Analysis
-
max time kernel
123s -
max time network
125s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
21-07-2021 18:05
Static task
static1
Behavioral task
behavioral1
Sample
6a0200a4316e595561f8527e3bcf27bc.exe
Resource
win7v20210410
General
-
Target
6a0200a4316e595561f8527e3bcf27bc.exe
-
Size
925KB
-
MD5
6a0200a4316e595561f8527e3bcf27bc
-
SHA1
4c356c914ccdf83b8c89b6a02a2c4a9391094763
-
SHA256
f8f02165547227a6692d503cf1203dcaf2d43b58219bb78cb0e42895f49a8121
-
SHA512
af3decd9eaf59e31462fce7cdf36335814151c6c512aa0248d0877c7addbfeccdb530f01a11de1fc47b6d8f5bd1dc506175d9c0d4fd67376cd06da5e89b90470
Malware Config
Extracted
formbook
4.1
http://www.hometowncashbuyersgroup.com/kkt/
inspirafutebol.com
customgiftshouston.com
mycreativelending.com
psplaystore.com
newlivingsolutionshop.com
dechefamsterdam.com
servicingl0ans.com
atsdholdings.com
manifestarz.com
sequenceanalytica.com
gethealthcaresmart.com
theartofsurprises.com
pirateequitypatrick.com
alliance-ce.com
wingrushusa.com
funtimespheres.com
solevux.com
antimasathya.com
profitexcavator.com
lankeboxshop.com
aarthiramamurthy.com
oldmopaiv.xyz
mavispaguzellik.com
milkamax.com
sputnikvasisi.com
gametoyou.com
sisconbol.com
thedreamcertificate.com
vichy-menuiserie.com
pv-step.com
growingmindstrilingual.com
tlcrentny.com
jedshomebuilders.com
curtailit.com
integruschamber.com
lanzamientosbimbocolombia.com
tightlinesfishingco.com
doubleuphome.com
arctic.solar
unstopabbledomains.com
aggiornamento-isp.info
clarkandhurnlaw.com
barefootbirthstl.com
seanfeuct.com
measureformeasurehome.com
stephsavy.com
loveflowersandevents.com
czsis.com
midnightblueinc.com
today.dental
customwithme.com
edisetiyo.com
jasoneganrealtor.com
rihxertiza.com
seahorseblast.net
nedayerasa.com
cliftonheightshoa.net
theprofilemba.com
cfwoods.com
dogggo.com
casatranquillainletbeach.com
u1023.com
aromakapseln.com
zhwanjie.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/648-66-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/648-67-0x000000000041EBD0-mapping.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6a0200a4316e595561f8527e3bcf27bc.exedescription pid process target process PID 1056 set thread context of 648 1056 6a0200a4316e595561f8527e3bcf27bc.exe 6a0200a4316e595561f8527e3bcf27bc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
6a0200a4316e595561f8527e3bcf27bc.exepid process 648 6a0200a4316e595561f8527e3bcf27bc.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
6a0200a4316e595561f8527e3bcf27bc.exedescription pid process target process PID 1056 wrote to memory of 648 1056 6a0200a4316e595561f8527e3bcf27bc.exe 6a0200a4316e595561f8527e3bcf27bc.exe PID 1056 wrote to memory of 648 1056 6a0200a4316e595561f8527e3bcf27bc.exe 6a0200a4316e595561f8527e3bcf27bc.exe PID 1056 wrote to memory of 648 1056 6a0200a4316e595561f8527e3bcf27bc.exe 6a0200a4316e595561f8527e3bcf27bc.exe PID 1056 wrote to memory of 648 1056 6a0200a4316e595561f8527e3bcf27bc.exe 6a0200a4316e595561f8527e3bcf27bc.exe PID 1056 wrote to memory of 648 1056 6a0200a4316e595561f8527e3bcf27bc.exe 6a0200a4316e595561f8527e3bcf27bc.exe PID 1056 wrote to memory of 648 1056 6a0200a4316e595561f8527e3bcf27bc.exe 6a0200a4316e595561f8527e3bcf27bc.exe PID 1056 wrote to memory of 648 1056 6a0200a4316e595561f8527e3bcf27bc.exe 6a0200a4316e595561f8527e3bcf27bc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a0200a4316e595561f8527e3bcf27bc.exe"C:\Users\Admin\AppData\Local\Temp\6a0200a4316e595561f8527e3bcf27bc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\6a0200a4316e595561f8527e3bcf27bc.exe"C:\Users\Admin\AppData\Local\Temp\6a0200a4316e595561f8527e3bcf27bc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:648
-