Analysis
-
max time kernel
80s -
max time network
49s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
06-07-2021 09:16
Static task
static1
Behavioral task
behavioral1
Sample
318c866ef078ec6d9597aaebed8bc370.exe
Resource
win7v20210410
General
-
Target
318c866ef078ec6d9597aaebed8bc370.exe
-
Size
799KB
-
MD5
318c866ef078ec6d9597aaebed8bc370
-
SHA1
4d0008cb7d64f6fb5378672bc4a2edba43546e1f
-
SHA256
54469ace58ddcfdd6d834574d87003857b0cda05e27a0b8e31cb0b58e6ca105d
-
SHA512
cd32fd72eda19e8a2210a3b646b21cbee5b722672773a49c0e4dc02fdaad9c9fb99a60326eb1a9589e4b02b3e30eb85e2c5a3b5cfd767155f72fa123f9e68985
Malware Config
Extracted
formbook
4.1
http://www.survivai.com/bsdd/
533dh.com
galerisikayet.xyz
tipsyalligator.com
crystalwellnessstudio.com
moovaap.com
lelfie.network
speedy-trips.com
prospectsolucoes.com
24x7customersservice.com
szbinsen.com
shikhardeals.com
totaldenta.com
ayksjx.com
avxrja.online
24kyule888.com
ufaw.net
spinozone.com
castvoicesmsreg.com
lajollawoodworks.com
renetyson.com
stephanieodennewsletter.com
tuben8.com
thescriptshack.com
macooperativeinc.com
franklinmachado.com
breezeescape.com
conv2app.com
kreditkarten-profi.com
czscjx.com
pvj2019.com
boosagroup.com
inesperienced.com
leschenaultpottery.com
sitvsfit.net
dwsykj.com
touchsquad.com
healthythomas.com
lphomeinspections.com
officialbondandunion.com
snowgreerfamilymemories.com
superheroesindisguise.com
topimportant.com
drillinginsider.com
esflog.net
baliyogacruise.net
sdys999.com
rugpat.com
solarpollo.com
kindrehearts.com
marijuana-medicine.com
thefinal7.com
guardiadeorixa.com
kayeducates.com
francorp.business
wegatherwegrow.com
quientequitalobailado.net
ghostridercreative.com
rachaeveal.com
sourcesysstems.com
xiuli100.com
xmjer.com
support-center-login.network
conversoronlline.com
misinformationnationmovie.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/576-66-0x000000000041EB30-mapping.dmp formbook behavioral1/memory/576-65-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
318c866ef078ec6d9597aaebed8bc370.exedescription pid process target process PID 1644 set thread context of 576 1644 318c866ef078ec6d9597aaebed8bc370.exe 318c866ef078ec6d9597aaebed8bc370.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
318c866ef078ec6d9597aaebed8bc370.exepid process 576 318c866ef078ec6d9597aaebed8bc370.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
318c866ef078ec6d9597aaebed8bc370.exedescription pid process target process PID 1644 wrote to memory of 576 1644 318c866ef078ec6d9597aaebed8bc370.exe 318c866ef078ec6d9597aaebed8bc370.exe PID 1644 wrote to memory of 576 1644 318c866ef078ec6d9597aaebed8bc370.exe 318c866ef078ec6d9597aaebed8bc370.exe PID 1644 wrote to memory of 576 1644 318c866ef078ec6d9597aaebed8bc370.exe 318c866ef078ec6d9597aaebed8bc370.exe PID 1644 wrote to memory of 576 1644 318c866ef078ec6d9597aaebed8bc370.exe 318c866ef078ec6d9597aaebed8bc370.exe PID 1644 wrote to memory of 576 1644 318c866ef078ec6d9597aaebed8bc370.exe 318c866ef078ec6d9597aaebed8bc370.exe PID 1644 wrote to memory of 576 1644 318c866ef078ec6d9597aaebed8bc370.exe 318c866ef078ec6d9597aaebed8bc370.exe PID 1644 wrote to memory of 576 1644 318c866ef078ec6d9597aaebed8bc370.exe 318c866ef078ec6d9597aaebed8bc370.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\318c866ef078ec6d9597aaebed8bc370.exe"C:\Users\Admin\AppData\Local\Temp\318c866ef078ec6d9597aaebed8bc370.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\318c866ef078ec6d9597aaebed8bc370.exe"C:\Users\Admin\AppData\Local\Temp\318c866ef078ec6d9597aaebed8bc370.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/576-66-0x000000000041EB30-mapping.dmp
-
memory/576-65-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/576-68-0x0000000000D00000-0x0000000001003000-memory.dmpFilesize
3.0MB
-
memory/1644-59-0x0000000000C30000-0x0000000000C31000-memory.dmpFilesize
4KB
-
memory/1644-61-0x0000000004E10000-0x0000000004E11000-memory.dmpFilesize
4KB
-
memory/1644-62-0x0000000000370000-0x000000000037F000-memory.dmpFilesize
60KB
-
memory/1644-63-0x0000000004D30000-0x0000000004DAE000-memory.dmpFilesize
504KB
-
memory/1644-64-0x0000000000770000-0x00000000007B4000-memory.dmpFilesize
272KB