Analysis
-
max time kernel
120s -
max time network
172s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-07-2021 05:49
Static task
static1
Behavioral task
behavioral1
Sample
bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe
Resource
win7v20210410
General
-
Target
bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe
-
Size
511KB
-
MD5
bacc243ec00ce90570cde50f458e1d1d
-
SHA1
bf6c61f77a8e79890f88c1fdb84e640f60a83b13
-
SHA256
bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9
-
SHA512
607043ae17e0432f78bebe32b4e3ab88631795a8981c738c1fa61a721e3ef45f4da1a446482fb9ee39956cf39fc3cfe32b51c7853e7caffd63064290518d0155
Malware Config
Extracted
formbook
4.1
http://www.orchardviewbostons.com/g65/
axsnaplp.icu
hmizat-khouribga.com
dishantnarang.com
ratchakarn.net
seatoskyphotos.com
emodel88.com
rajroyalepromoters.com
lzsfdnrm.com
premierpropertiesms.com
embodimentawareness.com
xn--q3ca0aaec3a1i6ah5eyf5a.com
yc8807.com
communitycouponbook.com
commercialbeach.com
elnurtic.com
edancesportradio.net
forcedir.com
zgzhzm.com
top-specials99.com
redwoodvisitor.com
katecorc.com
jonnymaster.com
parleyssipandsteam.com
austinhemorrhoidclinic.com
xn--tonodiseo-s6a.com
drtarver.com
ethomasphoto.com
dce-energy.com
321cz.com
rvalternators.com
usbiomedic.com
907camille.com
truuorg.com
localinternetads-us.com
gentilelibri.com
healthcareinformer.com
ot21lx7qc4xf3r.xyz
toplessbeercan.com
nationwidescholarship.com
creativehomebuilderalpy.com
3577385.com
blackcatstudio.cool
educeful.email
positivityfitness.com
vnd999.club
ilovenzfood.com
betrayissue.com
myacc.cloud
408haritoncourt.com
official-tudungrohani.com
thelandsmithandco.com
magentos6.com
tappdapp.com
missionasc.com
teenpattiy.com
myspanex.com
gls-lisbon.com
cloud9nutrition.com
10thbridgeconsulting.com
tauralf.com
louisofeedandseedbatavia.com
gmail39boy.xyz
5993799.com
edisonmiddleschool.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/524-66-0x000000000041EE10-mapping.dmp formbook behavioral1/memory/524-65-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exedescription pid process target process PID 1032 set thread context of 524 1032 bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exepid process 524 bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exedescription pid process target process PID 1032 wrote to memory of 524 1032 bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe PID 1032 wrote to memory of 524 1032 bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe PID 1032 wrote to memory of 524 1032 bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe PID 1032 wrote to memory of 524 1032 bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe PID 1032 wrote to memory of 524 1032 bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe PID 1032 wrote to memory of 524 1032 bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe PID 1032 wrote to memory of 524 1032 bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe"C:\Users\Admin\AppData\Local\Temp\bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe"C:\Users\Admin\AppData\Local\Temp\bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/524-66-0x000000000041EE10-mapping.dmp
-
memory/524-65-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/524-67-0x0000000000C00000-0x0000000000F03000-memory.dmpFilesize
3.0MB
-
memory/1032-60-0x0000000000B70000-0x0000000000B71000-memory.dmpFilesize
4KB
-
memory/1032-62-0x0000000004080000-0x0000000004081000-memory.dmpFilesize
4KB
-
memory/1032-63-0x00000000009E0000-0x00000000009E4000-memory.dmpFilesize
16KB
-
memory/1032-64-0x0000000005350000-0x00000000053AB000-memory.dmpFilesize
364KB