Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
21-04-2021 15:11
Behavioral task
behavioral1
Sample
test_prog.exe
Resource
win7v20210408
General
-
Target
test_prog.exe
-
Size
184KB
-
MD5
010c67f8960f277321803f5b9072dde9
-
SHA1
5980cc8f60853f97ad4879a4109378051387e67d
-
SHA256
317b44cb1a42636529caa86b5d3caeaa3689e3b58f6a414406c5d022635a99a6
-
SHA512
821f700fb2e7d690c4d7a419aec8d367c83a48dffcd4443e823d99a47e23a5592c3fe810ff12a42810eb97261ec93a90a90a76e85c58a39475889ecb281562d5
Malware Config
Extracted
formbook
4.1
http://www.martinbrosenterprise.com/nyd/
acpqpmq.icu
byonf.com
physicianco.com
wecare4therich.com
kenziesboutique.com
coachingfortransformation.co.uk
redenginegames.info
allindefi.xyz
hashflo.com
carnivalhotels.net
yogatrac.com
hotel-gasthof-neukirchen.com
ebn-lapak.com
xn--3iqa8101avze.com
sanimist.store
studentsafetysheild.store
themontalbanogroup.com
oyunhaberler.com
sportsbooksnv.com
yogiinthedistrict.com
corrlib.com
awpnoqe.icu
navagecleaningservices.com
fitangxinyu.com
vortexhairspray.com
aminulhaque.info
tonjilgroup.com
lifehack.academy
100001ip.com
dotacionesmedicasmarmol.com
poyoiz.com
alphamillls.com
disbalef.com
getuewqarefedre.com
rekoup.tax
andalusiaexclusive.com
eternal-affairs.com
shessosophisticated.com
virtualappraisals.online
hezhongvn.com
catalogcardgames.com
8160phaeton.com
wsacs.xyz
wibstow.icu
potoloks-spb.online
fernholt.com
relocatetoswitzerland.com
evservice.network
atome.science
shockleymediacenter.com
omae-mada.xyz
standingstonecellars.com
ynabvn.com
homeofmatriarch.com
legalteamsolutions.com
sheensheer.com
yossiamoday.com
angelinacamwhalen.site
garagedoorrepairparts.com
signworksvalpo.com
dalalh.info
jubawu.com
lifen.club
wfl.xyz
Signatures
-
Formbook Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1264-67-0x0000000000090000-0x00000000000BE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1508 cmd.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
test_prog.exerundll32.exedescription pid process target process PID 1612 set thread context of 1272 1612 test_prog.exe Explorer.EXE PID 1264 set thread context of 1272 1264 rundll32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
test_prog.exerundll32.exepid process 1612 test_prog.exe 1612 test_prog.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe 1264 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
test_prog.exerundll32.exepid process 1612 test_prog.exe 1612 test_prog.exe 1612 test_prog.exe 1264 rundll32.exe 1264 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
test_prog.exerundll32.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1612 test_prog.exe Token: SeDebugPrivilege 1264 rundll32.exe Token: SeShutdownPrivilege 1272 Explorer.EXE Token: SeShutdownPrivilege 1272 Explorer.EXE Token: SeShutdownPrivilege 1272 Explorer.EXE Token: SeShutdownPrivilege 1272 Explorer.EXE Token: SeShutdownPrivilege 1272 Explorer.EXE -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SendNotifyMessage 38 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Explorer.EXErundll32.exedescription pid process target process PID 1272 wrote to memory of 1264 1272 Explorer.EXE rundll32.exe PID 1272 wrote to memory of 1264 1272 Explorer.EXE rundll32.exe PID 1272 wrote to memory of 1264 1272 Explorer.EXE rundll32.exe PID 1272 wrote to memory of 1264 1272 Explorer.EXE rundll32.exe PID 1272 wrote to memory of 1264 1272 Explorer.EXE rundll32.exe PID 1272 wrote to memory of 1264 1272 Explorer.EXE rundll32.exe PID 1272 wrote to memory of 1264 1272 Explorer.EXE rundll32.exe PID 1264 wrote to memory of 1508 1264 rundll32.exe cmd.exe PID 1264 wrote to memory of 1508 1264 rundll32.exe cmd.exe PID 1264 wrote to memory of 1508 1264 rundll32.exe cmd.exe PID 1264 wrote to memory of 1508 1264 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\test_prog.exe"C:\Users\Admin\AppData\Local\Temp\test_prog.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\test_prog.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1264-63-0x0000000000000000-mapping.dmp
-
memory/1264-64-0x0000000075D51000-0x0000000075D53000-memory.dmpFilesize
8KB
-
memory/1264-66-0x00000000004B0000-0x00000000004BE000-memory.dmpFilesize
56KB
-
memory/1264-67-0x0000000000090000-0x00000000000BE000-memory.dmpFilesize
184KB
-
memory/1264-68-0x0000000001FB0000-0x00000000022B3000-memory.dmpFilesize
3.0MB
-
memory/1264-69-0x0000000001E20000-0x0000000001EB3000-memory.dmpFilesize
588KB
-
memory/1272-59-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1272-62-0x0000000006B50000-0x0000000006CB6000-memory.dmpFilesize
1.4MB
-
memory/1272-70-0x0000000006CC0000-0x0000000006E37000-memory.dmpFilesize
1.5MB
-
memory/1508-65-0x0000000000000000-mapping.dmp
-
memory/1612-60-0x0000000000AE0000-0x0000000000DE3000-memory.dmpFilesize
3.0MB
-
memory/1612-61-0x0000000000150000-0x0000000000164000-memory.dmpFilesize
80KB