Analysis
-
max time kernel
150s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
23-02-2021 12:54
Static task
static1
Behavioral task
behavioral1
Sample
SOA.exe
Resource
win7v20201028
General
-
Target
SOA.exe
-
Size
740KB
-
MD5
1d3573643db9a59abcd6b937a33d1f28
-
SHA1
7a00cb31b78616ed1f58cd3550d3ab47a2d66e4a
-
SHA256
8eb77ec70c44e86607e97ce926cdb4e0610a0199c348fa329dba50bef34d5fc1
-
SHA512
a4fc37960b23374d5a2fdf0e5013719a87dd5c90f7deca11ada4215db6ce1f44249f1bc1ec0b9f7071f6d3589dcef725037bf4a50147c5da02c29860b25bbc9f
Malware Config
Extracted
formbook
http://www.fun4gang.xyz/thg/
retrospectphotographydesign.com
jafodraws.com
cigiwie.space
upgradecarehealth.com
12ts.xyz
111indianbend.com
qqchbakery.com
0831xx.com
supecret.com
ayfadopple.com
coldwateradvisors.com
forexgiftcard.com
actionconsultingchile.com
mpsconcrete.net
carmallc.com
b167888.com
simonking.xyz
elitedigitalperformance.com
essentialjanitorialservices.com
barcosocasionberga.com
skyboxorganics.com
luewedrware.com
gypsybrandswag.com
v-surf-boards.com
maxbeautypro.com
bellahappy24.com
translatemyanmar.com
streemsex.com
wql.xyz
2002sport.xyz
septerrallc.com
pk30jpt5n.xyz
propurposepivot.com
vietristore.com
ghyperdigital.com
peau-parfaite.com
hdhldance.com
restaurantweeknepal.com
ww-tree.space
svim.net
flowersforeveraz.net
victormsalazar.com
sinaates.store
photomagazineextra.com
427557.com
regenerativesouls.com
lovestsintao.space
hyweljones.net
rogerbyronlaw.com
retirocard.com
jeterfurniture.com
chekax.com
fryare.info
themarronteam.com
gravitonbeam.com
writinglover.site
theroyaltot.com
blackberry-fr.com
healthpanel.net
diplomx-vo-vladivostoke.com
cftongxing.com
minadoasfalto.com
tokogrosirjaya.com
szmingfang.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/316-8-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/316-9-0x000000000041EAE0-mapping.dmp formbook behavioral1/memory/1520-19-0x0000000000070000-0x000000000009E000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 760 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
SOA.exeSOA.execscript.exedescription pid process target process PID 1684 set thread context of 316 1684 SOA.exe SOA.exe PID 316 set thread context of 1276 316 SOA.exe Explorer.EXE PID 316 set thread context of 1276 316 SOA.exe Explorer.EXE PID 1520 set thread context of 1276 1520 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
SOA.execscript.exepid process 316 SOA.exe 316 SOA.exe 316 SOA.exe 1520 cscript.exe 1520 cscript.exe 1520 cscript.exe 1520 cscript.exe 1520 cscript.exe 1520 cscript.exe 1520 cscript.exe 1520 cscript.exe 1520 cscript.exe 1520 cscript.exe 1520 cscript.exe 1520 cscript.exe 1520 cscript.exe 1520 cscript.exe 1520 cscript.exe 1520 cscript.exe 1520 cscript.exe 1520 cscript.exe 1520 cscript.exe 1520 cscript.exe 1520 cscript.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
SOA.execscript.exepid process 316 SOA.exe 316 SOA.exe 316 SOA.exe 316 SOA.exe 1520 cscript.exe 1520 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SOA.execscript.exedescription pid process Token: SeDebugPrivilege 316 SOA.exe Token: SeDebugPrivilege 1520 cscript.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
SOA.exeExplorer.EXEcscript.exedescription pid process target process PID 1684 wrote to memory of 316 1684 SOA.exe SOA.exe PID 1684 wrote to memory of 316 1684 SOA.exe SOA.exe PID 1684 wrote to memory of 316 1684 SOA.exe SOA.exe PID 1684 wrote to memory of 316 1684 SOA.exe SOA.exe PID 1684 wrote to memory of 316 1684 SOA.exe SOA.exe PID 1684 wrote to memory of 316 1684 SOA.exe SOA.exe PID 1684 wrote to memory of 316 1684 SOA.exe SOA.exe PID 1276 wrote to memory of 1520 1276 Explorer.EXE cscript.exe PID 1276 wrote to memory of 1520 1276 Explorer.EXE cscript.exe PID 1276 wrote to memory of 1520 1276 Explorer.EXE cscript.exe PID 1276 wrote to memory of 1520 1276 Explorer.EXE cscript.exe PID 1520 wrote to memory of 760 1520 cscript.exe cmd.exe PID 1520 wrote to memory of 760 1520 cscript.exe cmd.exe PID 1520 wrote to memory of 760 1520 cscript.exe cmd.exe PID 1520 wrote to memory of 760 1520 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"C:\Users\Admin\AppData\Local\Temp\SOA.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SOA.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/316-12-0x00000000002C0000-0x00000000002D4000-memory.dmpFilesize
80KB
-
memory/316-14-0x0000000000390000-0x00000000003A4000-memory.dmpFilesize
80KB
-
memory/316-8-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/316-9-0x000000000041EAE0-mapping.dmp
-
memory/316-11-0x0000000000AF0000-0x0000000000DF3000-memory.dmpFilesize
3.0MB
-
memory/760-17-0x0000000000000000-mapping.dmp
-
memory/1276-15-0x0000000006CA0000-0x0000000006DC0000-memory.dmpFilesize
1.1MB
-
memory/1276-13-0x0000000004F10000-0x0000000005007000-memory.dmpFilesize
988KB
-
memory/1520-16-0x0000000000000000-mapping.dmp
-
memory/1520-18-0x0000000000A90000-0x0000000000AB2000-memory.dmpFilesize
136KB
-
memory/1520-19-0x0000000000070000-0x000000000009E000-memory.dmpFilesize
184KB
-
memory/1520-20-0x00000000021E0000-0x00000000024E3000-memory.dmpFilesize
3.0MB
-
memory/1520-21-0x0000000000650000-0x00000000006E3000-memory.dmpFilesize
588KB
-
memory/1684-7-0x0000000002210000-0x000000000226B000-memory.dmpFilesize
364KB
-
memory/1684-6-0x0000000000440000-0x000000000044B000-memory.dmpFilesize
44KB
-
memory/1684-5-0x0000000004D80000-0x0000000004D81000-memory.dmpFilesize
4KB
-
memory/1684-2-0x0000000074670000-0x0000000074D5E000-memory.dmpFilesize
6.9MB
-
memory/1684-3-0x0000000000A30000-0x0000000000A31000-memory.dmpFilesize
4KB