Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
28-07-2021 05:47
Static task
static1
Behavioral task
behavioral1
Sample
Remittance_90523_03.exe
Resource
win7v20210410
General
-
Target
Remittance_90523_03.exe
-
Size
1.2MB
-
MD5
4877999ea194338dfe6ad0b7c501afe8
-
SHA1
41c912ac202c7b590450fd91e4f2ed6faa5b2aff
-
SHA256
107f0cce39dcfa85508fd5d256fa0515b6e27f554628e2ca4400af9dc2a5dcae
-
SHA512
e28520a7d7c5bcccb7309d51c2e5c67668e7c081cf15f133ad4345e1b46a92e652d435abe718c6df851ffa57f8e0355bcccf3cb8e4361bd10012723034e7a5bf
Malware Config
Extracted
formbook
4.1
http://www.bitcoin-noticias.com/fw6/
rashtriyasanghsewak.com
filestree.cloud
penoner.com
owliwant.com
elkincook.com
jhac16kaizencollection.com
shalomdentalavenue.com
hotelsbytheweek.com
cookwithchefcari.com
threattenterprises.com
sanookna.com
tlsbuilders.com
softandhardshop.com
ppr419.com
powertexinc.info
businessandhr.com
yiliao2020.com
eiman-pro.com
rhondarothrealtor.com
junk-service.com
55668.online
clarionintroducers.com
dotchugui.com
iymood.com
iphonesglasses.com
scores193843.xyz
bux4all.com
marlboromeadows.com
intercosmicshop.com
innne.com
gkjpondokgede.com
thedomushub.com
djdygytal.com
sportgamessa.com
pauspay.com
fordbieter.com
mortgageswithmelodie.com
umdesenhoqueanime.com
itech-servicios-sv.com
fairviewsecurity.com
maqalat93.com
unstuckwebinar.com
zen-code.guru
byssm.com
dylanfashion.com
atlastanimalrescue.com
yunzhangjiang.com
calia.group
biorythmbalance.com
specna.com
outdoorpropertylist.com
hg8808dh.com
justvapesa.com
homeinspectorreviews.com
mitplindia.com
solevux.com
mentalgto.com
tenin123.com
beautyholicsbybernards.com
shadhinbazaar.com
cxi.xyz
totumdrinks.com
defikrypto.com
thegreatbournecommunity.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral2/memory/568-122-0x0000000002750000-0x000000000275B000-memory.dmp CustAttr -
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2292-126-0x000000000041EBA0-mapping.dmp formbook behavioral2/memory/2292-125-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/1308-133-0x0000000000C10000-0x0000000000C3E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Remittance_90523_03.exeRemittance_90523_03.execscript.exedescription pid process target process PID 568 set thread context of 2292 568 Remittance_90523_03.exe Remittance_90523_03.exe PID 2292 set thread context of 2708 2292 Remittance_90523_03.exe Explorer.EXE PID 1308 set thread context of 2708 1308 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 39 IoCs
Processes:
Remittance_90523_03.exeRemittance_90523_03.execscript.exepid process 568 Remittance_90523_03.exe 2292 Remittance_90523_03.exe 2292 Remittance_90523_03.exe 2292 Remittance_90523_03.exe 2292 Remittance_90523_03.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe 1308 cscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2708 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Remittance_90523_03.execscript.exepid process 2292 Remittance_90523_03.exe 2292 Remittance_90523_03.exe 2292 Remittance_90523_03.exe 1308 cscript.exe 1308 cscript.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
Remittance_90523_03.exeRemittance_90523_03.exeExplorer.EXEcscript.exedescription pid process Token: SeDebugPrivilege 568 Remittance_90523_03.exe Token: SeDebugPrivilege 2292 Remittance_90523_03.exe Token: SeShutdownPrivilege 2708 Explorer.EXE Token: SeCreatePagefilePrivilege 2708 Explorer.EXE Token: SeShutdownPrivilege 2708 Explorer.EXE Token: SeCreatePagefilePrivilege 2708 Explorer.EXE Token: SeDebugPrivilege 1308 cscript.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2708 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Remittance_90523_03.exeExplorer.EXEcscript.exedescription pid process target process PID 568 wrote to memory of 2292 568 Remittance_90523_03.exe Remittance_90523_03.exe PID 568 wrote to memory of 2292 568 Remittance_90523_03.exe Remittance_90523_03.exe PID 568 wrote to memory of 2292 568 Remittance_90523_03.exe Remittance_90523_03.exe PID 568 wrote to memory of 2292 568 Remittance_90523_03.exe Remittance_90523_03.exe PID 568 wrote to memory of 2292 568 Remittance_90523_03.exe Remittance_90523_03.exe PID 568 wrote to memory of 2292 568 Remittance_90523_03.exe Remittance_90523_03.exe PID 2708 wrote to memory of 1308 2708 Explorer.EXE cscript.exe PID 2708 wrote to memory of 1308 2708 Explorer.EXE cscript.exe PID 2708 wrote to memory of 1308 2708 Explorer.EXE cscript.exe PID 1308 wrote to memory of 1504 1308 cscript.exe cmd.exe PID 1308 wrote to memory of 1504 1308 cscript.exe cmd.exe PID 1308 wrote to memory of 1504 1308 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Remittance_90523_03.exe"C:\Users\Admin\AppData\Local\Temp\Remittance_90523_03.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Remittance_90523_03.exe"C:\Users\Admin\AppData\Local\Temp\Remittance_90523_03.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Remittance_90523_03.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/568-114-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/568-116-0x0000000004D10000-0x0000000004D11000-memory.dmpFilesize
4KB
-
memory/568-117-0x00000000052B0000-0x00000000052B1000-memory.dmpFilesize
4KB
-
memory/568-118-0x0000000004DB0000-0x0000000004DB1000-memory.dmpFilesize
4KB
-
memory/568-119-0x0000000002820000-0x0000000002821000-memory.dmpFilesize
4KB
-
memory/568-120-0x0000000004F70000-0x0000000004F71000-memory.dmpFilesize
4KB
-
memory/568-121-0x00000000028A0000-0x00000000028A1000-memory.dmpFilesize
4KB
-
memory/568-122-0x0000000002750000-0x000000000275B000-memory.dmpFilesize
44KB
-
memory/568-123-0x0000000005BF0000-0x0000000005C65000-memory.dmpFilesize
468KB
-
memory/568-124-0x0000000005C70000-0x0000000005CA0000-memory.dmpFilesize
192KB
-
memory/1308-130-0x0000000000000000-mapping.dmp
-
memory/1308-133-0x0000000000C10000-0x0000000000C3E000-memory.dmpFilesize
184KB
-
memory/1308-132-0x00000000013D0000-0x00000000013F7000-memory.dmpFilesize
156KB
-
memory/1308-134-0x0000000004D50000-0x0000000005070000-memory.dmpFilesize
3.1MB
-
memory/1308-135-0x0000000004C50000-0x0000000004CE3000-memory.dmpFilesize
588KB
-
memory/1504-131-0x0000000000000000-mapping.dmp
-
memory/2292-125-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2292-127-0x0000000001570000-0x0000000001890000-memory.dmpFilesize
3.1MB
-
memory/2292-128-0x00000000014D0000-0x00000000014E4000-memory.dmpFilesize
80KB
-
memory/2292-126-0x000000000041EBA0-mapping.dmp
-
memory/2708-129-0x00000000028C0000-0x0000000002983000-memory.dmpFilesize
780KB
-
memory/2708-136-0x0000000002710000-0x00000000027B2000-memory.dmpFilesize
648KB