Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
09-05-2021 09:18
Static task
static1
Behavioral task
behavioral1
Sample
Confirm!!!.exe
Resource
win7v20210408
General
-
Target
Confirm!!!.exe
-
Size
1.1MB
-
MD5
7afd3b350ea6451b47be2058c07365de
-
SHA1
8186d625b6f406d71a27aa8ef51f52902c5c26f0
-
SHA256
540021aa05d8985bf6eca783d86cdada2727b5ed0b1a943cb9cdfb224a4e50f1
-
SHA512
02a7ec42b3d9c9f6e6b1538406b08fccd1a661c05d62b89a211443bad25acf520d78711906009f1215647971e6d7e8a65fddbe06efcc32c438e0b7e8b53d34d1
Malware Config
Extracted
formbook
4.1
http://www.deuxus.com/t052/
ladybug-learning.com
unforgottenstory.com
oldmopaiv.xyz
natashaexim.com
hannahmcelgunn.com
retargetingmachines.info
njoconline.com
unicornlankadelivery.com
giftkerala.com
englishfordoctors.online
schatzilandrvresort.com
brujoisaac.com
basiccampinggear.com
escapees.today
dgyxsy888.com
stevebana.xyz
mimozakebap.com
ezdoff.com
pluumyspalace.com
shaoshanshan.com
crazyvine.wine
sfjt55.com
xjgqh.com
netverificatie-home.info
efnew.com
welderweb.com
2ndstars.com
parrotpink.com
sarahjanehammock.com
pizzawestpalmbeach.com
pivot-branding.com
bribiebootcamp.com
floridaincontinencetherapy.com
muddanyc.com
pflegedienst-24-7.com
kunstradar.com
coolgadgetsdominate.com
comedynationlive.com
workoutandlawn.com
orangecountyvolvolease.com
sunrisemath.com
premiumenterprisegroup.com
mnglobalplatform.com
bijie.xyz
christiandailyusa.com
kismetestatestjohn.com
bobyworks.com
h2cooker.com
kimquint.com
torturechamberproductions.com
superbbsuper.com
bibleandkoran.net
oncuecollective.com
strat-fundamentals.info
taichi.chat
beautyroomgreenwich.com
686761.com
prostatamrt.net
medicina-genomica.com
hl022.com
forestlawnfunerals.com
charismayachts.com
sublimequalitystore.com
bowvacare.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2596-125-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2596-126-0x000000000041ECC0-mapping.dmp formbook behavioral2/memory/1504-134-0x00000000006A0000-0x00000000006CE000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Confirm!!!.exeConfirm!!!.exechkdsk.exedescription pid process target process PID 640 set thread context of 2596 640 Confirm!!!.exe Confirm!!!.exe PID 2596 set thread context of 2428 2596 Confirm!!!.exe Explorer.EXE PID 1504 set thread context of 2428 1504 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
Confirm!!!.exechkdsk.exepid process 2596 Confirm!!!.exe 2596 Confirm!!!.exe 2596 Confirm!!!.exe 2596 Confirm!!!.exe 1504 chkdsk.exe 1504 chkdsk.exe 1504 chkdsk.exe 1504 chkdsk.exe 1504 chkdsk.exe 1504 chkdsk.exe 1504 chkdsk.exe 1504 chkdsk.exe 1504 chkdsk.exe 1504 chkdsk.exe 1504 chkdsk.exe 1504 chkdsk.exe 1504 chkdsk.exe 1504 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Confirm!!!.exechkdsk.exepid process 2596 Confirm!!!.exe 2596 Confirm!!!.exe 2596 Confirm!!!.exe 1504 chkdsk.exe 1504 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Confirm!!!.exeConfirm!!!.exechkdsk.exedescription pid process Token: SeDebugPrivilege 640 Confirm!!!.exe Token: SeDebugPrivilege 2596 Confirm!!!.exe Token: SeDebugPrivilege 1504 chkdsk.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Confirm!!!.exeExplorer.EXEchkdsk.exedescription pid process target process PID 640 wrote to memory of 2596 640 Confirm!!!.exe Confirm!!!.exe PID 640 wrote to memory of 2596 640 Confirm!!!.exe Confirm!!!.exe PID 640 wrote to memory of 2596 640 Confirm!!!.exe Confirm!!!.exe PID 640 wrote to memory of 2596 640 Confirm!!!.exe Confirm!!!.exe PID 640 wrote to memory of 2596 640 Confirm!!!.exe Confirm!!!.exe PID 640 wrote to memory of 2596 640 Confirm!!!.exe Confirm!!!.exe PID 2428 wrote to memory of 1504 2428 Explorer.EXE chkdsk.exe PID 2428 wrote to memory of 1504 2428 Explorer.EXE chkdsk.exe PID 2428 wrote to memory of 1504 2428 Explorer.EXE chkdsk.exe PID 1504 wrote to memory of 3244 1504 chkdsk.exe cmd.exe PID 1504 wrote to memory of 3244 1504 chkdsk.exe cmd.exe PID 1504 wrote to memory of 3244 1504 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Confirm!!!.exe"C:\Users\Admin\AppData\Local\Temp\Confirm!!!.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Confirm!!!.exe"C:\Users\Admin\AppData\Local\Temp\Confirm!!!.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Confirm!!!.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/640-114-0x0000000000380000-0x0000000000381000-memory.dmpFilesize
4KB
-
memory/640-116-0x0000000004D00000-0x0000000004D01000-memory.dmpFilesize
4KB
-
memory/640-117-0x00000000052A0000-0x00000000052A1000-memory.dmpFilesize
4KB
-
memory/640-118-0x0000000004DA0000-0x0000000004DA1000-memory.dmpFilesize
4KB
-
memory/640-119-0x0000000004DA0000-0x000000000529E000-memory.dmpFilesize
5.0MB
-
memory/640-120-0x0000000004CD0000-0x0000000004CD1000-memory.dmpFilesize
4KB
-
memory/640-121-0x0000000004FB0000-0x0000000004FB1000-memory.dmpFilesize
4KB
-
memory/640-122-0x0000000007210000-0x000000000721E000-memory.dmpFilesize
56KB
-
memory/640-123-0x0000000000CF0000-0x0000000000D6D000-memory.dmpFilesize
500KB
-
memory/640-124-0x0000000009700000-0x0000000009738000-memory.dmpFilesize
224KB
-
memory/1504-131-0x0000000000000000-mapping.dmp
-
memory/1504-134-0x00000000006A0000-0x00000000006CE000-memory.dmpFilesize
184KB
-
memory/1504-133-0x00000000008D0000-0x00000000008DA000-memory.dmpFilesize
40KB
-
memory/1504-135-0x0000000004D60000-0x0000000005080000-memory.dmpFilesize
3.1MB
-
memory/1504-136-0x0000000004AC0000-0x0000000004B53000-memory.dmpFilesize
588KB
-
memory/2428-130-0x00000000064E0000-0x00000000065E3000-memory.dmpFilesize
1.0MB
-
memory/2428-137-0x00000000049F0000-0x0000000004B30000-memory.dmpFilesize
1.2MB
-
memory/2596-126-0x000000000041ECC0-mapping.dmp
-
memory/2596-128-0x0000000001240000-0x0000000001560000-memory.dmpFilesize
3.1MB
-
memory/2596-129-0x0000000001140000-0x0000000001154000-memory.dmpFilesize
80KB
-
memory/2596-125-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3244-132-0x0000000000000000-mapping.dmp