Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-01-2021 08:22
Static task
static1
Behavioral task
behavioral1
Sample
Details here.exe
Resource
win7v20201028
General
-
Target
Details here.exe
-
Size
1.2MB
-
MD5
a952c15d26e8b87cce83c842f9c56d71
-
SHA1
734fab89fedb57add80068bc56267512d717c189
-
SHA256
67710323c3dd7ba7cc04081512bdb304b4d7edd72975f2891c1f5893fdb75a8a
-
SHA512
2b433b9670d54b588cd1bd77e302ef6dea911bdb6eb5043653003b2ec30d005fb953c7ec844235203b56e22e3e26b60cadcea7662a9a73471441d64e01b8c696
Malware Config
Extracted
formbook
http://www.deuxus.com/t052/
ladybug-learning.com
unforgottenstory.com
oldmopaiv.xyz
natashaexim.com
hannahmcelgunn.com
retargetingmachines.info
njoconline.com
unicornlankadelivery.com
giftkerala.com
englishfordoctors.online
schatzilandrvresort.com
brujoisaac.com
basiccampinggear.com
escapees.today
dgyxsy888.com
stevebana.xyz
mimozakebap.com
ezdoff.com
pluumyspalace.com
shaoshanshan.com
crazyvine.wine
sfjt55.com
xjgqh.com
netverificatie-home.info
efnew.com
welderweb.com
2ndstars.com
parrotpink.com
sarahjanehammock.com
pizzawestpalmbeach.com
pivot-branding.com
bribiebootcamp.com
floridaincontinencetherapy.com
muddanyc.com
pflegedienst-24-7.com
kunstradar.com
coolgadgetsdominate.com
comedynationlive.com
workoutandlawn.com
orangecountyvolvolease.com
sunrisemath.com
premiumenterprisegroup.com
mnglobalplatform.com
bijie.xyz
christiandailyusa.com
kismetestatestjohn.com
bobyworks.com
h2cooker.com
kimquint.com
torturechamberproductions.com
superbbsuper.com
bibleandkoran.net
oncuecollective.com
strat-fundamentals.info
taichi.chat
beautyroomgreenwich.com
686761.com
prostatamrt.net
medicina-genomica.com
hl022.com
forestlawnfunerals.com
charismayachts.com
sublimequalitystore.com
bowvacare.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/976-14-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/976-15-0x000000000041ECC0-mapping.dmp formbook behavioral2/memory/3944-24-0x0000000000870000-0x000000000089E000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Details here.exeDetails here.exerundll32.exedescription pid process target process PID 1308 set thread context of 976 1308 Details here.exe Details here.exe PID 976 set thread context of 2352 976 Details here.exe Explorer.EXE PID 976 set thread context of 2352 976 Details here.exe Explorer.EXE PID 3944 set thread context of 2352 3944 rundll32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
Details here.exerundll32.exepid process 976 Details here.exe 976 Details here.exe 976 Details here.exe 976 Details here.exe 976 Details here.exe 976 Details here.exe 3944 rundll32.exe 3944 rundll32.exe 3944 rundll32.exe 3944 rundll32.exe 3944 rundll32.exe 3944 rundll32.exe 3944 rundll32.exe 3944 rundll32.exe 3944 rundll32.exe 3944 rundll32.exe 3944 rundll32.exe 3944 rundll32.exe 3944 rundll32.exe 3944 rundll32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Details here.exerundll32.exepid process 976 Details here.exe 976 Details here.exe 976 Details here.exe 976 Details here.exe 3944 rundll32.exe 3944 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Details here.exerundll32.exedescription pid process Token: SeDebugPrivilege 976 Details here.exe Token: SeDebugPrivilege 3944 rundll32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Details here.exeExplorer.EXErundll32.exedescription pid process target process PID 1308 wrote to memory of 976 1308 Details here.exe Details here.exe PID 1308 wrote to memory of 976 1308 Details here.exe Details here.exe PID 1308 wrote to memory of 976 1308 Details here.exe Details here.exe PID 1308 wrote to memory of 976 1308 Details here.exe Details here.exe PID 1308 wrote to memory of 976 1308 Details here.exe Details here.exe PID 1308 wrote to memory of 976 1308 Details here.exe Details here.exe PID 2352 wrote to memory of 3944 2352 Explorer.EXE rundll32.exe PID 2352 wrote to memory of 3944 2352 Explorer.EXE rundll32.exe PID 2352 wrote to memory of 3944 2352 Explorer.EXE rundll32.exe PID 3944 wrote to memory of 3808 3944 rundll32.exe cmd.exe PID 3944 wrote to memory of 3808 3944 rundll32.exe cmd.exe PID 3944 wrote to memory of 3808 3944 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Details here.exe"C:\Users\Admin\AppData\Local\Temp\Details here.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Details here.exe"C:\Users\Admin\AppData\Local\Temp\Details here.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Details here.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/976-14-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/976-20-0x00000000017E0000-0x00000000017F4000-memory.dmpFilesize
80KB
-
memory/976-18-0x0000000001480000-0x0000000001494000-memory.dmpFilesize
80KB
-
memory/976-17-0x00000000014C0000-0x00000000017E0000-memory.dmpFilesize
3.1MB
-
memory/976-15-0x000000000041ECC0-mapping.dmp
-
memory/1308-9-0x0000000005A20000-0x0000000005A21000-memory.dmpFilesize
4KB
-
memory/1308-5-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/1308-10-0x0000000006200000-0x0000000006201000-memory.dmpFilesize
4KB
-
memory/1308-11-0x0000000005A80000-0x0000000005A81000-memory.dmpFilesize
4KB
-
memory/1308-12-0x0000000005A00000-0x0000000005A13000-memory.dmpFilesize
76KB
-
memory/1308-13-0x0000000001620000-0x00000000016C8000-memory.dmpFilesize
672KB
-
memory/1308-8-0x00000000056D0000-0x00000000056D1000-memory.dmpFilesize
4KB
-
memory/1308-7-0x0000000005800000-0x0000000005801000-memory.dmpFilesize
4KB
-
memory/1308-6-0x0000000005D00000-0x0000000005D01000-memory.dmpFilesize
4KB
-
memory/1308-2-0x0000000073C50000-0x000000007433E000-memory.dmpFilesize
6.9MB
-
memory/1308-3-0x0000000000D80000-0x0000000000D81000-memory.dmpFilesize
4KB
-
memory/2352-21-0x00000000028E0000-0x00000000029A9000-memory.dmpFilesize
804KB
-
memory/2352-19-0x0000000000A50000-0x0000000000B33000-memory.dmpFilesize
908KB
-
memory/2352-28-0x0000000005000000-0x0000000005145000-memory.dmpFilesize
1.3MB
-
memory/3808-25-0x0000000000000000-mapping.dmp
-
memory/3944-22-0x0000000000000000-mapping.dmp
-
memory/3944-24-0x0000000000870000-0x000000000089E000-memory.dmpFilesize
184KB
-
memory/3944-23-0x0000000000950000-0x0000000000963000-memory.dmpFilesize
76KB
-
memory/3944-26-0x0000000004BA0000-0x0000000004EC0000-memory.dmpFilesize
3.1MB
-
memory/3944-27-0x0000000002D90000-0x0000000002E23000-memory.dmpFilesize
588KB