Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
07-05-2021 04:45
Static task
static1
Behavioral task
behavioral1
Sample
akon.exe
Resource
win7v20210408
General
-
Target
akon.exe
-
Size
756KB
-
MD5
0690de55a2a4081dd2ebc1f658bba4da
-
SHA1
e4952f3e5cb0c877c682678dbee181a8c737df28
-
SHA256
8bb3e6cace7598576464639d7f88d0c4d55919b2e110a341df89a1569ae0d5b7
-
SHA512
94576e743a774e30fbe40053d06c3d4ad8c4c2e421297bcae108a780713da45bf24487a541fbb1b706d0855a69d6883b68f2ec06be9bd2032e72a77d96ecf5c9
Malware Config
Extracted
formbook
4.1
http://www.merifalls.com/4kx/
eufood.info
theprotestmatters.com
khauchakhajina.com
008usa-xxf.com
backriverroadsportsplex.com
shopalndrinks.com
necght.xyz
summaryborrow.info
mys518.com
shopapemodeapparel.com
christineroseartiste.com
rsw2226.com
ashes-of-creation.com
shamilalyadin.com
learning-synergy.com
sendstats.net
waverdemo.tech
dubestol.com
bolterbunny.com
beerciderrebattes.com
threecommaacademy.com
paramethica.com
datoule.com
premiumsigorta.com
rwtmn.com
afwzonz.icu
hugsnkissesstore.com
ibf-ldc.com
ivanorduna.com
muthermedusa.com
commotional.com
cedarhilldreams.com
safehavenislandhomes.com
bedandbreakfastinmexico.com
hackerxchange.net
thedandygator.com
qixing1.com
fandombee.com
c-realz.com
bioworks.today
htmlcsscolorcodes.com
charmscitycases.com
harvestsdata.com
estiloxstore.com
greenwichconstructions.com
yogadochmal.com
spireenergy.support
birdsofafeathersf.com
fusui123.com
jms788.com
khalitex.com
fygj.online
weddingplannerssanantonio.com
ourgariwerdstories.com
theprettyclicks.com
lashice.com
yingchunjiaoguan.com
fx-kinyu.site
sterlingoaksassistedliving.com
thrivedesk.net
tyltrol.com
baolehome.com
uhousenet.com
arneeverts.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1324-65-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1324-66-0x000000000041EAD0-mapping.dmp formbook behavioral1/memory/360-74-0x00000000000C0000-0x00000000000EE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 868 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
akon.exeakon.exehelp.exedescription pid process target process PID 756 set thread context of 1324 756 akon.exe akon.exe PID 1324 set thread context of 1208 1324 akon.exe Explorer.EXE PID 360 set thread context of 1208 360 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
akon.exehelp.exepid process 1324 akon.exe 1324 akon.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
akon.exehelp.exepid process 1324 akon.exe 1324 akon.exe 1324 akon.exe 360 help.exe 360 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
akon.exehelp.exedescription pid process Token: SeDebugPrivilege 1324 akon.exe Token: SeDebugPrivilege 360 help.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
akon.exeExplorer.EXEhelp.exedescription pid process target process PID 756 wrote to memory of 1324 756 akon.exe akon.exe PID 756 wrote to memory of 1324 756 akon.exe akon.exe PID 756 wrote to memory of 1324 756 akon.exe akon.exe PID 756 wrote to memory of 1324 756 akon.exe akon.exe PID 756 wrote to memory of 1324 756 akon.exe akon.exe PID 756 wrote to memory of 1324 756 akon.exe akon.exe PID 756 wrote to memory of 1324 756 akon.exe akon.exe PID 1208 wrote to memory of 360 1208 Explorer.EXE help.exe PID 1208 wrote to memory of 360 1208 Explorer.EXE help.exe PID 1208 wrote to memory of 360 1208 Explorer.EXE help.exe PID 1208 wrote to memory of 360 1208 Explorer.EXE help.exe PID 360 wrote to memory of 868 360 help.exe cmd.exe PID 360 wrote to memory of 868 360 help.exe cmd.exe PID 360 wrote to memory of 868 360 help.exe cmd.exe PID 360 wrote to memory of 868 360 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\akon.exe"C:\Users\Admin\AppData\Local\Temp\akon.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\akon.exe"C:\Users\Admin\AppData\Local\Temp\akon.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\akon.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/360-71-0x0000000000000000-mapping.dmp
-
memory/360-76-0x0000000000690000-0x0000000000723000-memory.dmpFilesize
588KB
-
memory/360-75-0x0000000000920000-0x0000000000C23000-memory.dmpFilesize
3.0MB
-
memory/360-74-0x00000000000C0000-0x00000000000EE000-memory.dmpFilesize
184KB
-
memory/360-73-0x0000000000490000-0x0000000000496000-memory.dmpFilesize
24KB
-
memory/756-64-0x0000000000AD0000-0x0000000000B40000-memory.dmpFilesize
448KB
-
memory/756-59-0x0000000000EB0000-0x0000000000EB1000-memory.dmpFilesize
4KB
-
memory/756-63-0x0000000005100000-0x00000000051B5000-memory.dmpFilesize
724KB
-
memory/756-62-0x0000000000660000-0x000000000066E000-memory.dmpFilesize
56KB
-
memory/756-61-0x0000000004D50000-0x0000000004D51000-memory.dmpFilesize
4KB
-
memory/868-72-0x0000000000000000-mapping.dmp
-
memory/1208-70-0x0000000004CA0000-0x0000000004E2A000-memory.dmpFilesize
1.5MB
-
memory/1208-77-0x0000000004B80000-0x0000000004C2A000-memory.dmpFilesize
680KB
-
memory/1324-66-0x000000000041EAD0-mapping.dmp
-
memory/1324-68-0x0000000000A20000-0x0000000000D23000-memory.dmpFilesize
3.0MB
-
memory/1324-69-0x0000000000180000-0x0000000000194000-memory.dmpFilesize
80KB
-
memory/1324-65-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB