Analysis
-
max time kernel
148s -
max time network
10s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 07:26
Static task
static1
Behavioral task
behavioral1
Sample
payment advise.exe
Resource
win7v20201028
General
-
Target
payment advise.exe
-
Size
1.4MB
-
MD5
7d752130c300fcf1d2cd1668fc29ae28
-
SHA1
ec52bc66ee4f080618fdc06aa994765c0adc6dee
-
SHA256
7a434269888c9382307a609aceba2b185542ab901cda169d761c2650c84f2f4e
-
SHA512
72d0a485ee362f5c1688c5dc2e6507ecaa18f574e73ef8b9e9d71b94179f361ed106e05824c43e5f3eeda8bcc9c1b8c471bd2dac94f4497388b5cf78681aa928
Malware Config
Extracted
formbook
http://www.aftabzahur.com/wgn/
kokokara-life-blog.com
faswear.com
futureleadershiptoday.com
date4done.xyz
thecouponinn.com
bbeycarpetsf.com
propolisnasalspray.com
jinjudiamond.com
goodevectors.com
nehyam.com
evalinkapuppets.com
what-if-statistics.com
rateofrisk.com
impacttestonlinne.com
servis-kaydet.info
coloniacafe.com
marcemarketing.com
aarigging.com
goddesswitchery.com
jasqblo.icu
ballotlocations.com
opulentredesign.com
nicolakwan.com
timcarecskh.online
albertaeatsfood.com
impactnwf.com
transportersolutions.com
jkfdjkdjkfjkddre.com
haslvapps.com
oakhazelnut.com
jazzyfans.net
uklcp.com
genericfreeemailservice.com
jettbay.com
utahcommunitynewsnetwork.com
vinos-online.com
lafatime.com
2438kingsland.com
groovepags.com
locationwhiz.com
edu1center.com
chronic-trauma.com
ytr.xyz
airconacademy-courses.com
gawafeqauibne.com
flowcedure.com
bwproskill.com
woodenbros.com
thesearsgroupnc.com
whoaminot.com
addvations.com
fatboidonuts.com
mobileworkforcevpn.net
offto.site
tehospedamos.com
nadinerae.com
betherightcandidate.com
ethosgov.com
cgbaran.com
xynewadmrykaa.com
socialdistancing.cool
kedalamsapi.com
hendifishing.online
geniusprosolutions.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2012-9-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/2012-10-0x000000000041EAC0-mapping.dmp formbook behavioral1/memory/760-17-0x00000000000C0000-0x00000000000EE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1120 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
payment advise.exepayment advise.exehelp.exedescription pid process target process PID 2028 set thread context of 2012 2028 payment advise.exe payment advise.exe PID 2012 set thread context of 1252 2012 payment advise.exe Explorer.EXE PID 760 set thread context of 1252 760 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
payment advise.exepayment advise.exehelp.exepid process 2028 payment advise.exe 2028 payment advise.exe 2028 payment advise.exe 2012 payment advise.exe 2012 payment advise.exe 760 help.exe 760 help.exe 760 help.exe 760 help.exe 760 help.exe 760 help.exe 760 help.exe 760 help.exe 760 help.exe 760 help.exe 760 help.exe 760 help.exe 760 help.exe 760 help.exe 760 help.exe 760 help.exe 760 help.exe 760 help.exe 760 help.exe 760 help.exe 760 help.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
payment advise.exehelp.exepid process 2012 payment advise.exe 2012 payment advise.exe 2012 payment advise.exe 760 help.exe 760 help.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
payment advise.exepayment advise.exehelp.exedescription pid process Token: SeDebugPrivilege 2028 payment advise.exe Token: SeDebugPrivilege 2012 payment advise.exe Token: SeDebugPrivilege 760 help.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
payment advise.exeExplorer.EXEhelp.exedescription pid process target process PID 2028 wrote to memory of 2012 2028 payment advise.exe payment advise.exe PID 2028 wrote to memory of 2012 2028 payment advise.exe payment advise.exe PID 2028 wrote to memory of 2012 2028 payment advise.exe payment advise.exe PID 2028 wrote to memory of 2012 2028 payment advise.exe payment advise.exe PID 2028 wrote to memory of 2012 2028 payment advise.exe payment advise.exe PID 2028 wrote to memory of 2012 2028 payment advise.exe payment advise.exe PID 2028 wrote to memory of 2012 2028 payment advise.exe payment advise.exe PID 1252 wrote to memory of 760 1252 Explorer.EXE help.exe PID 1252 wrote to memory of 760 1252 Explorer.EXE help.exe PID 1252 wrote to memory of 760 1252 Explorer.EXE help.exe PID 1252 wrote to memory of 760 1252 Explorer.EXE help.exe PID 760 wrote to memory of 1120 760 help.exe cmd.exe PID 760 wrote to memory of 1120 760 help.exe cmd.exe PID 760 wrote to memory of 1120 760 help.exe cmd.exe PID 760 wrote to memory of 1120 760 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\payment advise.exe"C:\Users\Admin\AppData\Local\Temp\payment advise.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\payment advise.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2012 -
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\payment advise.exe"3⤵
- Deletes itself
PID:1120
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/760-20-0x0000000000550000-0x00000000005E3000-memory.dmpFilesize
588KB
-
memory/760-18-0x0000000000690000-0x0000000000993000-memory.dmpFilesize
3.0MB
-
memory/760-17-0x00000000000C0000-0x00000000000EE000-memory.dmpFilesize
184KB
-
memory/760-16-0x0000000000A00000-0x0000000000A06000-memory.dmpFilesize
24KB
-
memory/760-15-0x0000000000000000-mapping.dmp
-
memory/1120-19-0x0000000000000000-mapping.dmp
-
memory/1252-14-0x0000000003C40000-0x0000000003D05000-memory.dmpFilesize
788KB
-
memory/2012-12-0x0000000000AA0000-0x0000000000DA3000-memory.dmpFilesize
3.0MB
-
memory/2012-13-0x0000000000180000-0x0000000000194000-memory.dmpFilesize
80KB
-
memory/2012-10-0x000000000041EAC0-mapping.dmp
-
memory/2012-9-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2028-2-0x0000000074EE0000-0x00000000755CE000-memory.dmpFilesize
6.9MB
-
memory/2028-8-0x0000000004860000-0x00000000048BB000-memory.dmpFilesize
364KB
-
memory/2028-7-0x0000000000540000-0x000000000054E000-memory.dmpFilesize
56KB
-
memory/2028-6-0x0000000000500000-0x0000000000501000-memory.dmpFilesize
4KB
-
memory/2028-5-0x00000000005C0000-0x000000000063E000-memory.dmpFilesize
504KB
-
memory/2028-3-0x0000000001010000-0x0000000001011000-memory.dmpFilesize
4KB