Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
21-04-2021 08:27
Static task
static1
Behavioral task
behavioral1
Sample
DaJvWffC23hWF2u.exe
Resource
win7v20210410
General
-
Target
DaJvWffC23hWF2u.exe
-
Size
639KB
-
MD5
cdf8f544d5a3375d7eebe902a3a3ba50
-
SHA1
1c7fa4d7b221da27e3bddc0f0d494e77df359de5
-
SHA256
a46f0189a9016e0af96bebed0e62fad7bbd7e6223ea036c0e6d2da4f9a04a6cc
-
SHA512
5bb9a8da5bf437c9159999a50c158b41fc5d9878b61d29730539520c921c42976f4bd5446b6c8585dce975e94d535fdf6335bc33063fb610fefe26ff249f728b
Malware Config
Extracted
formbook
4.1
http://www.sevenwhale.com/sdh/
yapayzekaokulu.net
amazservices.com
slfengyang.com
khalijepars.com
quailranchcollection.com
xn--3h3b098b.com
thebladebag.com
iagogai.com
grammypay.com
sdcewrgrg.com
xn--00x51ad76f.com
wongtangstore5.host
yashaxi.com
newdavonhaimefoodbank.com
garden-beach.com
argebirlik.com
redpentoken.com
conversationexperiments.net
wonderwithin.co
salaandco.info
turnkeypet.com
ibrahimpike.com
datascienceenthusiasts.com
sonymusicrockenroll.com
eatrys.com
flyhaitiansociety.store
konegi.com
gallayo.com
lfwealthgroup.com
stormbicker.com
quickpanservice.com
greenvillageaddis.com
phisicsgames.com
walterhandig.com
findlocalkisses.com
callequatymortgages.com
adipurush.com
zuhut.com
vidhipandya.com
e-elections.net
pctrk.net
cumberlandrecording.com
carolynnobleauthor.com
reevolvehardware.com
yab447app.net
gigyanga.com
yanopizza.com
sdrcdhxy.club
heavenlyboutiqueonline.com
vividpallet.com
p0123movies.com
hglgbmkcn.icu
goldenchanceauction.com
szyljzl.com
youtclub.store
floryi.com
nititoursandtravels.com
stronger3.com
insectaffect.com
monnerias.com
logittechg.com
marcotorcivia.com
presidentbyedon.com
sexocoach.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/996-67-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/996-68-0x000000000041EAF0-mapping.dmp formbook behavioral1/memory/972-76-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 932 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
DaJvWffC23hWF2u.exeDaJvWffC23hWF2u.execmd.exedescription pid process target process PID 1864 set thread context of 996 1864 DaJvWffC23hWF2u.exe DaJvWffC23hWF2u.exe PID 996 set thread context of 1224 996 DaJvWffC23hWF2u.exe Explorer.EXE PID 972 set thread context of 1224 972 cmd.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
DaJvWffC23hWF2u.exeDaJvWffC23hWF2u.execmd.exepid process 1864 DaJvWffC23hWF2u.exe 1864 DaJvWffC23hWF2u.exe 996 DaJvWffC23hWF2u.exe 996 DaJvWffC23hWF2u.exe 972 cmd.exe 972 cmd.exe 972 cmd.exe 972 cmd.exe 972 cmd.exe 972 cmd.exe 972 cmd.exe 972 cmd.exe 972 cmd.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
DaJvWffC23hWF2u.execmd.exepid process 996 DaJvWffC23hWF2u.exe 996 DaJvWffC23hWF2u.exe 996 DaJvWffC23hWF2u.exe 972 cmd.exe 972 cmd.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
DaJvWffC23hWF2u.exeDaJvWffC23hWF2u.execmd.exedescription pid process Token: SeDebugPrivilege 1864 DaJvWffC23hWF2u.exe Token: SeDebugPrivilege 996 DaJvWffC23hWF2u.exe Token: SeDebugPrivilege 972 cmd.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
DaJvWffC23hWF2u.exeExplorer.EXEcmd.exedescription pid process target process PID 1864 wrote to memory of 996 1864 DaJvWffC23hWF2u.exe DaJvWffC23hWF2u.exe PID 1864 wrote to memory of 996 1864 DaJvWffC23hWF2u.exe DaJvWffC23hWF2u.exe PID 1864 wrote to memory of 996 1864 DaJvWffC23hWF2u.exe DaJvWffC23hWF2u.exe PID 1864 wrote to memory of 996 1864 DaJvWffC23hWF2u.exe DaJvWffC23hWF2u.exe PID 1864 wrote to memory of 996 1864 DaJvWffC23hWF2u.exe DaJvWffC23hWF2u.exe PID 1864 wrote to memory of 996 1864 DaJvWffC23hWF2u.exe DaJvWffC23hWF2u.exe PID 1864 wrote to memory of 996 1864 DaJvWffC23hWF2u.exe DaJvWffC23hWF2u.exe PID 1224 wrote to memory of 972 1224 Explorer.EXE cmd.exe PID 1224 wrote to memory of 972 1224 Explorer.EXE cmd.exe PID 1224 wrote to memory of 972 1224 Explorer.EXE cmd.exe PID 1224 wrote to memory of 972 1224 Explorer.EXE cmd.exe PID 972 wrote to memory of 932 972 cmd.exe cmd.exe PID 972 wrote to memory of 932 972 cmd.exe cmd.exe PID 972 wrote to memory of 932 972 cmd.exe cmd.exe PID 972 wrote to memory of 932 972 cmd.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DaJvWffC23hWF2u.exe"C:\Users\Admin\AppData\Local\Temp\DaJvWffC23hWF2u.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DaJvWffC23hWF2u.exe"C:\Users\Admin\AppData\Local\Temp\DaJvWffC23hWF2u.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DaJvWffC23hWF2u.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/932-74-0x0000000000000000-mapping.dmp
-
memory/972-73-0x0000000000000000-mapping.dmp
-
memory/972-78-0x0000000001DC0000-0x0000000001E53000-memory.dmpFilesize
588KB
-
memory/972-77-0x0000000001F50000-0x0000000002253000-memory.dmpFilesize
3.0MB
-
memory/972-76-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/972-75-0x000000004A990000-0x000000004A9DC000-memory.dmpFilesize
304KB
-
memory/996-70-0x0000000000950000-0x0000000000C53000-memory.dmpFilesize
3.0MB
-
memory/996-68-0x000000000041EAF0-mapping.dmp
-
memory/996-71-0x0000000000230000-0x0000000000244000-memory.dmpFilesize
80KB
-
memory/996-67-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1224-72-0x0000000004190000-0x000000000428D000-memory.dmpFilesize
1012KB
-
memory/1224-79-0x0000000006E30000-0x0000000006F36000-memory.dmpFilesize
1.0MB
-
memory/1864-60-0x0000000000030000-0x0000000000031000-memory.dmpFilesize
4KB
-
memory/1864-66-0x0000000002000000-0x0000000002033000-memory.dmpFilesize
204KB
-
memory/1864-65-0x0000000005140000-0x00000000051BA000-memory.dmpFilesize
488KB
-
memory/1864-64-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/1864-63-0x0000000000860000-0x0000000000869000-memory.dmpFilesize
36KB
-
memory/1864-62-0x0000000000630000-0x0000000000631000-memory.dmpFilesize
4KB