Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
21-04-2021 08:27
Static task
static1
Behavioral task
behavioral1
Sample
DaJvWffC23hWF2u.exe
Resource
win7v20210410
General
-
Target
DaJvWffC23hWF2u.exe
-
Size
639KB
-
MD5
cdf8f544d5a3375d7eebe902a3a3ba50
-
SHA1
1c7fa4d7b221da27e3bddc0f0d494e77df359de5
-
SHA256
a46f0189a9016e0af96bebed0e62fad7bbd7e6223ea036c0e6d2da4f9a04a6cc
-
SHA512
5bb9a8da5bf437c9159999a50c158b41fc5d9878b61d29730539520c921c42976f4bd5446b6c8585dce975e94d535fdf6335bc33063fb610fefe26ff249f728b
Malware Config
Extracted
formbook
4.1
http://www.sevenwhale.com/sdh/
yapayzekaokulu.net
amazservices.com
slfengyang.com
khalijepars.com
quailranchcollection.com
xn--3h3b098b.com
thebladebag.com
iagogai.com
grammypay.com
sdcewrgrg.com
xn--00x51ad76f.com
wongtangstore5.host
yashaxi.com
newdavonhaimefoodbank.com
garden-beach.com
argebirlik.com
redpentoken.com
conversationexperiments.net
wonderwithin.co
salaandco.info
turnkeypet.com
ibrahimpike.com
datascienceenthusiasts.com
sonymusicrockenroll.com
eatrys.com
flyhaitiansociety.store
konegi.com
gallayo.com
lfwealthgroup.com
stormbicker.com
quickpanservice.com
greenvillageaddis.com
phisicsgames.com
walterhandig.com
findlocalkisses.com
callequatymortgages.com
adipurush.com
zuhut.com
vidhipandya.com
e-elections.net
pctrk.net
cumberlandrecording.com
carolynnobleauthor.com
reevolvehardware.com
yab447app.net
gigyanga.com
yanopizza.com
sdrcdhxy.club
heavenlyboutiqueonline.com
vividpallet.com
p0123movies.com
hglgbmkcn.icu
goldenchanceauction.com
szyljzl.com
youtclub.store
floryi.com
nititoursandtravels.com
stronger3.com
insectaffect.com
monnerias.com
logittechg.com
marcotorcivia.com
presidentbyedon.com
sexocoach.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1484-125-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/1484-126-0x000000000041EAF0-mapping.dmp formbook behavioral2/memory/1020-133-0x0000000002E00000-0x0000000002E2E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
DaJvWffC23hWF2u.exeDaJvWffC23hWF2u.execmstp.exedescription pid process target process PID 796 set thread context of 1484 796 DaJvWffC23hWF2u.exe DaJvWffC23hWF2u.exe PID 1484 set thread context of 3024 1484 DaJvWffC23hWF2u.exe Explorer.EXE PID 1020 set thread context of 3024 1020 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
DaJvWffC23hWF2u.exeDaJvWffC23hWF2u.execmstp.exepid process 796 DaJvWffC23hWF2u.exe 796 DaJvWffC23hWF2u.exe 796 DaJvWffC23hWF2u.exe 1484 DaJvWffC23hWF2u.exe 1484 DaJvWffC23hWF2u.exe 1484 DaJvWffC23hWF2u.exe 1484 DaJvWffC23hWF2u.exe 1020 cmstp.exe 1020 cmstp.exe 1020 cmstp.exe 1020 cmstp.exe 1020 cmstp.exe 1020 cmstp.exe 1020 cmstp.exe 1020 cmstp.exe 1020 cmstp.exe 1020 cmstp.exe 1020 cmstp.exe 1020 cmstp.exe 1020 cmstp.exe 1020 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
DaJvWffC23hWF2u.execmstp.exepid process 1484 DaJvWffC23hWF2u.exe 1484 DaJvWffC23hWF2u.exe 1484 DaJvWffC23hWF2u.exe 1020 cmstp.exe 1020 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
