Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
21-04-2021 08:39
Static task
static1
Behavioral task
behavioral1
Sample
Passport_ID_jpg.exe
Resource
win7v20210408
General
-
Target
Passport_ID_jpg.exe
-
Size
657KB
-
MD5
6b095bd38143e9308e9ffca16b2a5bff
-
SHA1
0fdd73e4020f6c1e5a3482659bae46bd5d47d8e2
-
SHA256
2fcd9b75bc8b3443e1196faca6b458d8caeaa213b19dd5e5ee78ae559962aa9c
-
SHA512
6be73b32e7b6244d1b90a7a81acb0a3df84166b0ac863355f5c9f8c2608bbb9e9bd620993a0e019d6a14dafd923d7036d563289bba18d15b40ec4535aaa721dc
Malware Config
Extracted
formbook
4.1
http://www.simplymollie.com/sre/
pasionmusical.com
csgoplays.com
donnabsringsblingandthings.com
renovation-mansion.com
stoneswithsouls.com
ibworm.net
solidwin88bet.com
vtnywvebg.club
buyyourhd.com
reviewit4you.com
tobethelion.com
venicegifts.com
tyronredman.com
peloponnesesunbed.com
atranscom.com
flexi-rentals.com
neilint.com
brmsempire.com
maisquebolsas.com
hack-cloud.icu
milestone-dental.com
loolebazkonkaraj.com
floryi.com
brokod.com
5151gt.com
webblad.info
usluke.com
londonshard.com
russkoe.love
vigilanciabogota.com
yikouxiu.com
dleonisa.com
davidjosephbooks.com
rustyrobinsonfuturend.com
llttfsuffolk.com
project-dashboard.online
wikiliberty.com
fourthwalldiagnostics.com
qsgongkong.com
zhenshigoods.com
soukt.com
annahopkinsonart.com
dynamicprocleaning.com
nickwestspanglish.com
photovideobg.com
thesprktmbrand.com
guangdongmansion.com
huevnvideo.com
psychologist-help.com
jstool-korea.com
balbidumco.com
deviantort.com
andrewcurtis.net
bdsm-kontakt.net
refineproskin.com
devo-denz.com
unitedcreed.net
fengwujiu.ltd
7muz7epekpmw92.net
gbdodgeball.com
gumysle.info
blackdoorsociety.com
picmomentscancun.info
wisdomoftheowl.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1492-124-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/1492-125-0x000000000041EBA0-mapping.dmp formbook behavioral2/memory/3364-133-0x00000000007B0000-0x00000000007DE000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Passport_ID_jpg.exePassport_ID_jpg.exesvchost.exedescription pid process target process PID 784 set thread context of 1492 784 Passport_ID_jpg.exe Passport_ID_jpg.exe PID 1492 set thread context of 3052 1492 Passport_ID_jpg.exe Explorer.EXE PID 3364 set thread context of 3052 3364 svchost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
Passport_ID_jpg.exePassport_ID_jpg.exesvchost.exepid process 784 Passport_ID_jpg.exe 784 Passport_ID_jpg.exe 784 Passport_ID_jpg.exe 1492 Passport_ID_jpg.exe 1492 Passport_ID_jpg.exe 1492 Passport_ID_jpg.exe 1492 Passport_ID_jpg.exe 3364 svchost.exe 3364 svchost.exe 3364 svchost.exe 3364 svchost.exe 3364 svchost.exe 3364 svchost.exe 3364 svchost.exe 3364 svchost.exe 3364 svchost.exe 3364 svchost.exe 3364 svchost.exe 3364 svchost.exe 3364 svchost.exe 3364 svchost.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Passport_ID_jpg.exesvchost.exepid process 1492 Passport_ID_jpg.exe 1492 Passport_ID_jpg.exe 1492 Passport_ID_jpg.exe 3364 svchost.exe 3364 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Passport_ID_jpg.exePassport_ID_jpg.exesvchost.exedescription pid process Token: SeDebugPrivilege 784 Passport_ID_jpg.exe Token: SeDebugPrivilege 1492 Passport_ID_jpg.exe Token: SeDebugPrivilege 3364 svchost.