Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
03-05-2021 02:01
Static task
static1
Behavioral task
behavioral1
Sample
MSUtbPjUGib2dvd.exe
Resource
win7v20210408
General
-
Target
MSUtbPjUGib2dvd.exe
-
Size
733KB
-
MD5
2f7f29fe69e0b9bcd41c069689fd9cb5
-
SHA1
eacd339fda8902c242a9831dac733ac4ef77d1ee
-
SHA256
82a09751c8b51a1dc0aca4780015f833a2ef01ff6d3d5f2d98dcd588381bec82
-
SHA512
3becde1b46a4f640899bd4286fb0ba892e4cfe24a3c4c2c1b6975628ad71f75abaceedde64f1e0d870f2224236287875bd8f394cfe362cb2bca7b7a9ee712f1f
Malware Config
Extracted
formbook
4.1
http://www.zmuoxb.com/ffy/
kundk-gebaeudemanagement.com
theeconomicalmillennial.com
bigbuttdating.net
dauthomdubai.com
thesilverslipper.club
onwardmotionpictures.com
tl2009.com
nelivo.com
valuablebet.com
kupiokno-online.com
magnoot.xyz
blandiskodk.com
thevibes.net
tp-simogame.com
cigarettes-on-line.com
radiancebyreilly.com
1mame.net
fimimarket.com
cayupi.com
transperucorp.com
mepocamusic.com
chaletpetille.com
apagyms.com
lindawattssilvapt.com
coffeeupgraded.com
linkedina-z.com
fangxiaotan.com
bigalswildadventures.com
bankoftheberkshires.com
summiterhub.com
7955t.com
bolnewshelpline.com
mariachisaborajalisco.com
theinterlaced.com
458stovall.com
xzgeermu.com
ibfscmy.icu
pubgfret.com
cricketsofa.com
ryancavellong.com
panafricanholdings.com
ecometrical.com
ukrainian-and-latin-cuisine.com
synklion.com
novitadelgiorno.com
evfurniture.com
river-side.net
cornershoppie.com
oneisawholenumber.com
randombakes.com
metropolitan-inmobilia.com
flifefusion.com
extravagantmagazine.com
janedoeone.com
lolitamicgiyim.com
trendingmaroc.com
hansebauunternehmen.com
trishimpex.com
vibronguitars.com
touchofblack.net
madeinlimestonecounty.com
shetalksrecipes.com
flpdelperu.com
gpjlqwnd.icu
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2804-125-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2804-126-0x000000000041EB80-mapping.dmp formbook behavioral2/memory/2260-133-0x0000000003240000-0x000000000326E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
MSUtbPjUGib2dvd.exeMSUtbPjUGib2dvd.exemstsc.exedescription pid process target process PID 512 set thread context of 2804 512 MSUtbPjUGib2dvd.exe MSUtbPjUGib2dvd.exe PID 2804 set thread context of 388 2804 MSUtbPjUGib2dvd.exe Explorer.EXE PID 2260 set thread context of 388 2260 mstsc.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
MSUtbPjUGib2dvd.exemstsc.exepid process 2804 MSUtbPjUGib2dvd.exe 2804 MSUtbPjUGib2dvd.exe 2804 MSUtbPjUGib2dvd.exe 2804 MSUtbPjUGib2dvd.exe 2260 mstsc.exe 2260 mstsc.exe 2260 mstsc.exe 2260 mstsc.exe 2260 mstsc.exe 2260 mstsc.exe 2260 mstsc.exe 2260 mstsc.exe 2260 mstsc.exe 2260 mstsc.exe 2260 mstsc.exe 2260 mstsc.exe 2260 mstsc.exe 2260 mstsc.exe 2260 mstsc.exe 2260 mstsc.exe 2260 mstsc.exe 2260 mstsc.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
MSUtbPjUGib2dvd.exemstsc.exepid process 2804 MSUtbPjUGib2dvd.exe 2804 MSUtbPjUGib2dvd.exe 2804 MSUtbPjUGib2dvd.exe 2260 mstsc.exe 2260 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
