Analysis
-
max time kernel
5s -
max time network
9s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-01-2021 09:07
Static task
static1
Behavioral task
behavioral1
Sample
inv.exe
Resource
win7v20201028
General
-
Target
inv.exe
-
Size
343KB
-
MD5
59ca7615f52a57b4d4528956889491ca
-
SHA1
790ffd88a22f28df64c491e9fef87d50ceb9bfb7
-
SHA256
bfa63841a36301ed60a4a0c177ad229a1b09266034182b7c8695fa5d7324f0b4
-
SHA512
6564a9edcc216bfde643e24604cb2f536ea997bf902d933c40760ff834decb990f2f70f968484a27619551e4e493adcf867f0a19c1806a8142845692102f95fd
Malware Config
Extracted
formbook
http://www.nationshiphop.com/hko6/
apartmentsineverettwa.com
forritcu.net
hotroodes.com
skinnerttc.com
royaltrustmyanmar.com
adreslog.com
kaysbridalboutiques.com
multitask-improvements.com
geniiforum.com
smarthomehatinh.asia
banglikeaboss.com
javlover.club
affiliateclubindia.com
mycapecoralhomevalue.com
comparamuebles.online
newrochellenissan.com
nairobi-paris.com
fwk.xyz
downdepot.com
nextgenmemorabilia.com
achonabu.com
stevebana.xyz
jacmkt.com
weownthenight187.com
divshop.pro
wewearceylon.com
skyreadymix.net
jaffacorner.com
bakerlibra.icu
femalecoliving.com
best20banks.com
millcityloam.com
signature-office.com
qlifepharmacy.com
dextermind.net
fittcycleacademy.com
davidoff.sucks
1033393.com
tutorsboulder.com
bonicc.com
goodberryjuice.com
zhaowulu.com
teryaq.media
a-zsolutionsllc.com
bitcoincandy.xyz
cfmfair.com
annefontain.com
princesssexyluxwear.com
prodigybrushes.com
zzhqp.com
hwcailing.com
translatiions.com
azery.site
wy1917.com
ringohouse.info
chartershome.com
thongtinhay.net
2201virginiacondo5.com
laurieryork.net
mujeresnegociantes.com
anchoriaswimwear.com
michaelsala.com
esdeportebici.com
ninjitsoo.com
Signatures
-
Formbook Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2008-5-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
inv.exedescription pid process target process PID 1852 set thread context of 2008 1852 inv.exe inv.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1384 2008 WerFault.exe inv.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
WerFault.exepid process 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
inv.exepid process 1852 inv.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 1384 WerFault.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
inv.exeinv.exedescription pid process target process PID 1852 wrote to memory of 2008 1852 inv.exe inv.exe PID 1852 wrote to memory of 2008 1852 inv.exe inv.exe PID 1852 wrote to memory of 2008 1852 inv.exe inv.exe PID 1852 wrote to memory of 2008 1852 inv.exe inv.exe PID 1852 wrote to memory of 2008 1852 inv.exe inv.exe PID 2008 wrote to memory of 1384 2008 inv.exe WerFault.exe PID 2008 wrote to memory of 1384 2008 inv.exe WerFault.exe PID 2008 wrote to memory of 1384 2008 inv.exe WerFault.exe PID 2008 wrote to memory of 1384 2008 inv.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\inv.exe"C:\Users\Admin\AppData\Local\Temp\inv.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\inv.exe"C:\Users\Admin\AppData\Local\Temp\inv.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 363⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1384-3-0x0000000000000000-mapping.dmp
-
memory/1384-4-0x0000000002070000-0x0000000002081000-memory.dmpFilesize
68KB
-
memory/1384-6-0x00000000025A0000-0x00000000025B1000-memory.dmpFilesize
68KB
-
memory/1384-7-0x00000000756C1000-0x00000000756C3000-memory.dmpFilesize
8KB
-
memory/1384-8-0x0000000000340000-0x0000000000341000-memory.dmpFilesize
4KB
-
memory/2008-2-0x000000000041ECF0-mapping.dmp
-
memory/2008-5-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB