemath.com
premiumenterprisegroup.com
mnglobalplatform.com
bijie.xyz
christiandailyusa.com
kismetestatestjohn.com
bobyworks.com
h2cooker.com
kimquint.com
torturechamberproductions.com
superbbsuper.com
bibleandkoran.net
oncuecollective.com
strat-fundamentals.info
taichi.chat
beautyroomgreenwich.com
686761.com
prostatamrt.net
medicina-genomica.com
hl022.com
forestlawnfunerals.com
charismayachts.com
sublimequalitystore.com
bowvacare.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1652-8-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1652-9-0x000000000041ECC0-mapping.dmp formbook behavioral1/memory/1296-17-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 316 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Details here.exeDetails here.exechkdsk.exedescription pid process target process PID 1876 set thread context of 1652 1876 Details here.exe Details here.exe PID 1652 set thread context of 1196 1652 Details here.exe Explorer.EXE PID 1296 set thread context of 1196 1296 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Details here.exechkdsk.exepid process 1652 Details here.exe 1652 Details here.exe 1296 chkdsk.exe 1296 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Details here.exechkdsk.exepid process 1652 Details here.exe 1652 Details here.exe 1652 Details here.exe 1296 chkdsk.exe 1296 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Details here.exechkdsk.exedescription pid process Token: SeDebugPrivilege 1652 Details here.exe Token: SeDebugPrivilege 1296 chkdsk.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Details here.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1876 wrote to memory of 1652 1876 Details here.exe Details here.exe PID 1876 wrote to memory of 1652 1876 Details here.exe Details here.exe PID 1876 wrote to memory of 1652 1876 Details here.exe Details here.exe PID 1876 wrote to memory of 1652 1876 Details here.exe Details here.exe PID 1876 wrote to memory of 1652 1876 Details here.exe Details here.exe PID 1876 wrote to memory of 1652 1876 Details here.exe Details here.exe PID 1876 wrote to memory of 1652 1876 Details here.exe Details here.exe PID 1196 wrote to memory of 1296 1196 Explorer.EXE chkdsk.exe PID 1196 wrote to memory of 1296 1196 Explorer.EXE chkdsk.exe PID 1196 wrote to memory of 1296 1196 Explorer.EXE chkdsk.exe PID 1196 wrote to memory of 1296 1196 Explorer.EXE chkdsk.exe PID 1296 wrote to memory of 316 1296 chkdsk.exe cmd.exe PID 1296 wrote to memory of 316 1296 chkdsk.exe cmd.exe PID 1296 wrote to memory of 316 1296 chkdsk.exe cmd.exe PID 1296 wrote to memory of 316 1296 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Details here.exe"C:\Users\Admin\AppData\Local\Temp\Details here.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Details here.exe"C:\Users\Admin\AppData\Local\Temp\Details here.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Details here.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/316-15-0x0000000000000000-mapping.dmp
-
memory/1196-13-0x0000000004900000-0x00000000049CF000-memory.dmpFilesize
828KB
-
memory/1296-19-0x0000000000A30000-0x0000000000AC3000-memory.dmpFilesize
588KB
-
memory/1296-18-0x0000000002080000-0x0000000002383000-memory.dmpFilesize
3.0MB
-
memory/1296-17-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/1296-16-0x0000000000AE0000-0x0000000000AE7000-memory.dmpFilesize
28KB
-
memory/1296-14-0x0000000000000000-mapping.dmp
-
memory/1652-12-0x0000000000310000-0x0000000000324000-memory.dmpFilesize
80KB
-
memory/1652-11-0x0000000000890000-0x0000000000B93000-memory.dmpFilesize
3.0MB
-
memory/1652-9-0x000000000041ECC0-mapping.dmp
-
memory/1652-8-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1876-2-0x00000000749E0000-0x00000000750CE000-memory.dmpFilesize
6.9MB
-
memory/1876-7-0x0000000004DA0000-0x0000000004E48000-memory.dmpFilesize
672KB
-
memory/1876-6-0x0000000000570000-0x0000000000583000-memory.dmpFilesize
76KB
-
memory/1876-5-0x0000000004D60000-0x0000000004D61000-memory.dmpFilesize
4KB
-
memory/1876-3-0x0000000001120000-0x0000000001121000-memory.dmpFilesize
4KB