Analysis
-
max time kernel
42s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-01-2021 09:46
Static task
static1
Behavioral task
behavioral1
Sample
d4982ab3c53ad21f2b1b96f7ae8042d4.exe
Resource
win7v20201028
General
-
Target
d4982ab3c53ad21f2b1b96f7ae8042d4.exe
-
Size
978KB
-
MD5
d4982ab3c53ad21f2b1b96f7ae8042d4
-
SHA1
0ecf9f1ab5b44da05a2a39bcb5b397c4ef1343ea
-
SHA256
cf18069218b5b834227fa33133f629f24be9c582eeb0caaf0d7641520b1d9748
-
SHA512
2cfdc207d9fc5c22ba420b06bc36fbf3aca4e9b33eb3722bff639c5631445f4c600f66b272b30a7023cb84f46997a7d73fb9a3f7bba8fb00dc88347bb10f5bb2
Malware Config
Extracted
formbook
http://www.bytecommunication.com/aky/
jeiksaoeklea.com
sagame-auto.net
soloseriolavoro.com
thecreatorsbook.com
superskritch.com
oroxequipment.com
heart-of-art.online
liwedfg.com
fisherofsouls.com
jota.xyz
nehyam.com
smart-contact-delivery.com
hoom.guru
dgryds.com
thesoakcpd.com
mishv.com
rings-factory.info
bero-craft-beers.com
podcastnamegenerators.com
856379813.xyz
ruinfectious.com
wdcsupport.com
youngbrokeandeducated.com
shpments75.com
louisbmartinez100th.com
shining.ink
hkexpresswaterford.com
quickcashoffersatl.com
180cliniconline.com
mainriskintl.com
clinicadosorriso.com
kuxueyunkeji.com
smart-acumen.com
maisonkerlann.com
jewishposter.com
xn--w52b77ujva.com
antoniodevivo.com
diversitypatriots.com
tiotacos.company
ventumgi.com
ip-tv.online
smithvilletexashistory.com
amruta-varshini.com
wildpositive.com
alifezap.com
nczjt.net
palmsvillaswhitneyranch.com
experiencemoretogether.com
dewitfire.com
scruffynotfluffy.online
bazarsurtidorico.com
dayscosmetics.com
tpsvegas.com
externalboard.com
2125lynchmere.com
agroplenty.com
easterneuropemall.com
whtoys888.com
writehousepoint.com
ppeaceandgloves.com
sadtire.press
jj3994.com
smokenengines.com
offplanprojects-re.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3728-12-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3728-13-0x000000000041EB60-mapping.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
d4982ab3c53ad21f2b1b96f7ae8042d4.exedescription pid process target process PID 580 set thread context of 3728 580 d4982ab3c53ad21f2b1b96f7ae8042d4.exe d4982ab3c53ad21f2b1b96f7ae8042d4.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
d4982ab3c53ad21f2b1b96f7ae8042d4.exed4982ab3c53ad21f2b1b96f7ae8042d4.exepid process 580 d4982ab3c53ad21f2b1b96f7ae8042d4.exe 580 d4982ab3c53ad21f2b1b96f7ae8042d4.exe 3728 d4982ab3c53ad21f2b1b96f7ae8042d4.exe 3728 d4982ab3c53ad21f2b1b96f7ae8042d4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
d4982ab3c53ad21f2b1b96f7ae8042d4.exedescription pid process Token: SeDebugPrivilege 580 d4982ab3c53ad21f2b1b96f7ae8042d4.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
d4982ab3c53ad21f2b1b96f7ae8042d4.exedescription pid process target process PID 580 wrote to memory of 2832 580 d4982ab3c53ad21f2b1b96f7ae8042d4.exe d4982ab3c53ad21f2b1b96f7ae8042d4.exe PID 580 wrote to memory of 2832 580 d4982ab3c53ad21f2b1b96f7ae8042d4.exe d4982ab3c53ad21f2b1b96f7ae8042d4.exe PID 580 wrote to memory of 2832 580 d4982ab3c53ad21f2b1b96f7ae8042d4.exe d4982ab3c53ad21f2b1b96f7ae8042d4.exe PID 580 wrote to memory of 3728 580 d4982ab3c53ad21f2b1b96f7ae8042d4.exe d4982ab3c53ad21f2b1b96f7ae8042d4.exe PID 580 wrote to memory of 3728 580 d4982ab3c53ad21f2b1b96f7ae8042d4.exe d4982ab3c53ad21f2b1b96f7ae8042d4.exe PID 580 wrote to memory of 3728 580 d4982ab3c53ad21f2b1b96f7ae8042d4.exe d4982ab3c53ad21f2b1b96f7ae8042d4.exe PID 580 wrote to memory of 3728 580 d4982ab3c53ad21f2b1b96f7ae8042d4.exe d4982ab3c53ad21f2b1b96f7ae8042d4.exe PID 580 wrote to memory of 3728 580 d4982ab3c53ad21f2b1b96f7ae8042d4.exe d4982ab3c53ad21f2b1b96f7ae8042d4.exe PID 580 wrote to memory of 3728 580 d4982ab3c53ad21f2b1b96f7ae8042d4.exe d4982ab3c53ad21f2b1b96f7ae8042d4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4982ab3c53ad21f2b1b96f7ae8042d4.exe"C:\Users\Admin\AppData\Local\Temp\d4982ab3c53ad21f2b1b96f7ae8042d4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d4982ab3c53ad21f2b1b96f7ae8042d4.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\d4982ab3c53ad21f2b1b96f7ae8042d4.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/580-2-0x0000000073F30000-0x000000007461E000-memory.dmpFilesize
6.9MB
-
memory/580-3-0x0000000000930000-0x0000000000931000-memory.dmpFilesize
4KB
-
memory/580-5-0x00000000056C0000-0x00000000056C1000-memory.dmpFilesize
4KB
-
memory/580-6-0x0000000005270000-0x0000000005271000-memory.dmpFilesize
4KB
-
memory/580-7-0x00000000053F0000-0x00000000053F1000-memory.dmpFilesize
4KB
-
memory/580-8-0x00000000053D0000-0x00000000053D1000-memory.dmpFilesize
4KB
-
memory/580-9-0x00000000056B0000-0x00000000056BE000-memory.dmpFilesize
56KB
-
memory/580-10-0x0000000007720000-0x000000000777D000-memory.dmpFilesize
372KB
-
memory/580-11-0x0000000007820000-0x0000000007821000-memory.dmpFilesize
4KB
-
memory/3728-12-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3728-13-0x000000000041EB60-mapping.dmp
-
memory/3728-15-0x0000000001960000-0x0000000001C80000-memory.dmpFilesize
3.1MB