Analysis
-
max time kernel
148s -
max time network
39s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 07:55
Static task
static1
Behavioral task
behavioral1
Sample
PO210119.exe
Resource
win7v20201028
General
-
Target
PO210119.exe
-
Size
1.5MB
-
MD5
b074bc8cc313c6fcafe448ae189de963
-
SHA1
427ad90e6f9e40c447a66dedb344c788764cbf92
-
SHA256
f6a1cf040ecee307e3e5289f73b27664e33db21aaac5142e89b2a956934ae0c9
-
SHA512
86067908dc9e432cb6362e1925d0aa5e57cde258d5c4dfb724a8e1dde9a273b1062e2a37d1ee82ea10ed08f7f20619ed96f5df6cad81c90d0757fd7d055b371a
Malware Config
Extracted
formbook
http://www.midnightblueinc.com/2kf/
edmondscakes.com
doublewldr.online
tickets2usa.com
heyhxry.com
weightloss-gulfport.com
prosselius.com
newviewroofers.com
jacksonarearealestate.com
catparkas.xyz
pagos2020.com
sonwsefjrahi.online
franchisethings.com
nuocvietngaynay.com
sohelvai.com
mikeyroush.com
lamesaroofing.com
betbigo138.com
amazon-service-recovery.com
clockin.net
riostrader.com
novergi.com
bounethone.online
unsaluted-muckworm.info
qmglg.com
trans-chna.com
bloom-cottage.info
espacioholista.com
vitrines72.com
vtnywveb.club
shelfdryrock.com
lowcountrykindermusik.com
brendolangiovanni.com
samilisback.com
coffeeofmyheart.com
moderndetailist.com
royalparkhotelandsuites.com
camsick.com
khoetuthiennhien.com
link-glue.com
zzirk.com
alyxthorne.com
tristateinsurancegroup.com
pdztwl.com
basecampmedics.com
orionbilisim.net
comaholic.com
sai-re.com
mimmodetullio.net
thevyvd.com
bookstorie.com
preparednessnow.net
lvtvmounting.com
anchondowedding.com
the-florida-accident-md.com
indyspirits.com
culture-of-safety.com
blue-003.com
federation-advens.com
junmedicare.com
qjnhilfhs.icu
chesed72.com
kingrvrentals.com
greenlightsuccesscoach.com
efrenjose.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1664-10-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1664-11-0x000000000041EB30-mapping.dmp formbook behavioral1/memory/816-22-0x00000000000D0000-0x00000000000FE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1056 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
PO210119.exePO210119.execmstp.exedescription pid process target process PID 1596 set thread context of 1664 1596 PO210119.exe PO210119.exe PID 1664 set thread context of 1232 1664 PO210119.exe Explorer.EXE PID 1664 set thread context of 1232 1664 PO210119.exe Explorer.EXE PID 816 set thread context of 1232 816 cmstp.exe Explorer.EXE -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
PO210119.execmstp.exepid process 1664 PO210119.exe 1664 PO210119.exe 1664 PO210119.exe 816 cmstp.exe 816 cmstp.exe 816 cmstp.exe 816 cmstp.exe 816 cmstp.exe 816 cmstp.exe 816 cmstp.exe 816 cmstp.exe 816 cmstp.exe 816 cmstp.exe 816 cmstp.exe 816 cmstp.exe 816 cmstp.exe 816 cmstp.exe 816 cmstp.exe 816 cmstp.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
PO210119.execmstp.exepid process 1664 PO210119.exe 1664 PO210119.exe 1664 PO210119.exe 1664 PO210119.exe 816 cmstp.exe 816 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PO210119.exePO210119.execmstp.exedescription pid process Token: SeDebugPrivilege 1596 PO210119.exe Token: SeDebugPrivilege 1664 PO210119.exe Token: SeDebugPrivilege 816 cmstp.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1232 Explorer.EXE 1232 Explorer.EXE 1232 Explorer.EXE 1232 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1232 Explorer.EXE 1232 Explorer.EXE 1232 Explorer.EXE 1232 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
