Analysis
-
max time kernel
44s -
max time network
44s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-07-2021 16:09
Static task
static1
Behavioral task
behavioral1
Sample
77e9f5464c103f8fedf6ae500d87dd32.exe
Resource
win7v20210408
General
-
Target
77e9f5464c103f8fedf6ae500d87dd32.exe
-
Size
654KB
-
MD5
77e9f5464c103f8fedf6ae500d87dd32
-
SHA1
63ac44a904971f265decc404583bd3912c31cf02
-
SHA256
7b40c9c16df4b35ae04076a8afd38c4fe4bf5525bb388ea3871ec2371fa9e049
-
SHA512
4488ffcb12abd71d0e25ba10655085d5c876ea047a85cb8d02f1280442b998b85e3b8adadcd3a5e835b062fd27953fb05dc9a4c96e7f4cbe7869812a65fa2f6e
Malware Config
Extracted
formbook
4.1
http://www.yjhlgg.com/grve/
jrvinganimalexterminator.com
smallsyalls.com
po1c3.com
mencg.com
aussieenjoyment.today
espace22.com
aanmelding-desk.info
gallopshoes.com
nftsexy.com
ricosdulcesmexicanos.com
riseswift.com
thechicthirty.com
matdcg.com
alternet.today
creativehuesdesigns.com
rjkcrafts.com
lowdosemortgage.com
adoptahamster.com
wellness-sense.com
jacardcapital.com
pastiindonesia.com
lindsaynathan2021.com
brisbanemagicians.com
tvglanz.com
388384.com
mitgrim.com
endonelatrading.com
political.singles
ganjegirls.com
democratscancelled.com
ytzhubao.com
roiskylands.com
zamlgroup.com
winstonsalemathleticclub.com
62qtz2.com
caddyys.com
ecorarte.com
coonier.com
cbgmanhattan-hub.com
givanon.com
tioniis11.com
variceselite.com
tasaciona.com
hiphopeconomicdevelopment.com
citrixfile.com
piebuilder.com
drmetalpublishing.com
themesthatyoulike.com
vinhomes-phamhung.info
ardecentro.com
gameshowsatwork.com
go-rillathebrand.com
virtualppo.com
nogodbeforeme.net
fabrezeairpurifiers.com
roorisor.com
elaraberentcar.com
rugpat.com
renewalbyheather.com
innocox.com
ztsj10086.com
channelarmor.info
thecarbonbox.store
edicionesvita.com
Signatures
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral1/memory/1948-63-0x0000000000240000-0x000000000024B000-memory.dmp CustAttr -
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1500-67-0x000000000041EAF0-mapping.dmp formbook behavioral1/memory/1500-66-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
77e9f5464c103f8fedf6ae500d87dd32.exedescription pid process target process PID 1948 set thread context of 1500 1948 77e9f5464c103f8fedf6ae500d87dd32.exe 77e9f5464c103f8fedf6ae500d87dd32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
77e9f5464c103f8fedf6ae500d87dd32.exepid process 1500 77e9f5464c103f8fedf6ae500d87dd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
77e9f5464c103f8fedf6ae500d87dd32.exedescription pid process target process PID 1948 wrote to memory of 1500 1948 77e9f5464c103f8fedf6ae500d87dd32.exe 77e9f5464c103f8fedf6ae500d87dd32.exe PID 1948 wrote to memory of 1500 1948 77e9f5464c103f8fedf6ae500d87dd32.exe 77e9f5464c103f8fedf6ae500d87dd32.exe PID 1948 wrote to memory of 1500 1948 77e9f5464c103f8fedf6ae500d87dd32.exe 77e9f5464c103f8fedf6ae500d87dd32.exe PID 1948 wrote to memory of 1500 1948 77e9f5464c103f8fedf6ae500d87dd32.exe 77e9f5464c103f8fedf6ae500d87dd32.exe PID 1948 wrote to memory of 1500 1948 77e9f5464c103f8fedf6ae500d87dd32.exe 77e9f5464c103f8fedf6ae500d87dd32.exe PID 1948 wrote to memory of 1500 1948 77e9f5464c103f8fedf6ae500d87dd32.exe 77e9f5464c103f8fedf6ae500d87dd32.exe PID 1948 wrote to memory of 1500 1948 77e9f5464c103f8fedf6ae500d87dd32.exe 77e9f5464c103f8fedf6ae500d87dd32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\77e9f5464c103f8fedf6ae500d87dd32.exe"C:\Users\Admin\AppData\Local\Temp\77e9f5464c103f8fedf6ae500d87dd32.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\77e9f5464c103f8fedf6ae500d87dd32.exe"C:\Users\Admin\AppData\Local\Temp\77e9f5464c103f8fedf6ae500d87dd32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1500-67-0x000000000041EAF0-mapping.dmp
-
memory/1500-66-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1500-68-0x0000000000990000-0x0000000000C93000-memory.dmpFilesize
3.0MB
-
memory/1948-60-0x00000000008E0000-0x00000000008E1000-memory.dmpFilesize
4KB
-
memory/1948-62-0x0000000004E60000-0x0000000004E61000-memory.dmpFilesize
4KB
-
memory/1948-63-0x0000000000240000-0x000000000024B000-memory.dmpFilesize
44KB
-
memory/1948-64-0x0000000005960000-0x00000000059DB000-memory.dmpFilesize
492KB
-
memory/1948-65-0x0000000000630000-0x0000000000666000-memory.dmpFilesize
216KB