Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
21-04-2021 15:11
Behavioral task
behavioral1
Sample
test_prog.exe
Resource
win7v20210408
General
-
Target
test_prog.exe
-
Size
184KB
-
MD5
010c67f8960f277321803f5b9072dde9
-
SHA1
5980cc8f60853f97ad4879a4109378051387e67d
-
SHA256
317b44cb1a42636529caa86b5d3caeaa3689e3b58f6a414406c5d022635a99a6
-
SHA512
821f700fb2e7d690c4d7a419aec8d367c83a48dffcd4443e823d99a47e23a5592c3fe810ff12a42810eb97261ec93a90a90a76e85c58a39475889ecb281562d5
Malware Config
Extracted
formbook
4.1
http://www.martinbrosenterprise.com/nyd/
acpqpmq.icu
byonf.com
physicianco.com
wecare4therich.com
kenziesboutique.com
coachingfortransformation.co.uk
redenginegames.info
allindefi.xyz
hashflo.com
carnivalhotels.net
yogatrac.com
hotel-gasthof-neukirchen.com
ebn-lapak.com
xn--3iqa8101avze.com
sanimist.store
studentsafetysheild.store
themontalbanogroup.com
oyunhaberler.com
sportsbooksnv.com
yogiinthedistrict.com
corrlib.com
awpnoqe.icu
navagecleaningservices.com
fitangxinyu.com
vortexhairspray.com
aminulhaque.info
tonjilgroup.com
lifehack.academy
100001ip.com
dotacionesmedicasmarmol.com
poyoiz.com
alphamillls.com
disbalef.com
getuewqarefedre.com
rekoup.tax
andalusiaexclusive.com
eternal-affairs.com
shessosophisticated.com
virtualappraisals.online
hezhongvn.com
catalogcardgames.com
8160phaeton.com
wsacs.xyz
wibstow.icu
potoloks-spb.online
fernholt.com
relocatetoswitzerland.com
evservice.network
atome.science
shockleymediacenter.com
omae-mada.xyz
standingstonecellars.com
ynabvn.com
homeofmatriarch.com
legalteamsolutions.com
sheensheer.com
yossiamoday.com
angelinacamwhalen.site
garagedoorrepairparts.com
signworksvalpo.com
dalalh.info
jubawu.com
lifen.club
wfl.xyz
Signatures
-
Formbook Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1520-120-0x00000000007C0000-0x00000000007EE000-memory.dmp formbook -
Suspicious use of SetThreadContext 2 IoCs
Processes:
test_prog.execmstp.exedescription pid process target process PID 1892 set thread context of 2984 1892 test_prog.exe Explorer.EXE PID 1520 set thread context of 2984 1520 cmstp.exe Explorer.EXE -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
test_prog.execmstp.exepid process 1892 test_prog.exe 1892 test_prog.exe 1892 test_prog.exe 1892 test_prog.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe 1520 cmstp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2984 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
test_prog.execmstp.exepid process 1892 test_prog.exe 1892 test_prog.exe 1892 test_prog.exe 1520 cmstp.exe 1520 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
test_prog.exeExplorer.EXEcmstp.exedescription pid process Token: SeDebugPrivilege 1892 test_prog.exe Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeDebugPrivilege 1520 cmstp.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2984 Explorer.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Explorer.EXEcmstp.exedescription pid process target process PID 2984 wrote to memory of 1520 2984 Explorer.EXE cmstp.exe PID 2984 wrote to memory of 1520 2984 Explorer.EXE cmstp.exe PID 2984 wrote to memory of 1520 2984 Explorer.EXE cmstp.exe PID 1520 wrote to memory of 3276 1520 cmstp.exe cmd.exe PID 1520 wrote to memory of 3276 1520 cmstp.exe cmd.exe PID 1520 wrote to memory of 3276 1520 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\test_prog.exe"C:\Users\Admin\AppData\Local\Temp\test_prog.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\test_prog.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1520-117-0x0000000000000000-mapping.dmp
-
memory/1520-120-0x00000000007C0000-0x00000000007EE000-memory.dmpFilesize
184KB
-
memory/1520-119-0x0000000000A10000-0x0000000000A26000-memory.dmpFilesize
88KB
-
memory/1520-121-0x00000000042A0000-0x00000000045C0000-memory.dmpFilesize
3.1MB
-
memory/1520-122-0x0000000004100000-0x0000000004193000-memory.dmpFilesize
588KB
-
memory/1892-114-0x0000000000D00000-0x0000000000DAE000-memory.dmpFilesize
696KB
-
memory/1892-115-0x0000000001260000-0x0000000001274000-memory.dmpFilesize
80KB
-
memory/2984-116-0x00000000065A0000-0x00000000066AA000-memory.dmpFilesize
1.0MB
-
memory/2984-123-0x0000000008F50000-0x000000000909E000-memory.dmpFilesize
1.3MB
-
memory/3276-118-0x0000000000000000-mapping.dmp