PO210119.exeExplorer.EXEcmstp.exedescription pid process target process PID 1596 wrote to memory of 1456 1596 PO210119.exe schtasks.exe PID 1596 wrote to memory of 1456 1596 PO210119.exe schtasks.exe PID 1596 wrote to memory of 1456 1596 PO210119.exe schtasks.exe PID 1596 wrote to memory of 1456 1596 PO210119.exe schtasks.exe PID 1596 wrote to memory of 1664 1596 PO210119.exe PO210119.exe PID 1596 wrote to memory of 1664 1596 PO210119.exe PO210119.exe PID 1596 wrote to memory of 1664 1596 PO210119.exe PO210119.exe PID 1596 wrote to memory of 1664 1596 PO210119.exe PO210119.exe PID 1596 wrote to memory of 1664 1596 PO210119.exe PO210119.exe PID 1596 wrote to memory of 1664 1596 PO210119.exe PO210119.exe PID 1596 wrote to memory of 1664 1596 PO210119.exe PO210119.exe PID 1232 wrote to memory of 816 1232 Explorer.EXE cmstp.exe PID 1232 wrote to memory of 816 1232 Explorer.EXE cmstp.exe PID 1232 wrote to memory of 816 1232 Explorer.EXE cmstp.exe PID 1232 wrote to memory of 816 1232 Explorer.EXE cmstp.exe PID 1232 wrote to memory of 816 1232 Explorer.EXE cmstp.exe PID 1232 wrote to memory of 816 1232 Explorer.EXE cmstp.exe PID 1232 wrote to memory of 816 1232 Explorer.EXE cmstp.exe PID 816 wrote to memory of 1056 816 cmstp.exe cmd.exe PID 816 wrote to memory of 1056 816 cmstp.exe cmd.exe PID 816 wrote to memory of 1056 816 cmstp.exe cmd.exe PID 816 wrote to memory of 1056 816 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO210119.exe"C:\Users\Admin\AppData\Local\Temp\PO210119.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uczynErOwa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5763.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PO210119.exe"C:\Users\Admin\AppData\Local\Temp\PO210119.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO210119.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5763.tmpMD5
5da53e59b5484d4052675ae0820ad671
SHA155a5856bd6ae28605689c47df1b072bea0765978
SHA2563464d2b49d40056567bca9adcb62bba54e20a693cf114aa6295638920fe4189b
SHA512d30aaf333f5cbf5d4e327d030329ae406846d3e9bc4ea25758f1e5548571bb51dd2dcbbf0229705ab6965ad6673d65d209807ac6fe2d83774f75c13ebe884012
-
memory/816-24-0x0000000001E40000-0x0000000001ED3000-memory.dmpFilesize
588KB
-
memory/816-23-0x0000000001EE0000-0x00000000021E3000-memory.dmpFilesize
3.0MB
-
memory/816-22-0x00000000000D0000-0x00000000000FE000-memory.dmpFilesize
184KB
-
memory/816-21-0x0000000000310000-0x0000000000328000-memory.dmpFilesize
96KB
-
memory/816-19-0x0000000075781000-0x0000000075783000-memory.dmpFilesize
8KB
-
memory/816-18-0x0000000000000000-mapping.dmp
-
memory/1056-20-0x0000000000000000-mapping.dmp
-
memory/1232-15-0x0000000004190000-0x0000000004300000-memory.dmpFilesize
1.4MB
-
memory/1232-17-0x00000000071A0000-0x0000000007345000-memory.dmpFilesize
1.6MB
-
memory/1456-8-0x0000000000000000-mapping.dmp
-
memory/1596-2-0x0000000074450000-0x0000000074B3E000-memory.dmpFilesize
6.9MB
-
memory/1596-7-0x0000000007510000-0x0000000007576000-memory.dmpFilesize
408KB
-
memory/1596-6-0x0000000000A30000-0x0000000000A31000-memory.dmpFilesize
4KB
-
memory/1596-5-0x0000000000580000-0x00000000005A3000-memory.dmpFilesize
140KB
-
memory/1596-3-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1664-14-0x0000000000120000-0x0000000000134000-memory.dmpFilesize
80KB
-
memory/1664-16-0x00000000001E0000-0x00000000001F4000-memory.dmpFilesize
80KB
-
memory/1664-13-0x00000000009B0000-0x0000000000CB3000-memory.dmpFilesize
3.0MB
-
memory/1664-11-0x000000000041EB30-mapping.dmp
-
memory/1664-10-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB