Analysis
-
max time kernel
146s -
max time network
145s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
26-07-2021 14:02
Static task
static1
Behavioral task
behavioral1
Sample
Douane nécessaire.scr
Resource
win7v20210410
General
-
Target
Douane nécessaire.scr
-
Size
1.3MB
-
MD5
02a16ecb920577998a4964a4eb9e2ad1
-
SHA1
8b8d43fd5b6aa6c925bb8dd9beca3ec7d10aae58
-
SHA256
c327a9bad9c1f25d9da900eb60b3ef7a0387d232c30bebb4d8b4b1bb62e257fb
-
SHA512
54b59deda69c278c9056ba294aa9549a47b9324e93c1735abf09231925d43a47830d45977d0b3250941d80d903e44b809cb2761de621bbc220d86e0793ea53be
Malware Config
Extracted
formbook
4.1
http://www.celinehair.com/e7hf/
miaozhunjingzhijia.com
mindplayva.com
vbetturkey.com
panevnyk.space
philiprankinemarketing.com
rosascleaningpros.com
nadersadek.info
2of237woodlandstreet.com
thegroomingdrs.com
cloudtrending.com
viajenscomcafe.com
medkomp.online
hohlola.com
ksremy.com
watermarkwpb.com
work4villageinn.com
pollmag.com
organizingbypaty.com
awakenwithrochelle.com
walcottstreetdental.site
newbethelneylandville.com
jam-nins.com
blue-elephant-indian.com
backyardpizzaiolo.com
patisseriefromparis.com
reachfleet.com
freedatarecovery.net
bkt18.com
auxvoilages-prive.com
jcc9999.com
localeclectric.com
seanhipkindesign.com
hnurses.com
suachuaotoquan8.com
actionboarddiversity.com
apipedemontana.info
biblechalktalk.com
hlv.kiwi
sortingyourlife.com
cvbcvsdqw.com
mexicoenruta.com
mentalidadparaemprender.com
tolerc.net
catchup-net.com
southwestsoaring.com
goldcastinglimited.com
knappsnews.com
advertmanagerbot.com
r6bproject.club
entonlineupdate.com
fiop.cat
denshicustoms.com
flittigstudent.net
spotadz.com
howecute.gifts
almisexpress.com
dogwayslancashire.com
toopaydropbox.com
simplyduplexes.site
citazionprocessingcenter.com
dijuyi.com
8668602.com
deshistories.com
minnesotaswishbasketball.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral1/memory/2020-63-0x0000000000840000-0x000000000084B000-memory.dmp CustAttr -
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/980-66-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/980-67-0x000000000041ED90-mapping.dmp formbook behavioral1/memory/524-74-0x0000000000070000-0x000000000009E000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1540 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Douane nécessaire.scrDouane nécessaire.scrwscript.exedescription pid process target process PID 2020 set thread context of 980 2020 Douane nécessaire.scr Douane nécessaire.scr PID 980 set thread context of 1272 980 Douane nécessaire.scr Explorer.EXE PID 524 set thread context of 1272 524 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
Douane nécessaire.scrwscript.exepid process 980 Douane nécessaire.scr 980 Douane nécessaire.scr 524 wscript.exe 524 wscript.exe 524 wscript.exe 524 wscript.exe 524 wscript.exe 524 wscript.exe 524 wscript.exe 524 wscript.exe 524 wscript.exe 524 wscript.exe 524 wscript.exe 524 wscript.exe 524 wscript.exe 524 wscript.exe 524 wscript.exe 524 wscript.exe 524 wscript.exe 524 wscript.exe 524 wscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Douane nécessaire.scrwscript.exepid process 980 Douane nécessaire.scr 980 Douane nécessaire.scr 980 Douane nécessaire.scr 524 wscript.exe 524 wscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Douane nécessaire.scrwscript.exedescription pid process Token: SeDebugPrivilege 980 Douane nécessaire.scr Token: SeDebugPrivilege 524 wscript.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Douane nécessaire.scrExplorer.EXEwscript.exedescription pid process target process PID 2020 wrote to memory of 980 2020 Douane nécessaire.scr Douane nécessaire.scr PID 2020 wrote to memory of 980 2020 Douane nécessaire.scr Douane nécessaire.scr PID 2020 wrote to memory of 980 2020 Douane nécessaire.scr Douane nécessaire.scr PID 2020 wrote to memory of 980 2020 Douane nécessaire.scr Douane nécessaire.scr PID 2020 wrote to memory of 980 2020 Douane nécessaire.scr Douane nécessaire.scr PID 2020 wrote to memory of 980 2020 Douane nécessaire.scr Douane nécessaire.scr PID 2020 wrote to memory of 980 2020 Douane nécessaire.scr Douane nécessaire.scr PID 1272 wrote to memory of 524 1272 Explorer.EXE wscript.exe PID 1272 wrote to memory of 524 1272 Explorer.EXE wscript.exe PID 1272 wrote to memory of 524 1272 Explorer.EXE wscript.exe PID 1272 wrote to memory of 524 1272 Explorer.EXE wscript.exe PID 524 wrote to memory of 1540 524 wscript.exe cmd.exe PID 524 wrote to memory of 1540 524 wscript.exe cmd.exe PID 524 wrote to memory of 1540 524 wscript.exe cmd.exe PID 524 wrote to memory of 1540 524 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Douane nécessaire.scr"C:\Users\Admin\AppData\Local\Temp\Douane nécessaire.scr" /S2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Douane nécessaire.scr"C:\Users\Admin\AppData\Local\Temp\Douane nécessaire.scr"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Douane nécessaire.scr"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/524-76-0x0000000000940000-0x00000000009D3000-memory.dmpFilesize
588KB
-
memory/524-75-0x0000000002070000-0x0000000002373000-memory.dmpFilesize
3.0MB
-
memory/524-74-0x0000000000070000-0x000000000009E000-memory.dmpFilesize
184KB
-
memory/524-73-0x0000000000C40000-0x0000000000C66000-memory.dmpFilesize
152KB
-
memory/524-71-0x0000000000000000-mapping.dmp
-
memory/980-69-0x0000000000160000-0x0000000000174000-memory.dmpFilesize
80KB
-
memory/980-66-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/980-67-0x000000000041ED90-mapping.dmp
-
memory/980-68-0x0000000000A80000-0x0000000000D83000-memory.dmpFilesize
3.0MB
-
memory/1272-70-0x00000000062E0000-0x0000000006445000-memory.dmpFilesize
1.4MB
-
memory/1272-77-0x0000000006110000-0x0000000006247000-memory.dmpFilesize
1.2MB
-
memory/1540-72-0x0000000000000000-mapping.dmp
-
memory/2020-60-0x0000000001160000-0x0000000001161000-memory.dmpFilesize
4KB
-
memory/2020-65-0x0000000000D70000-0x0000000000DA5000-memory.dmpFilesize
212KB
-
memory/2020-64-0x0000000004A10000-0x0000000004A89000-memory.dmpFilesize
484KB
-
memory/2020-63-0x0000000000840000-0x000000000084B000-memory.dmpFilesize
44KB
-
memory/2020-62-0x0000000000D30000-0x0000000000D31000-memory.dmpFilesize
4KB