MSUtbPjUGib2dvd.exemstsc.exedescription pid process Token: SeDebugPrivilege 2804 MSUtbPjUGib2dvd.exe Token: SeDebugPrivilege 2260 mstsc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
MSUtbPjUGib2dvd.exeExplorer.EXEmstsc.exedescription pid process target process PID 512 wrote to memory of 2804 512 MSUtbPjUGib2dvd.exe MSUtbPjUGib2dvd.exe PID 512 wrote to memory of 2804 512 MSUtbPjUGib2dvd.exe MSUtbPjUGib2dvd.exe PID 512 wrote to memory of 2804 512 MSUtbPjUGib2dvd.exe MSUtbPjUGib2dvd.exe PID 512 wrote to memory of 2804 512 MSUtbPjUGib2dvd.exe MSUtbPjUGib2dvd.exe PID 512 wrote to memory of 2804 512 MSUtbPjUGib2dvd.exe MSUtbPjUGib2dvd.exe PID 512 wrote to memory of 2804 512 MSUtbPjUGib2dvd.exe MSUtbPjUGib2dvd.exe PID 388 wrote to memory of 2260 388 Explorer.EXE mstsc.exe PID 388 wrote to memory of 2260 388 Explorer.EXE mstsc.exe PID 388 wrote to memory of 2260 388 Explorer.EXE mstsc.exe PID 2260 wrote to memory of 592 2260 mstsc.exe cmd.exe PID 2260 wrote to memory of 592 2260 mstsc.exe cmd.exe PID 2260 wrote to memory of 592 2260 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MSUtbPjUGib2dvd.exe"C:\Users\Admin\AppData\Local\Temp\MSUtbPjUGib2dvd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MSUtbPjUGib2dvd.exe"C:\Users\Admin\AppData\Local\Temp\MSUtbPjUGib2dvd.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\MSUtbPjUGib2dvd.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/388-130-0x0000000006490000-0x0000000006613000-memory.dmpFilesize
1.5MB
-
memory/388-137-0x00000000058B0000-0x0000000005989000-memory.dmpFilesize
868KB
-
memory/512-121-0x00000000054C0000-0x00000000054CD000-memory.dmpFilesize
52KB
-
memory/512-118-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/512-119-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/512-120-0x0000000005230000-0x0000000005231000-memory.dmpFilesize
4KB
-
memory/512-117-0x00000000054D0000-0x00000000054D1000-memory.dmpFilesize
4KB
-
memory/512-122-0x0000000004FD0000-0x00000000054CE000-memory.dmpFilesize
5.0MB
-
memory/512-123-0x0000000000F90000-0x0000000001009000-memory.dmpFilesize
484KB
-
memory/512-124-0x0000000008250000-0x0000000008286000-memory.dmpFilesize
216KB
-
memory/512-116-0x0000000004F30000-0x0000000004F31000-memory.dmpFilesize
4KB
-
memory/512-114-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/592-134-0x0000000000000000-mapping.dmp
-
memory/2260-131-0x0000000000000000-mapping.dmp
-
memory/2260-133-0x0000000003240000-0x000000000326E000-memory.dmpFilesize
184KB
-
memory/2260-132-0x0000000000C40000-0x0000000000F3C000-memory.dmpFilesize
3.0MB
-
memory/2260-135-0x0000000005160000-0x0000000005480000-memory.dmpFilesize
3.1MB
-
memory/2260-136-0x00000000050C0000-0x0000000005153000-memory.dmpFilesize
588KB
-
memory/2804-128-0x0000000001450000-0x0000000001770000-memory.dmpFilesize
3.1MB
-
memory/2804-129-0x0000000001920000-0x0000000001934000-memory.dmpFilesize
80KB
-
memory/2804-126-0x000000000041EB80-mapping.dmp
-
memory/2804-125-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB