Analysis
-
max time kernel
147s -
max time network
13s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-01-2021 09:07
Static task
static1
Behavioral task
behavioral1
Sample
Payment_4372889.exe
Resource
win7v20201028
General
-
Target
Payment_4372889.exe
-
Size
735KB
-
MD5
d7e382bb4854061f9fc7a9806da0d7af
-
SHA1
07150c8377209b185e017d858f0cd6704ab2c732
-
SHA256
ee559d67bcad95fc4e1e6c867908b0b84338472a30d28d34da415c7efbd48f2b
-
SHA512
2f1ae72ebc57a8b312740425113240a0de56aab10c2248f31b7f66e452a30f2583e32bfaaaacf9f3f4ee692aef09196477075441d5be24ad6be7630137b22a25
Malware Config
Extracted
formbook
http://www.merckcbd.com/dei5/
studiomullerphoto.com
reallionairewear.com
dogsalondoggy-tail.com
excelmache.net
bigdiscounters.com
7986799.com
ignition.guru
xiaoxu.info
jpinpd.com
solpool.info
uchooswrewards.com
everestengineeringworks.com
qianglongzhipin.com
deepimper-325.com
appliedrate.com
radsazemehr.com
vivabematividadesfisicas.com
capacitalo.com
somecore.com
listingclass.net
romel.codes
mybettermentor.com
hxc43.com
btccvil312723.com
rudiskenya.com
internationalrockmusic.com
wudiwifi.com
scienceacademyraj.com
tumulusinnovations.com
studioeduardobeninca.com
formabench.com
ribbonredwhiteandblue.com
miningequipmentrental.com
myamom.com
riversportswear.net
14505glenmarkdr.com
nikolcosmetic.com
toninopr.com
cutfortheconnect.com
nl22584.com
mezokovesd.com
rozhandesign.com
futbolki.space
rmobipanoshop.com
merchmuslim.com
recurrentcornealerosion.com
enottampan.com
vasquez.photos
koreanmindbeauty.com
andressabode.com
thetwolouises.com
weberbyroble.com
followmargpolo.com
englishclubb.online
sorryididnthearthat.com
greatlookfashion.club
cartoleriagrillocatania.com
esteprize.com
sdsej.com
phiecraft.xyz
psm-gen.com
passivefiresafe.com
homeyplantycosy.com
0343888.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/992-10-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/992-11-0x000000000041ECD0-mapping.dmp formbook behavioral1/memory/364-21-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Payment_4372889.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Payment_4372889.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Payment_4372889.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 928 cmd.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Payment_4372889.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Payment_4372889.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 Payment_4372889.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Payment_4372889.exePayment_4372889.exeexplorer.exedescription pid process target process PID 1668 set thread context of 992 1668 Payment_4372889.exe Payment_4372889.exe PID 992 set thread context of 1248 992 Payment_4372889.exe Explorer.EXE PID 364 set thread context of 1248 364 explorer.exe Explorer.EXE -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Payment_4372889.exePayment_4372889.exeexplorer.exepid process 1668 Payment_4372889.exe 992 Payment_4372889.exe 992 Payment_4372889.exe 364 explorer.exe 364 explorer.exe 364 explorer.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Payment_4372889.exeexplorer.exepid process 992 Payment_4372889.exe 992 Payment_4372889.exe 992 Payment_4372889.exe 364 explorer.exe 364 explorer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Payment_4372889.exePayment_4372889.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1668 Payment_4372889.exe Token: SeDebugPrivilege 992 Payment_4372889.exe Token: SeDebugPrivilege 364 explorer.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
Payment_4372889.exeExplorer.EXEexplorer.exedescription pid process target process PID 1668 wrote to memory of 1204 1668 Payment_4372889.exe schtasks.exe PID 1668 wrote to memory of 1204 1668 Payment_4372889.exe schtasks.exe PID 1668 wrote to memory of 1204 1668 Payment_4372889.exe schtasks.exe PID 1668 wrote to memory of 1204 1668 Payment_4372889.exe schtasks.exe PID 1668 wrote to memory of 992 1668 Payment_4372889.exe Payment_4372889.exe PID 1668 wrote to memory of 992 1668 Payment_4372889.exe Payment_4372889.exe PID 1668 wrote to memory of 992 1668 Payment_4372889.exe Payment_4372889.exe PID 1668 wrote to memory of 992 1668 Payment_4372889.exe Payment_4372889.exe PID 1668 wrote to memory of 992 1668 Payment_4372889.exe Payment_4372889.exe PID 1668 wrote to memory of 992 1668 Payment_4372889.exe Payment_4372889.exe PID 1668 wrote to memory of 992 1668 Payment_4372889.exe Payment_4372889.exe PID 1248 wrote to memory of 364 1248 Explorer.EXE explorer.exe PID 1248 wrote to memory of 364 1248 Explorer.EXE explorer.exe PID 1248 wrote to memory of 364 1248 Explorer.EXE explorer.exe PID 1248 wrote to memory of 364 1248 Explorer.EXE explorer.exe PID 364 wrote to memory of 928 364 explorer.exe cmd.exe PID 364 wrote to memory of 928 364 explorer.exe cmd.exe PID 364 wrote to memory of 928 364 explorer.exe cmd.exe PID 364 wrote to memory of 928 364 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment_4372889.exe"C:\Users\Admin\AppData\Local\Temp\Payment_4372889.exe"2⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UEwFjeYBtPwSqZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6133.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Payment_4372889.exe"C:\Users\Admin\AppData\Local\Temp\Payment_4372889.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Payment_4372889.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6133.tmpMD5
cd18588e75fbff80bc48855ca636e0e5
SHA1a754c7ae74fdecaeb03c019c6120e4a170d71cb5
SHA2561fef465fdae70b1d17f7de5d8c5a5e306c1f34c5dedbc41588b0f52f3c42f5d9
SHA51297cd0e562af2f448c4c82843da35b1aed6f635dcb3fddd325c8d7cfb4208c56080357d1fd4734e642edeb042377d35e63f8534b2a6eb30fbaa0b4fac71f6371d
-
memory/364-16-0x0000000000000000-mapping.dmp
-
memory/364-23-0x0000000000A80000-0x0000000000B13000-memory.dmpFilesize
588KB
-
memory/364-22-0x0000000002500000-0x0000000002803000-memory.dmpFilesize
3.0MB
-
memory/364-21-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/364-20-0x0000000000E70000-0x00000000010F1000-memory.dmpFilesize
2.5MB
-
memory/364-18-0x0000000074691000-0x0000000074693000-memory.dmpFilesize
8KB
-
memory/364-17-0x0000000074B31000-0x0000000074B33000-memory.dmpFilesize
8KB
-
memory/928-19-0x0000000000000000-mapping.dmp
-
memory/992-14-0x0000000000140000-0x0000000000154000-memory.dmpFilesize
80KB
-
memory/992-13-0x0000000000970000-0x0000000000C73000-memory.dmpFilesize
3.0MB
-
memory/992-11-0x000000000041ECD0-mapping.dmp
-
memory/992-10-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1204-8-0x0000000000000000-mapping.dmp
-
memory/1248-15-0x0000000004250000-0x00000000043BC000-memory.dmpFilesize
1.4MB
-
memory/1668-2-0x0000000074110000-0x00000000747FE000-memory.dmpFilesize
6.9MB
-
memory/1668-7-0x0000000004870000-0x00000000048DB000-memory.dmpFilesize
428KB
-
memory/1668-6-0x0000000000480000-0x0000000000493000-memory.dmpFilesize
76KB
-
memory/1668-5-0x0000000004E20000-0x0000000004E21000-memory.dmpFilesize
4KB
-
memory/1668-3-0x0000000000D90000-0x0000000000D91000-memory.dmpFilesize
4KB