Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
22-07-2021 12:01
Static task
static1
Behavioral task
behavioral1
Sample
0e715db2198ff670f4bf0e88e0e9b547.exe
Resource
win7v20210408
General
-
Target
0e715db2198ff670f4bf0e88e0e9b547.exe
-
Size
633KB
-
MD5
0e715db2198ff670f4bf0e88e0e9b547
-
SHA1
2de5030a9261655e5879e4faba7b5e79d1dd483e
-
SHA256
4dc8cb12314311a3bf1b1afa5cc5483284fda573f18c15ab0fef18b7b9ef9f98
-
SHA512
8fb7ea121d51c489bac9d8d6b35e94fc8bc5e5e218da53ad952326f6c558fa7484e54842b2c6abba36c5ec5bb0e6eb51fdab46b3f98daee3569ef8c6ec400bcd
Malware Config
Extracted
formbook
4.1
http://www.containerflippers.com/np0c/
spartansurebets.com
threelakestradingco.com
metaspace.global
zjenbao.com
directlyincluded.press
peterchadri.com
learnhousebreaking.com
wonobattle.online
leadate.com
shebafarmscali.com
top4thejob.online
awakeyourfaith.com
bedford-st.com
lolwhats.com
cucurumbel.com
lokalbazaar.com
matter.pro
eastcountyanimalrescue.com
musesgirl.com
noordinarydairy.com
saigonstar2.com
farmacias-aranda.com
fjzzck.com
createandelevate.solutions
australiavapeoil.com
imperfectlymassabella.com
criminalmindeddesign.com
silverstoneca.com
scotlandpropertygroup.com
3dvbuild.com
privatebeautysuites.com
driplockerstore.com
rcdesigncompany.com
2141cascaderdsw.com
mybbblog.com
bodyambrosia.com
solitudeblog.com
coworkingofficespaces.com
9999cpa.com
flipwo.com
dynamicfitnesslife.store
anandsharmah.com
afyz-jf7y.net
erikagrandstaff.com
pumpfoil.com
bodurm.com
goldlifetime.com
a1organ.com
akomandr.com
hsavvysupply.com
dyvyn.com
bizlikeabosslady.network
livein.space
helpafounderout.com
orbmena.com
mrrodgersrealty.com
roxhomeswellington.com
klimareporter.com
1040fourthst405.com
blackbuiltbusinesses.com
solidswim.com
lordetkinlik3.com
gardencontainerbar.com
viperporn.net
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/996-69-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/996-70-0x000000000041EB90-mapping.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0e715db2198ff670f4bf0e88e0e9b547.exedescription pid process target process PID 1948 set thread context of 996 1948 0e715db2198ff670f4bf0e88e0e9b547.exe 0e715db2198ff670f4bf0e88e0e9b547.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
0e715db2198ff670f4bf0e88e0e9b547.exe0e715db2198ff670f4bf0e88e0e9b547.exepid process 1948 0e715db2198ff670f4bf0e88e0e9b547.exe 1948 0e715db2198ff670f4bf0e88e0e9b547.exe 996 0e715db2198ff670f4bf0e88e0e9b547.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
0e715db2198ff670f4bf0e88e0e9b547.exedescription pid process Token: SeDebugPrivilege 1948 0e715db2198ff670f4bf0e88e0e9b547.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
0e715db2198ff670f4bf0e88e0e9b547.exedescription pid process target process PID 1948 wrote to memory of 996 1948 0e715db2198ff670f4bf0e88e0e9b547.exe 0e715db2198ff670f4bf0e88e0e9b547.exe PID 1948 wrote to memory of 996 1948 0e715db2198ff670f4bf0e88e0e9b547.exe 0e715db2198ff670f4bf0e88e0e9b547.exe PID 1948 wrote to memory of 996 1948 0e715db2198ff670f4bf0e88e0e9b547.exe 0e715db2198ff670f4bf0e88e0e9b547.exe PID 1948 wrote to memory of 996 1948 0e715db2198ff670f4bf0e88e0e9b547.exe 0e715db2198ff670f4bf0e88e0e9b547.exe PID 1948 wrote to memory of 996 1948 0e715db2198ff670f4bf0e88e0e9b547.exe 0e715db2198ff670f4bf0e88e0e9b547.exe PID 1948 wrote to memory of 996 1948 0e715db2198ff670f4bf0e88e0e9b547.exe 0e715db2198ff670f4bf0e88e0e9b547.exe PID 1948 wrote to memory of 996 1948 0e715db2198ff670f4bf0e88e0e9b547.exe 0e715db2198ff670f4bf0e88e0e9b547.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e715db2198ff670f4bf0e88e0e9b547.exe"C:\Users\Admin\AppData\Local\Temp\0e715db2198ff670f4bf0e88e0e9b547.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\0e715db2198ff670f4bf0e88e0e9b547.exeC:\Users\Admin\AppData\Local\Temp\0e715db2198ff670f4bf0e88e0e9b547.exe vgyjnbhui2⤵
- Suspicious behavior: EnumeratesProcesses
PID:996
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/996-69-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/996-70-0x000000000041EB90-mapping.dmp
-
memory/996-71-0x0000000000800000-0x0000000000B03000-memory.dmpFilesize
3.0MB
-
memory/1948-60-0x0000000000C90000-0x0000000000C91000-memory.dmpFilesize
4KB
-
memory/1948-62-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/1948-63-0x0000000000B70000-0x0000000000BD1000-memory.dmpFilesize
388KB
-
memory/1948-68-0x0000000005090000-0x0000000005102000-memory.dmpFilesize
456KB