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Passport_ID_jpg.exeExplorer.EXEsvchost.exedescription pid process target process PID 784 wrote to memory of 1492 784 Passport_ID_jpg.exe Passport_ID_jpg.exe PID 784 wrote to memory of 1492 784 Passport_ID_jpg.exe Passport_ID_jpg.exe PID 784 wrote to memory of 1492 784 Passport_ID_jpg.exe Passport_ID_jpg.exe PID 784 wrote to memory of 1492 784 Passport_ID_jpg.exe Passport_ID_jpg.exe PID 784 wrote to memory of 1492 784 Passport_ID_jpg.exe Passport_ID_jpg.exe PID 784 wrote to memory of 1492 784 Passport_ID_jpg.exe Passport_ID_jpg.exe PID 3052 wrote to memory of 3364 3052 Explorer.EXE svchost.exe PID 3052 wrote to memory of 3364 3052 Explorer.EXE svchost.exe PID 3052 wrote to memory of 3364 3052 Explorer.EXE svchost.exe PID 3364 wrote to memory of 3044 3364 svchost.exe cmd.exe PID 3364 wrote to memory of 3044 3364 svchost.exe cmd.exe PID 3364 wrote to memory of 3044 3364 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Passport_ID_jpg.exe"C:\Users\Admin\AppData\Local\Temp\Passport_ID_jpg.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Passport_ID_jpg.exe"C:\Users\Admin\AppData\Local\Temp\Passport_ID_jpg.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Passport_ID_jpg.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/784-114-0x0000000000460000-0x0000000000461000-memory.dmpFilesize
4KB
-
memory/784-116-0x00000000052A0000-0x00000000052A1000-memory.dmpFilesize
4KB
-
memory/784-117-0x0000000004DA0000-0x0000000004DA1000-memory.dmpFilesize
4KB
-
memory/784-118-0x0000000004E40000-0x0000000004E41000-memory.dmpFilesize
4KB
-
memory/784-119-0x0000000004DA0000-0x000000000529E000-memory.dmpFilesize
5.0MB
-
memory/784-120-0x0000000004D30000-0x0000000004D31000-memory.dmpFilesize
4KB
-
memory/784-121-0x0000000005230000-0x0000000005239000-memory.dmpFilesize
36KB
-
memory/784-122-0x0000000006A20000-0x0000000006AA1000-memory.dmpFilesize
516KB
-
memory/784-123-0x0000000000DD0000-0x0000000000E10000-memory.dmpFilesize
256KB
-
memory/1492-125-0x000000000041EBA0-mapping.dmp
-
memory/1492-124-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1492-128-0x0000000001570000-0x0000000001584000-memory.dmpFilesize
80KB
-
memory/1492-127-0x0000000001A10000-0x0000000001D30000-memory.dmpFilesize
3.1MB
-
memory/3044-131-0x0000000000000000-mapping.dmp
-
memory/3052-129-0x0000000003120000-0x0000000003208000-memory.dmpFilesize
928KB
-
memory/3052-136-0x0000000005740000-0x000000000589D000-memory.dmpFilesize
1.4MB
-
memory/3364-130-0x0000000000000000-mapping.dmp
-
memory/3364-133-0x00000000007B0000-0x00000000007DE000-memory.dmpFilesize
184KB
-
memory/3364-132-0x0000000000C40000-0x0000000000C4C000-memory.dmpFilesize
48KB
-
memory/3364-134-0x0000000003390000-0x00000000036B0000-memory.dmpFilesize
3.1MB
-
memory/3364-135-0x0000000003200000-0x0000000003293000-memory.dmpFilesize
588KB