Analysis
-
max time kernel
152s -
max time network
24s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
21-04-2021 08:39
Static task
static1
Behavioral task
behavioral1
Sample
Passport_ID_jpg.exe
Resource
win7v20210408
General
-
Target
Passport_ID_jpg.exe
-
Size
657KB
-
MD5
6b095bd38143e9308e9ffca16b2a5bff
-
SHA1
0fdd73e4020f6c1e5a3482659bae46bd5d47d8e2
-
SHA256
2fcd9b75bc8b3443e1196faca6b458d8caeaa213b19dd5e5ee78ae559962aa9c
-
SHA512
6be73b32e7b6244d1b90a7a81acb0a3df84166b0ac863355f5c9f8c2608bbb9e9bd620993a0e019d6a14dafd923d7036d563289bba18d15b40ec4535aaa721dc
Malware Config
Extracted
formbook
4.1
http://www.simplymollie.com/sre/
pasionmusical.com
csgoplays.com
donnabsringsblingandthings.com
renovation-mansion.com
stoneswithsouls.com
ibworm.net
solidwin88bet.com
vtnywvebg.club
buyyourhd.com
reviewit4you.com
tobethelion.com
venicegifts.com
tyronredman.com
peloponnesesunbed.com
atranscom.com
flexi-rentals.com
neilint.com
brmsempire.com
maisquebolsas.com
hack-cloud.icu
milestone-dental.com
loolebazkonkaraj.com
floryi.com
brokod.com
5151gt.com
webblad.info
usluke.com
londonshard.com
russkoe.love
vigilanciabogota.com
yikouxiu.com
dleonisa.com
davidjosephbooks.com
rustyrobinsonfuturend.com
llttfsuffolk.com
project-dashboard.online
wikiliberty.com
fourthwalldiagnostics.com
qsgongkong.com
zhenshigoods.com
soukt.com
annahopkinsonart.com
dynamicprocleaning.com
nickwestspanglish.com
photovideobg.com
thesprktmbrand.com
guangdongmansion.com
huevnvideo.com
psychologist-help.com
jstool-korea.com
balbidumco.com
deviantort.com
andrewcurtis.net
bdsm-kontakt.net
refineproskin.com
devo-denz.com
unitedcreed.net
fengwujiu.ltd
7muz7epekpmw92.net
gbdodgeball.com
gumysle.info
blackdoorsociety.com
picmomentscancun.info
wisdomoftheowl.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/840-66-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/840-67-0x000000000041EBA0-mapping.dmp formbook behavioral1/memory/348-74-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1152 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Passport_ID_jpg.exePassport_ID_jpg.exeNETSTAT.EXEdescription pid process target process PID 1848 set thread context of 840 1848 Passport_ID_jpg.exe Passport_ID_jpg.exe PID 840 set thread context of 1200 840 Passport_ID_jpg.exe Explorer.EXE PID 348 set thread context of 1200 348 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 348 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
Passport_ID_jpg.exePassport_ID_jpg.exeNETSTAT.EXEpid process 1848 Passport_ID_jpg.exe 1848 Passport_ID_jpg.exe 840 Passport_ID_jpg.exe 840 Passport_ID_jpg.exe 348 NETSTAT.EXE 348 NETSTAT.EXE 348 NETSTAT.EXE 348 NETSTAT.EXE 348 NETSTAT.EXE 348 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Passport_ID_jpg.exeNETSTAT.EXEpid process 840 Passport_ID_jpg.exe 840 Passport_ID_jpg.exe 840 Passport_ID_jpg.exe 348 NETSTAT.EXE 348 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Passport_ID_jpg.exePassport_ID_jpg.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 1848 Passport_ID_jpg.exe Token: SeDebugPrivilege 840 Passport_ID_jpg.exe Token: SeDebugPrivilege 348 NETSTAT.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Passport_ID_jpg.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 1848 wrote to memory of 840 1848 Passport_ID_jpg.exe Passport_ID_jpg.exe PID 1848 wrote to memory of 840 1848 Passport_ID_jpg.exe Passport_ID_jpg.exe PID 1848 wrote to memory of 840 1848 Passport_ID_jpg.exe Passport_ID_jpg.exe PID 1848 wrote to memory of 840 1848 Passport_ID_jpg.exe Passport_ID_jpg.exe PID 1848 wrote to memory of 840 1848 Passport_ID_jpg.exe Passport_ID_jpg.exe PID 1848 wrote to memory of 840 1848 Passport_ID_jpg.exe Passport_ID_jpg.exe PID 1848 wrote to memory of 840 1848 Passport_ID_jpg.exe Passport_ID_jpg.exe PID 1200 wrote to memory of 348 1200 Explorer.EXE NETSTAT.EXE PID 1200 wrote to memory of 348 1200 Explorer.EXE NETSTAT.EXE PID 1200 wrote to memory of 348 1200 Explorer.EXE NETSTAT.EXE PID 1200 wrote to memory of 348 1200 Explorer.EXE NETSTAT.EXE PID 348 wrote to memory of 1152 348 NETSTAT.EXE cmd.exe PID 348 wrote to memory of 1152 348 NETSTAT.EXE cmd.exe PID 348 wrote to memory of 1152 348 NETSTAT.EXE cmd.exe PID 348 wrote to memory of 1152 348 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Passport_ID_jpg.exe"C:\Users\Admin\AppData\Local\Temp\Passport_ID_jpg.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Passport_ID_jpg.exe"C:\Users\Admin\AppData\Local\Temp\Passport_ID_jpg.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Passport_ID_jpg.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/348-72-0x0000000000000000-mapping.dmp
-
memory/348-77-0x0000000002010000-0x00000000020A3000-memory.dmpFilesize
588KB
-
memory/348-75-0x00000000021A0000-0x00000000024A3000-memory.dmpFilesize
3.0MB
-
memory/348-74-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/348-73-0x00000000004C0000-0x00000000004C9000-memory.dmpFilesize
36KB
-
memory/840-70-0x0000000000280000-0x0000000000294000-memory.dmpFilesize
80KB
-
memory/840-67-0x000000000041EBA0-mapping.dmp
-
memory/840-69-0x0000000000910000-0x0000000000C13000-memory.dmpFilesize
3.0MB
-
memory/840-66-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1152-76-0x0000000000000000-mapping.dmp
-
memory/1200-71-0x0000000004A30000-0x0000000004AF5000-memory.dmpFilesize
788KB
-
memory/1200-78-0x0000000006130000-0x0000000006275000-memory.dmpFilesize
1.3MB
-
memory/1848-60-0x0000000000C80000-0x0000000000C81000-memory.dmpFilesize
4KB
-
memory/1848-65-0x0000000000560000-0x00000000005A0000-memory.dmpFilesize
256KB
-
memory/1848-64-0x0000000005070000-0x00000000050F1000-memory.dmpFilesize
516KB
-
memory/1848-63-0x00000000004A0000-0x00000000004A9000-memory.dmpFilesize
36KB
-
memory/1848-62-0x00000000047B0000-0x00000000047B1000-memory.dmpFilesize
4KB