Analysis
-
max time kernel
75s -
max time network
136s -
platform
windows10_x64 -
resource
win10-en -
submitted
14-09-2021 20:30
Static task
static1
Behavioral task
behavioral1
Sample
f0f4b5aa6183bbc5265f26e47aaeb579.exe
Resource
win7-en
General
-
Target
f0f4b5aa6183bbc5265f26e47aaeb579.exe
-
Size
500KB
-
MD5
f0f4b5aa6183bbc5265f26e47aaeb579
-
SHA1
81f06990ec9c83d755d5023f95af114d92e68d45
-
SHA256
f8d239a08e27c28f5a5dea56ab895274476ae7360d5d456d89b58d33a392d49c
-
SHA512
3bc8bb2ac4dc15c484aac016b5c09ff55c45f7db2127a10ba5621711d66dc6287ad109906a1707dcbf0f6c8ba0078b8f6b4603e4a6365726ef419aabe7cf02e6
Malware Config
Extracted
formbook
4.1
m8g0
http://www.corbvalperu.com/m8g0/
exclusivecan.com
junzhesuji.com
acces-credit-mutuel.com
iknitvintage.com
solonmodelun.com
debekia.com
peanutskitchen.com
kamanantzin.com
personalmodeststyle.com
qo49.com
googman.site
maisonshahnaz.com
annaalexandrovich.com
californiacashcars.com
ncafashionboutique.com
nsu0.com
cloudfirstlender.com
allforchildren.net
vn80000.com
restroon.com
rpm555.com
yasminaaa.com
e-shopee.com
flasnlute.online
fact-about.com
laurielobdell.com
bokzer.com
digitalmarketex.com
gemmakamps.com
cbdely.com
originem.cat
sherifalleghenycounty.com
mymenageire.com
jtzaatbya.icu
akuluarabavar.com
thepartygod.com
rpf.xyz
adejareadebimpefoundation.com
meingutschein.gratis
bahisbeta131.com
xn--proteindnyam-klb.com
marketauto.uk
xn--mgbai9a7dqf7be.com
milk-espresso-bar.com
lincolnsquareseniorliving.com
tranvachthachcao2020.com
sreezna.com
sudaniamericancollective.com
iresistable.com
healthyhabitsdiary.com
tianenconsulting.com
glassicsrentals.com
maviba.net
wheelersmill.info
schnellptc.com
touch2give.com
dadandan-blog.com
sheltaco.com
ramonnunezm.com
franchisesquareliquidations.com
hotelesmotril.com
tuxedojunctionbook.com
thedognanniesct.com
mettelonhart.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4024-126-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/4024-127-0x000000000041EB70-mapping.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f0f4b5aa6183bbc5265f26e47aaeb579.exedescription pid process target process PID 4008 set thread context of 4024 4008 f0f4b5aa6183bbc5265f26e47aaeb579.exe f0f4b5aa6183bbc5265f26e47aaeb579.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f0f4b5aa6183bbc5265f26e47aaeb579.exepid process 4024 f0f4b5aa6183bbc5265f26e47aaeb579.exe 4024 f0f4b5aa6183bbc5265f26e47aaeb579.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
f0f4b5aa6183bbc5265f26e47aaeb579.exedescription pid process target process PID 4008 wrote to memory of 4024 4008 f0f4b5aa6183bbc5265f26e47aaeb579.exe f0f4b5aa6183bbc5265f26e47aaeb579.exe PID 4008 wrote to memory of 4024 4008 f0f4b5aa6183bbc5265f26e47aaeb579.exe f0f4b5aa6183bbc5265f26e47aaeb579.exe PID 4008 wrote to memory of 4024 4008 f0f4b5aa6183bbc5265f26e47aaeb579.exe f0f4b5aa6183bbc5265f26e47aaeb579.exe PID 4008 wrote to memory of 4024 4008 f0f4b5aa6183bbc5265f26e47aaeb579.exe f0f4b5aa6183bbc5265f26e47aaeb579.exe PID 4008 wrote to memory of 4024 4008 f0f4b5aa6183bbc5265f26e47aaeb579.exe f0f4b5aa6183bbc5265f26e47aaeb579.exe PID 4008 wrote to memory of 4024 4008 f0f4b5aa6183bbc5265f26e47aaeb579.exe f0f4b5aa6183bbc5265f26e47aaeb579.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0f4b5aa6183bbc5265f26e47aaeb579.exe"C:\Users\Admin\AppData\Local\Temp\f0f4b5aa6183bbc5265f26e47aaeb579.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f0f4b5aa6183bbc5265f26e47aaeb579.exe"C:\Users\Admin\AppData\Local\Temp\f0f4b5aa6183bbc5265f26e47aaeb579.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4008-115-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/4008-117-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/4008-118-0x0000000004B90000-0x0000000004B91000-memory.dmpFilesize
4KB
-
memory/4008-119-0x0000000005590000-0x0000000005591000-memory.dmpFilesize
4KB
-
memory/4008-120-0x0000000004D70000-0x0000000004D71000-memory.dmpFilesize
4KB
-
memory/4008-121-0x0000000004B90000-0x000000000508E000-memory.dmpFilesize
5.0MB
-
memory/4008-122-0x0000000008520000-0x0000000008521000-memory.dmpFilesize
4KB
-
memory/4008-123-0x0000000005070000-0x0000000005077000-memory.dmpFilesize
28KB
-
memory/4008-124-0x0000000008A50000-0x0000000008AB9000-memory.dmpFilesize
420KB
-
memory/4008-125-0x000000000B250000-0x000000000B283000-memory.dmpFilesize
204KB
-
memory/4024-126-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/4024-127-0x000000000041EB70-mapping.dmp
-
memory/4024-128-0x00000000011E0000-0x0000000001500000-memory.dmpFilesize
3.1MB