Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
23-02-2021 12:54
Static task
static1
Behavioral task
behavioral1
Sample
SOA.exe
Resource
win7v20201028
General
-
Target
SOA.exe
-
Size
740KB
-
MD5
1d3573643db9a59abcd6b937a33d1f28
-
SHA1
7a00cb31b78616ed1f58cd3550d3ab47a2d66e4a
-
SHA256
8eb77ec70c44e86607e97ce926cdb4e0610a0199c348fa329dba50bef34d5fc1
-
SHA512
a4fc37960b23374d5a2fdf0e5013719a87dd5c90f7deca11ada4215db6ce1f44249f1bc1ec0b9f7071f6d3589dcef725037bf4a50147c5da02c29860b25bbc9f
Malware Config
Extracted
formbook
http://www.fun4gang.xyz/thg/
retrospectphotographydesign.com
jafodraws.com
cigiwie.space
upgradecarehealth.com
12ts.xyz
111indianbend.com
qqchbakery.com
0831xx.com
supecret.com
ayfadopple.com
coldwateradvisors.com
forexgiftcard.com
actionconsultingchile.com
mpsconcrete.net
carmallc.com
b167888.com
simonking.xyz
elitedigitalperformance.com
essentialjanitorialservices.com
barcosocasionberga.com
skyboxorganics.com
luewedrware.com
gypsybrandswag.com
v-surf-boards.com
maxbeautypro.com
bellahappy24.com
translatemyanmar.com
streemsex.com
wql.xyz
2002sport.xyz
septerrallc.com
pk30jpt5n.xyz
propurposepivot.com
vietristore.com
ghyperdigital.com
peau-parfaite.com
hdhldance.com
restaurantweeknepal.com
ww-tree.space
svim.net
flowersforeveraz.net
victormsalazar.com
sinaates.store
photomagazineextra.com
427557.com
regenerativesouls.com
lovestsintao.space
hyweljones.net
rogerbyronlaw.com
retirocard.com
jeterfurniture.com
chekax.com
fryare.info
themarronteam.com
gravitonbeam.com
writinglover.site
theroyaltot.com
blackberry-fr.com
healthpanel.net
diplomx-vo-vladivostoke.com
cftongxing.com
minadoasfalto.com
tokogrosirjaya.com
szmingfang.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2316-12-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2316-13-0x000000000041EAE0-mapping.dmp formbook behavioral2/memory/3856-22-0x0000000000900000-0x000000000092E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
SOA.exeSOA.exenetsh.exedescription pid process target process PID 812 set thread context of 2316 812 SOA.exe SOA.exe PID 2316 set thread context of 3048 2316 SOA.exe Explorer.EXE PID 3856 set thread context of 3048 3856 netsh.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
SOA.exeSOA.exenetsh.exepid process 812 SOA.exe 812 SOA.exe 2316 SOA.exe 2316 SOA.exe 2316 SOA.exe 2316 SOA.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe 3856 netsh.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
SOA.exenetsh.exepid process 2316 SOA.exe 2316 SOA.exe 2316 SOA.exe 3856 netsh.exe 3856 netsh.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SOA.exeSOA.exenetsh.exedescription pid process Token: SeDebugPrivilege 812 SOA.exe Token: SeDebugPrivilege 2316 SOA.exe Token: SeDebugPrivilege 3856 netsh.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3048 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
SOA.exeExplorer.EXEnetsh.exedescription pid process target process PID 812 wrote to memory of 2392 812 SOA.exe SOA.exe PID 812 wrote to memory of 2392 812 SOA.exe SOA.exe PID 812 wrote to memory of 2392 812 SOA.exe SOA.exe PID 812 wrote to memory of 2316 812 SOA.exe SOA.exe PID 812 wrote to memory of 2316 812 SOA.exe SOA.exe PID 812 wrote to memory of 2316 812 SOA.exe SOA.exe PID 812 wrote to memory of 2316 812 SOA.exe SOA.exe PID 812 wrote to memory of 2316 812 SOA.exe SOA.exe PID 812 wrote to memory of 2316 812 SOA.exe SOA.exe PID 3048 wrote to memory of 3856 3048 Explorer.EXE netsh.exe PID 3048 wrote to memory of 3856 3048 Explorer.EXE netsh.exe PID 3048 wrote to memory of 3856 3048 Explorer.EXE netsh.exe PID 3856 wrote to memory of 656 3856 netsh.exe cmd.exe PID 3856 wrote to memory of 656 3856 netsh.exe cmd.exe PID 3856 wrote to memory of 656 3856 netsh.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"C:\Users\Admin\AppData\Local\Temp\SOA.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SOA.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/656-20-0x0000000000000000-mapping.dmp
-
memory/812-8-0x0000000004FF0000-0x0000000004FF1000-memory.dmpFilesize
4KB
-
memory/812-11-0x0000000006AD0000-0x0000000006B2B000-memory.dmpFilesize
364KB
-
memory/812-6-0x0000000004DA0000-0x0000000004DA1000-memory.dmpFilesize
4KB
-
memory/812-7-0x0000000004E50000-0x0000000004E51000-memory.dmpFilesize
4KB
-
memory/812-2-0x0000000074070000-0x000000007475E000-memory.dmpFilesize
6.9MB
-
memory/812-9-0x0000000008420000-0x0000000008421000-memory.dmpFilesize
4KB
-
memory/812-10-0x0000000008380000-0x000000000838B000-memory.dmpFilesize
44KB
-
memory/812-3-0x0000000000380000-0x0000000000381000-memory.dmpFilesize
4KB
-
memory/812-5-0x0000000005370000-0x0000000005371000-memory.dmpFilesize
4KB
-
memory/2316-13-0x000000000041EAE0-mapping.dmp
-
memory/2316-17-0x0000000001200000-0x0000000001214000-memory.dmpFilesize
80KB
-
memory/2316-12-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2316-16-0x0000000001270000-0x0000000001590000-memory.dmpFilesize
3.1MB
-
memory/3048-26-0x0000000005960000-0x0000000005A11000-memory.dmpFilesize
708KB
-
memory/3048-18-0x0000000002590000-0x000000000264F000-memory.dmpFilesize
764KB
-
memory/3856-23-0x0000000001120000-0x0000000001440000-memory.dmpFilesize
3.1MB
-
memory/3856-22-0x0000000000900000-0x000000000092E000-memory.dmpFilesize
184KB
-
memory/3856-21-0x00000000017D0000-0x00000000017EE000-memory.dmpFilesize
120KB
-
memory/3856-25-0x0000000001440000-0x00000000014D3000-memory.dmpFilesize
588KB
-
memory/3856-19-0x0000000000000000-mapping.dmp