Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
26-07-2021 14:02
Static task
static1
Behavioral task
behavioral1
Sample
Douane nécessaire.scr
Resource
win7v20210410
General
-
Target
Douane nécessaire.scr
-
Size
1.3MB
-
MD5
02a16ecb920577998a4964a4eb9e2ad1
-
SHA1
8b8d43fd5b6aa6c925bb8dd9beca3ec7d10aae58
-
SHA256
c327a9bad9c1f25d9da900eb60b3ef7a0387d232c30bebb4d8b4b1bb62e257fb
-
SHA512
54b59deda69c278c9056ba294aa9549a47b9324e93c1735abf09231925d43a47830d45977d0b3250941d80d903e44b809cb2761de621bbc220d86e0793ea53be
Malware Config
Extracted
formbook
4.1
http://www.celinehair.com/e7hf/
miaozhunjingzhijia.com
mindplayva.com
vbetturkey.com
panevnyk.space
philiprankinemarketing.com
rosascleaningpros.com
nadersadek.info
2of237woodlandstreet.com
thegroomingdrs.com
cloudtrending.com
viajenscomcafe.com
medkomp.online
hohlola.com
ksremy.com
watermarkwpb.com
work4villageinn.com
pollmag.com
organizingbypaty.com
awakenwithrochelle.com
walcottstreetdental.site
newbethelneylandville.com
jam-nins.com
blue-elephant-indian.com
backyardpizzaiolo.com
patisseriefromparis.com
reachfleet.com
freedatarecovery.net
bkt18.com
auxvoilages-prive.com
jcc9999.com
localeclectric.com
seanhipkindesign.com
hnurses.com
suachuaotoquan8.com
actionboarddiversity.com
apipedemontana.info
biblechalktalk.com
hlv.kiwi
sortingyourlife.com
cvbcvsdqw.com
mexicoenruta.com
mentalidadparaemprender.com
tolerc.net
catchup-net.com
southwestsoaring.com
goldcastinglimited.com
knappsnews.com
advertmanagerbot.com
r6bproject.club
entonlineupdate.com
fiop.cat
denshicustoms.com
flittigstudent.net
spotadz.com
howecute.gifts
almisexpress.com
dogwayslancashire.com
toopaydropbox.com
simplyduplexes.site
citazionprocessingcenter.com
dijuyi.com
8668602.com
deshistories.com
minnesotaswishbasketball.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral2/memory/4652-122-0x00000000053E0000-0x00000000053EB000-memory.dmp CustAttr -
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3132-125-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3132-126-0x000000000041ED90-mapping.dmp formbook behavioral2/memory/4204-133-0x0000000002900000-0x000000000292E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Douane nécessaire.scrDouane nécessaire.scrrundll32.exedescription pid process target process PID 4652 set thread context of 3132 4652 Douane nécessaire.scr Douane nécessaire.scr PID 3132 set thread context of 3048 3132 Douane nécessaire.scr Explorer.EXE PID 4204 set thread context of 3048 4204 rundll32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
Douane nécessaire.scrrundll32.exepid process 3132 Douane nécessaire.scr 3132 Douane nécessaire.scr 3132 Douane nécessaire.scr 3132 Douane nécessaire.scr 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe 4204 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3048 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Douane nécessaire.scrrundll32.exepid process 3132 Douane nécessaire.scr 3132 Douane nécessaire.scr 3132 Douane nécessaire.scr 4204 rundll32.exe 4204 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Douane nécessaire.scrrundll32.exedescription pid process Token: SeDebugPrivilege 3132 Douane nécessaire.scr Token: SeDebugPrivilege 4204 rundll32.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3048 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Douane nécessaire.scrExplorer.EXErundll32.exedescription pid process target process PID 4652 wrote to memory of 3132 4652 Douane nécessaire.scr Douane nécessaire.scr PID 4652 wrote to memory of 3132 4652 Douane nécessaire.scr Douane nécessaire.scr PID 4652 wrote to memory of 3132 4652 Douane nécessaire.scr Douane nécessaire.scr PID 4652 wrote to memory of 3132 4652 Douane nécessaire.scr Douane nécessaire.scr PID 4652 wrote to memory of 3132 4652 Douane nécessaire.scr Douane nécessaire.scr PID 4652 wrote to memory of 3132 4652 Douane nécessaire.scr Douane nécessaire.scr PID 3048 wrote to memory of 4204 3048 Explorer.EXE rundll32.exe PID 3048 wrote to memory of 4204 3048 Explorer.EXE rundll32.exe PID 3048 wrote to memory of 4204 3048 Explorer.EXE rundll32.exe PID 4204 wrote to memory of 4176 4204 rundll32.exe cmd.exe PID 4204 wrote to memory of 4176 4204 rundll32.exe cmd.exe PID 4204 wrote to memory of 4176 4204 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Douane nécessaire.scr"C:\Users\Admin\AppData\Local\Temp\Douane nécessaire.scr" /S2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Douane nécessaire.scr"C:\Users\Admin\AppData\Local\Temp\Douane nécessaire.scr"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Douane nécessaire.scr"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3048-136-0x0000000006280000-0x00000000063FC000-memory.dmpFilesize
1.5MB
-
memory/3048-129-0x0000000006150000-0x0000000006275000-memory.dmpFilesize
1.1MB
-
memory/3132-125-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3132-127-0x0000000001290000-0x00000000015B0000-memory.dmpFilesize
3.1MB
-
memory/3132-128-0x0000000001050000-0x0000000001064000-memory.dmpFilesize
80KB
-
memory/3132-126-0x000000000041ED90-mapping.dmp
-
memory/4176-131-0x0000000000000000-mapping.dmp
-
memory/4204-130-0x0000000000000000-mapping.dmp
-
memory/4204-133-0x0000000002900000-0x000000000292E000-memory.dmpFilesize
184KB
-
memory/4204-135-0x0000000004620000-0x00000000046B3000-memory.dmpFilesize
588KB
-
memory/4204-134-0x0000000004300000-0x0000000004620000-memory.dmpFilesize
3.1MB
-
memory/4204-132-0x0000000000110000-0x0000000000123000-memory.dmpFilesize
76KB
-
memory/4652-121-0x0000000005670000-0x0000000005671000-memory.dmpFilesize
4KB
-
memory/4652-119-0x00000000054A0000-0x000000000599E000-memory.dmpFilesize
5.0MB
-
memory/4652-118-0x00000000054A0000-0x00000000054A1000-memory.dmpFilesize
4KB
-
memory/4652-114-0x0000000000A30000-0x0000000000A31000-memory.dmpFilesize
4KB
-
memory/4652-117-0x00000000059A0000-0x00000000059A1000-memory.dmpFilesize
4KB
-
memory/4652-120-0x0000000005380000-0x0000000005381000-memory.dmpFilesize
4KB
-
memory/4652-123-0x0000000006B40000-0x0000000006BB9000-memory.dmpFilesize
484KB
-
memory/4652-122-0x00000000053E0000-0x00000000053EB000-memory.dmpFilesize
44KB
-
memory/4652-124-0x0000000006BD0000-0x0000000006C05000-memory.dmpFilesize
212KB
-
memory/4652-116-0x0000000005400000-0x0000000005401000-memory.dmpFilesize
4KB