Analysis
- max time kernel
148s - max time network
148s - platform
windows10_x64 - resource
win10-en - submitted
15/09/2021, 15:50
Static task
static1
Behavioral task
behavioral1
Sample
Noua comanda de achizitie.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
- Target Noua comanda de achizitie.exe
- Size 783KB
- Sample210915-s9xtqsahf9
- SHA256 6a4a8564e5f578a122a6d5341dd34a4f7f7d196acfc28b3f61b90151a9e545dc
- MD5 c85d06951f7a48ed9e2fa5b4a233f22d
- SHA1 9e747d1ed952b34283fdff32e5444d1c3f83f952
- SHA512 20e8151c14cd9b3cb96854de23e08fb2b460665b34ac0364bcab56048d126cafab1cb446b66696dfecb7dd64aba4bf0b5aa1251e8927e5948265334bd6577558
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
bc3s
C2
-
http://www.topei-products.com/bc3s/
Decoy
-
anna-ng.com
-
mariangelamata.com
-
szqnbl.com
-
nesherguitars.com
-
mysekrit.com
-
againbeautyviensui.xyz
-
appf.life
-
bilalsolution.com
-
technoratii.com
-
11restoran.com
-
birthingly.com
-
crystalcarrillo.com
-
cohenasset.info
-
bunchofdesign.com
-
highstreetmag.com
-
talentkerning.com
-
outdoor-glassesadvice.com
-
aliceeety.com
-
habbuhot.info
-
pao91.com
-
resgatarpontosparavoce.com
-
tuancai.net
-
cnynckcrw.com
-
visaza.com
-
paulettecallen.com
-
kandmfinancialgroup.com
-
malibuclassix.com
-
thespoonteller.com
-
vidyaxyp.com
-
xn--gmsepetim-q9ab20j.com
-
saudesexualdoshomens.com
-
safehandmarketing.com
-
yebimhieu.site
-
alimitchellmedia.com
-
andrewpatrickpiette.com
-
astro-paradise.com
-
domainechoquet.com
-
navihealthpartners.com
-
detroitveganseafood.com
-
spankingandpunishment.com
-
magalu-queromais.com
-
mallsinup.com
-
rmsnidlogini.cloud
-
lifeisveryessential.com
-
stolzfus.com
-
iniciala.com
-
designslayers.com
-
clinivahq.com
-
ubersms.com
-
welenb.com
-
skyegroupllc.com
-
happyburger.net
-
moredate-s.com
-
alon-mail.com
-
voceprofessor.com
-
dokadveri.com
-
lafabricadisseny.com
-
westwooddesign.net
-
blossoms-boutique.com
-
jumtix.xyz
-
dietgulfport.com
-
soccerstreamer.com
-
lapurtcedd.com
-
secret-mall.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/1752-119-0x0000000000000000-mapping.dmp formbook behavioral2/memory/1752-121-0x0000000010410000-0x000000001043E000-memory.dmp formbook behavioral2/memory/2636-129-0x0000000000B90000-0x0000000000BBE000-memory.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1752 set thread context of 3048 1752 mshta.exe 44 PID 1752 set thread context of 3048 1752 mshta.exe 44 PID 2636 set thread context of 3048 2636 control.exe 44 - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Explorer.EXE - Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 1752 mshta.exe 1752 mshta.exe 1752 mshta.exe 1752 mshta.exe 1752 mshta.exe 1752 mshta.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe 2636 control.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3048 Explorer.EXE - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1752 mshta.exe 1752 mshta.exe 1752 mshta.exe 1752 mshta.exe 2636 control.exe 2636 control.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1752 mshta.exe Token: SeDebugPrivilege 2636 control.exe - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3048 Explorer.EXE 3048 Explorer.EXE 3048 Explorer.EXE 3048 Explorer.EXE 3048 Explorer.EXE 3048 Explorer.EXE 3048 Explorer.EXE 3048 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2248 wrote to memory of 1752 2248 Noua comanda de achizitie.exe 69 PID 2248 wrote to memory of 1752 2248 Noua comanda de achizitie.exe 69 PID 2248 wrote to memory of 1752 2248 Noua comanda de achizitie.exe 69 PID 2248 wrote to memory of 1752 2248 Noua comanda de achizitie.exe 69 PID 2248 wrote to memory of 1752 2248 Noua comanda de achizitie.exe 69 PID 2248 wrote to memory of 1752 2248 Noua comanda de achizitie.exe 69 PID 3048 wrote to memory of 2636 3048 Explorer.EXE 70 PID 3048 wrote to memory of 2636 3048 Explorer.EXE 70 PID 3048 wrote to memory of 2636 3048 Explorer.EXE 70 PID 2636 wrote to memory of 3804 2636 control.exe 71 PID 2636 wrote to memory of 3804 2636 control.exe 71 PID 2636 wrote to memory of 3804 2636 control.exe 71
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\Noua comanda de achizitie.exe"C:\Users\Admin\AppData\Local\Temp\Noua comanda de achizitie.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\mshta.exeC:\Windows\System32\mshta.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1752
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\mshta.exe"3⤵PID:3804
-
-