Analysis
-
max time kernel
151s -
max time network
146s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
14-10-2021 10:13
Static task
static1
Behavioral task
behavioral1
Sample
Siparis onayi.09826272882.exe
Resource
win7-en-20210920
General
-
Target
Siparis onayi.09826272882.exe
-
Size
777KB
-
MD5
ec4945b27f81624b5293543cc03885e5
-
SHA1
98702dd3ae9571c627615d6cb7137156381d1886
-
SHA256
f86258665b68d70e83397ac4ef17598c552b994dd13f26b8208c4d40b8e94816
-
SHA512
70156ed777e9650e4a37ce8794df62b7b08852e331edd798c388430abc33616cc2f608b0a8c92295d97f87be3d31297c6e921946841d967c7254a98d30cd57f8
Malware Config
Extracted
formbook
4.1
bc3s
http://www.topei-products.com/bc3s/
anna-ng.com
mariangelamata.com
szqnbl.com
nesherguitars.com
mysekrit.com
againbeautyviensui.xyz
appf.life
bilalsolution.com
technoratii.com
11restoran.com
birthingly.com
crystalcarrillo.com
cohenasset.info
bunchofdesign.com
highstreetmag.com
talentkerning.com
outdoor-glassesadvice.com
aliceeety.com
habbuhot.info
pao91.com
resgatarpontosparavoce.com
tuancai.net
cnynckcrw.com
visaza.com
paulettecallen.com
kandmfinancialgroup.com
malibuclassix.com
thespoonteller.com
vidyaxyp.com
xn--gmsepetim-q9ab20j.com
saudesexualdoshomens.com
safehandmarketing.com
yebimhieu.site
alimitchellmedia.com
andrewpatrickpiette.com
astro-paradise.com
domainechoquet.com
navihealthpartners.com
detroitveganseafood.com
spankingandpunishment.com
magalu-queromais.com
mallsinup.com
rmsnidlogini.cloud
lifeisveryessential.com
stolzfus.com
iniciala.com
designslayers.com
clinivahq.com
ubersms.com
welenb.com
skyegroupllc.com
happyburger.net
moredate-s.com
alon-mail.com
voceprofessor.com
dokadveri.com
lafabricadisseny.com
westwooddesign.net
blossoms-boutique.com
jumtix.xyz
dietgulfport.com
soccerstreamer.com
lapurtcedd.com
secret-mall.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2300-117-0x0000000000000000-mapping.dmp formbook behavioral2/memory/2300-120-0x0000000072480000-0x00000000724AE000-memory.dmp formbook behavioral2/memory/912-126-0x0000000000780000-0x00000000007AE000-memory.dmp formbook -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Siparis onayi.09826272882.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Vgkxrts = "C:\\Users\\Public\\Libraries\\strxkgV.url" Siparis onayi.09826272882.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
logagent.execscript.exedescription pid process target process PID 2300 set thread context of 3040 2300 logagent.exe Explorer.EXE PID 912 set thread context of 3040 912 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
logagent.execscript.exepid process 2300 logagent.exe 2300 logagent.exe 2300 logagent.exe 2300 logagent.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe 912 cscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3040 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
logagent.execscript.exepid process 2300 logagent.exe 2300 logagent.exe 2300 logagent.exe 912 cscript.exe 912 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
logagent.execscript.exedescription pid process Token: SeDebugPrivilege 2300 logagent.exe Token: SeDebugPrivilege 912 cscript.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Siparis onayi.09826272882.exeExplorer.EXEcscript.exedescription pid process target process PID 1776 wrote to memory of 2300 1776 Siparis onayi.09826272882.exe logagent.exe PID 1776 wrote to memory of 2300 1776 Siparis onayi.09826272882.exe logagent.exe PID 1776 wrote to memory of 2300 1776 Siparis onayi.09826272882.exe logagent.exe PID 1776 wrote to memory of 2300 1776 Siparis onayi.09826272882.exe logagent.exe PID 1776 wrote to memory of 2300 1776 Siparis onayi.09826272882.exe logagent.exe PID 1776 wrote to memory of 2300 1776 Siparis onayi.09826272882.exe logagent.exe PID 3040 wrote to memory of 912 3040 Explorer.EXE cscript.exe PID 3040 wrote to memory of 912 3040 Explorer.EXE cscript.exe PID 3040 wrote to memory of 912 3040 Explorer.EXE cscript.exe PID 912 wrote to memory of 3952 912 cscript.exe cmd.exe PID 912 wrote to memory of 3952 912 cscript.exe cmd.exe PID 912 wrote to memory of 3952 912 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Siparis onayi.09826272882.exe"C:\Users\Admin\AppData\Local\Temp\Siparis onayi.09826272882.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\logagent.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/912-124-0x0000000000000000-mapping.dmp
-
memory/912-129-0x00000000049D0000-0x0000000004A63000-memory.dmpFilesize
588KB
-
memory/912-128-0x0000000004B60000-0x0000000004E80000-memory.dmpFilesize
3.1MB
-
memory/912-125-0x0000000000EC0000-0x0000000000EE7000-memory.dmpFilesize
156KB
-
memory/912-126-0x0000000000780000-0x00000000007AE000-memory.dmpFilesize
184KB
-
memory/1776-116-0x0000000000951000-0x0000000000965000-memory.dmpFilesize
80KB
-
memory/1776-115-0x0000000000930000-0x0000000000931000-memory.dmpFilesize
4KB
-
memory/2300-118-0x0000000002DF0000-0x0000000002DF1000-memory.dmpFilesize
4KB
-
memory/2300-122-0x0000000003380000-0x0000000003394000-memory.dmpFilesize
80KB
-
memory/2300-120-0x0000000072480000-0x00000000724AE000-memory.dmpFilesize
184KB
-
memory/2300-121-0x0000000004FB0000-0x00000000052D0000-memory.dmpFilesize
3.1MB
-
memory/2300-117-0x0000000000000000-mapping.dmp
-
memory/3040-123-0x0000000006920000-0x0000000006A44000-memory.dmpFilesize
1.1MB
-
memory/3040-130-0x0000000007500000-0x000000000762F000-memory.dmpFilesize
1.2MB
-
memory/3952-127-0x0000000000000000-mapping.dmp