Analysis
-
max time kernel
35s -
max time network
119s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
22-01-2021 10:14
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.generic.ml.29418.exe
Resource
win7v20201028
General
-
Target
SecuriteInfo.com.generic.ml.29418.exe
-
Size
999KB
-
MD5
03bfef72c4d962a223cd051d1fe5bbe6
-
SHA1
bb7097101b26eadb4af50f6e2bb21c2cad610217
-
SHA256
f59df25daa1bbe11f38724ad0b36eebc535f1f36ae3796ce5bebe1049cbb57ed
-
SHA512
23b1a4542eb8f530e6984f51e340699c0bda6e03e2c192ef46f61a04358c261ca1f902f5e1c2e36a081fa286f92c4061768e130f38fdca95f3865d9c8cf06874
Malware Config
Extracted
formbook
http://www.huynhanhdung.com/kna/
lawrencefiredepartment.com
executivehomeoffices.com
solfed.world
oshawaexchange.com
webdavlexstore.com
youpieb.com
chiller-master.com
bearstoragetn.com
daf90x16.com
gewhacaalouine.com
simplyezi.com
cstechnologyservices.com
nosyboats.com
thecocomarie.com
vetinaryeco.club
americangoselfilm.com
gdsuhejia.com
verbunden-sein.net
the-minerva.com
loctrantv.com
casualluvonline.com
groups3usa.com
ncdcnow.com
qrastenmap.online
ltjxw.net
crystalblueboating.com
51adcn.com
abrasto.com
smokegas.com
schofieldoutpost.com
sh-ruidiclub.com
zzyxgl.com
qpremodeling.com
ayzvyeco.icu
modestartgallery.com
ref478.com
astutetopshop.com
pinebarrenfarms.com
webprofiji.com
purfect-air.com
transformesuasaude.com
oz-men.com
mpjjpwp.icu
zeinabiohouse.com
shopwaterlemon.com
radiohebron.com
americanheraldnews.com
clinicadentalfika.com
throughthelorgnette.com
carte-diem.com
elderstatesmanarchive.com
nanhulove.com
melonicwater.com
streamingdads.com
indrapandhari.com
dc-prices.com
xstarconnect.com
weninse.com
atlantavirtualmeetings.com
jobhelpseekers.com
freisaq.com
viajeaatenas.com
worldparcel.net
qcc3.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2324-12-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2324-13-0x000000000041EAB0-mapping.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.generic.ml.29418.exedescription pid process target process PID 4720 set thread context of 2324 4720 SecuriteInfo.com.generic.ml.29418.exe SecuriteInfo.com.generic.ml.29418.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SecuriteInfo.com.generic.ml.29418.exepid process 2324 SecuriteInfo.com.generic.ml.29418.exe 2324 SecuriteInfo.com.generic.ml.29418.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
SecuriteInfo.com.generic.ml.29418.exedescription pid process target process PID 4720 wrote to memory of 2324 4720 SecuriteInfo.com.generic.ml.29418.exe SecuriteInfo.com.generic.ml.29418.exe PID 4720 wrote to memory of 2324 4720 SecuriteInfo.com.generic.ml.29418.exe SecuriteInfo.com.generic.ml.29418.exe PID 4720 wrote to memory of 2324 4720 SecuriteInfo.com.generic.ml.29418.exe SecuriteInfo.com.generic.ml.29418.exe PID 4720 wrote to memory of 2324 4720 SecuriteInfo.com.generic.ml.29418.exe SecuriteInfo.com.generic.ml.29418.exe PID 4720 wrote to memory of 2324 4720 SecuriteInfo.com.generic.ml.29418.exe SecuriteInfo.com.generic.ml.29418.exe PID 4720 wrote to memory of 2324 4720 SecuriteInfo.com.generic.ml.29418.exe SecuriteInfo.com.generic.ml.29418.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.generic.ml.29418.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.generic.ml.29418.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.generic.ml.29418.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2324-12-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2324-13-0x000000000041EAB0-mapping.dmp
-
memory/2324-15-0x0000000001690000-0x00000000019B0000-memory.dmpFilesize
3.1MB
-
memory/4720-2-0x0000000073FA0000-0x000000007468E000-memory.dmpFilesize
6.9MB
-
memory/4720-3-0x0000000000AA0000-0x0000000000AA1000-memory.dmpFilesize
4KB
-
memory/4720-5-0x0000000005900000-0x0000000005901000-memory.dmpFilesize
4KB
-
memory/4720-6-0x0000000005400000-0x0000000005401000-memory.dmpFilesize
4KB
-
memory/4720-7-0x00000000053D0000-0x00000000053D1000-memory.dmpFilesize
4KB
-
memory/4720-8-0x0000000005590000-0x000000000559E000-memory.dmpFilesize
56KB
-
memory/4720-9-0x0000000005580000-0x0000000005581000-memory.dmpFilesize
4KB
-
memory/4720-10-0x00000000078E0000-0x000000000797A000-memory.dmpFilesize
616KB
-
memory/4720-11-0x0000000007A20000-0x0000000007A21000-memory.dmpFilesize
4KB