Analysis
-
max time kernel
82s -
max time network
121s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-07-2021 07:54
Static task
static1
Behavioral task
behavioral1
Sample
KNNBHBL43590303005084SOB07Dec20TXL15Feb21/KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe
Resource
win7v20210410
General
-
Target
KNNBHBL43590303005084SOB07Dec20TXL15Feb21/KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe
-
Size
542KB
-
MD5
71b8954c01a98f7f9efcd86388cab318
-
SHA1
fac366fa3660e1db0dfa2473fc805444bbfbb1f5
-
SHA256
af4150ab77918813e1f16480bac0fae2c80f0d77e7c205da5dc7220c08095890
-
SHA512
e0a346cd1f643dfe4af6d004aea39c68cdcbfe692cb205352c8be00f1f95324386f43e420b36057eda9ee1f97e9d2cec0dfd2c20afde106e1260ad45adca551e
Malware Config
Extracted
formbook
4.1
http://www.sportsbooksil.com/css/
small-business-credit.com
waypsy.com
azerni.com
netzafe.com
crceg-eldjazair.com
minitruckwiki.com
lensdemy.com
cognitivecorridors.com
foxredart.com
m-groove.com
delevateagency.com
franklyspeakingtheword.com
iplleatheraccessories.com
print-and-ink.com
callpine.com
grydomarmy.com
washfoldndelivery.com
tarapharm.com
adairepalmer.com
jilbabsanaya.com
djmarieco.com
saitamacity-sports.com
ktobandboston.com
bandowtiam.com
rubycons.com
windowscreenshop.com
thedigitalhideout.net
maidalab.xyz
mariahelizabethmerch.com
theten.agency
6degreesofdelicious.com
sueclothingandaccessories.com
hyattregencywesthanoi.com
burgerorder.com
wowo-199.com
abudhabi-israel.com
nicaraguamatrimony.com
epicsocialite.com
tastethe.cloud
desimallhd.com
dwfhadbk.icu
carsandrigs.com
bigtreecloud.net
autotrafficbot.com
theranchmtk.art
niceperiodic.com
copypress-support.com
jamesjgaffney.com
otoviki.net
ajsuneasow.com
kohlercustom.com
bazaardomain.com
defectinjury.com
jsaplicativos.com
camin-vip.com
kalpanavincent.com
vianvifurnitures.com
abacada.net
findyourjobusa.com
2centsworthapp.com
jiazuyun.net
brightandfreshfaces.com
bnvirtual.com
elementaryteachingonline.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3600-124-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3600-125-0x000000000041EB40-mapping.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exedescription pid process target process PID 776 set thread context of 3600 776 KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exepid process 3600 KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe 3600 KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exedescription pid process target process PID 776 wrote to memory of 3600 776 KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe PID 776 wrote to memory of 3600 776 KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe PID 776 wrote to memory of 3600 776 KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe PID 776 wrote to memory of 3600 776 KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe PID 776 wrote to memory of 3600 776 KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe PID 776 wrote to memory of 3600 776 KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\KNNBHBL43590303005084SOB07Dec20TXL15Feb21\KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe"C:\Users\Admin\AppData\Local\Temp\KNNBHBL43590303005084SOB07Dec20TXL15Feb21\KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\KNNBHBL43590303005084SOB07Dec20TXL15Feb21\KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe"C:\Users\Admin\AppData\Local\Temp\KNNBHBL43590303005084SOB07Dec20TXL15Feb21\KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/776-114-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/776-116-0x0000000004A60000-0x0000000004A61000-memory.dmpFilesize
4KB
-
memory/776-117-0x0000000005000000-0x0000000005001000-memory.dmpFilesize
4KB
-
memory/776-118-0x0000000004BA0000-0x0000000004BA1000-memory.dmpFilesize
4KB
-
memory/776-119-0x0000000004B00000-0x0000000004FFE000-memory.dmpFilesize
5.0MB
-
memory/776-120-0x00000000025F0000-0x00000000025F1000-memory.dmpFilesize
4KB
-
memory/776-121-0x0000000004D30000-0x0000000004D31000-memory.dmpFilesize
4KB
-
memory/776-122-0x0000000004D00000-0x0000000004D04000-memory.dmpFilesize
16KB
-
memory/776-123-0x00000000007D0000-0x000000000082B000-memory.dmpFilesize
364KB
-
memory/3600-124-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3600-125-0x000000000041EB40-mapping.dmp
-
memory/3600-126-0x00000000017D0000-0x0000000001AF0000-memory.dmpFilesize
3.1MB