DaJvWffC23hWF2u.exeDaJvWffC23hWF2u.execmstp.exedescription pid process Token: SeDebugPrivilege 796 DaJvWffC23hWF2u.exe Token: SeDebugPrivilege 1484 DaJvWffC23hWF2u.exe Token: SeDebugPrivilege 1020 cmstp.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
DaJvWffC23hWF2u.exeExplorer.EXEcmstp.exedescription pid process target process PID 796 wrote to memory of 1484 796 DaJvWffC23hWF2u.exe DaJvWffC23hWF2u.exe PID 796 wrote to memory of 1484 796 DaJvWffC23hWF2u.exe DaJvWffC23hWF2u.exe PID 796 wrote to memory of 1484 796 DaJvWffC23hWF2u.exe DaJvWffC23hWF2u.exe PID 796 wrote to memory of 1484 796 DaJvWffC23hWF2u.exe DaJvWffC23hWF2u.exe PID 796 wrote to memory of 1484 796 DaJvWffC23hWF2u.exe DaJvWffC23hWF2u.exe PID 796 wrote to memory of 1484 796 DaJvWffC23hWF2u.exe DaJvWffC23hWF2u.exe PID 3024 wrote to memory of 1020 3024 Explorer.EXE cmstp.exe PID 3024 wrote to memory of 1020 3024 Explorer.EXE cmstp.exe PID 3024 wrote to memory of 1020 3024 Explorer.EXE cmstp.exe PID 1020 wrote to memory of 964 1020 cmstp.exe cmd.exe PID 1020 wrote to memory of 964 1020 cmstp.exe cmd.exe PID 1020 wrote to memory of 964 1020 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DaJvWffC23hWF2u.exe"C:\Users\Admin\AppData\Local\Temp\DaJvWffC23hWF2u.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DaJvWffC23hWF2u.exe"C:\Users\Admin\AppData\Local\Temp\DaJvWffC23hWF2u.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DaJvWffC23hWF2u.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/796-114-0x00000000007E0000-0x00000000007E1000-memory.dmpFilesize
4KB
-
memory/796-116-0x0000000005700000-0x0000000005701000-memory.dmpFilesize
4KB
-
memory/796-117-0x00000000050F0000-0x00000000050F1000-memory.dmpFilesize
4KB
-
memory/796-118-0x0000000005200000-0x0000000005201000-memory.dmpFilesize
4KB
-
memory/796-119-0x0000000005050000-0x00000000050E2000-memory.dmpFilesize
584KB
-
memory/796-120-0x00000000050C0000-0x00000000050C1000-memory.dmpFilesize
4KB
-
memory/796-121-0x00000000056F0000-0x00000000056F9000-memory.dmpFilesize
36KB
-
memory/796-122-0x000000007F920000-0x000000007F921000-memory.dmpFilesize
4KB
-
memory/796-123-0x0000000001140000-0x00000000011BA000-memory.dmpFilesize
488KB
-
memory/796-124-0x00000000083B0000-0x00000000083E3000-memory.dmpFilesize
204KB
-
memory/964-134-0x0000000000000000-mapping.dmp
-
memory/1020-131-0x0000000000000000-mapping.dmp
-
memory/1020-132-0x0000000000B50000-0x0000000000B66000-memory.dmpFilesize
88KB
-
memory/1020-133-0x0000000002E00000-0x0000000002E2E000-memory.dmpFilesize
184KB
-
memory/1020-135-0x0000000004DD0000-0x00000000050F0000-memory.dmpFilesize
3.1MB
-
memory/1020-136-0x0000000004C30000-0x0000000004CC3000-memory.dmpFilesize
588KB
-
memory/1484-128-0x0000000000F20000-0x0000000001240000-memory.dmpFilesize
3.1MB
-
memory/1484-129-0x0000000000E80000-0x0000000000E94000-memory.dmpFilesize
80KB
-
memory/1484-126-0x000000000041EAF0-mapping.dmp
-
memory/1484-125-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3024-130-0x0000000002610000-0x00000000026E7000-memory.dmpFilesize
860KB
-
memory/3024-137-0x0000000004DA0000-0x0000000004E7E000-memory.dmpFilesize
888KB