Analysis
-
max time kernel
50s -
max time network
50s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
14-10-2021 09:31
Static task
static1
General
-
Target
Nueva lista de pedidos.exe
-
Size
653KB
-
MD5
1bdecdff064b9e7304adfc1edca22019
-
SHA1
caf0534623c5f4c4293ecd5d671570a65e77fe96
-
SHA256
df2cd1e31e0ca0bb7210ee5382d2c1927d558920827e15843e0faf4010a03e94
-
SHA512
ac2acab16aa0a5451ef85bf8b8e0b2a08f37ae14ae947474aa5cd5b350064ce614f7b26d5be55908e359d4638676ea355fddc80bc6e0b54270e9cd7a26e17cd2
Malware Config
Extracted
formbook
4.1
bc3s
http://www.topei-products.com/bc3s/
anna-ng.com
mariangelamata.com
szqnbl.com
nesherguitars.com
mysekrit.com
againbeautyviensui.xyz
appf.life
bilalsolution.com
technoratii.com
11restoran.com
birthingly.com
crystalcarrillo.com
cohenasset.info
bunchofdesign.com
highstreetmag.com
talentkerning.com
outdoor-glassesadvice.com
aliceeety.com
habbuhot.info
pao91.com
resgatarpontosparavoce.com
tuancai.net
cnynckcrw.com
visaza.com
paulettecallen.com
kandmfinancialgroup.com
malibuclassix.com
thespoonteller.com
vidyaxyp.com
xn--gmsepetim-q9ab20j.com
saudesexualdoshomens.com
safehandmarketing.com
yebimhieu.site
alimitchellmedia.com
andrewpatrickpiette.com
astro-paradise.com
domainechoquet.com
navihealthpartners.com
detroitveganseafood.com
spankingandpunishment.com
magalu-queromais.com
mallsinup.com
rmsnidlogini.cloud
lifeisveryessential.com
stolzfus.com
iniciala.com
designslayers.com
clinivahq.com
ubersms.com
welenb.com
skyegroupllc.com
happyburger.net
moredate-s.com
alon-mail.com
voceprofessor.com
dokadveri.com
lafabricadisseny.com
westwooddesign.net
blossoms-boutique.com
jumtix.xyz
dietgulfport.com
soccerstreamer.com
lapurtcedd.com
secret-mall.com
Signatures
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1996-116-0x0000000000000000-mapping.dmp formbook behavioral1/memory/1996-119-0x0000000072480000-0x00000000724AE000-memory.dmp formbook behavioral1/memory/1996-121-0x0000000002C00000-0x0000000002D4A000-memory.dmp formbook behavioral1/memory/816-125-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Suspicious use of SetThreadContext 2 IoCs
Processes:
DpiScaling.exeexplorer.exedescription pid process target process PID 1996 set thread context of 3068 1996 DpiScaling.exe Explorer.EXE PID 816 set thread context of 3068 816 explorer.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
DpiScaling.exeexplorer.exepid process 1996 DpiScaling.exe 1996 DpiScaling.exe 1996 DpiScaling.exe 1996 DpiScaling.exe 816 explorer.exe 816 explorer.exe 816 explorer.exe 816 explorer.exe 816 explorer.exe 816 explorer.exe 816 explorer.exe 816 explorer.exe 816 explorer.exe 816 explorer.exe 816 explorer.exe 816 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3068 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
DpiScaling.exeexplorer.exepid process 1996 DpiScaling.exe 1996 DpiScaling.exe 1996 DpiScaling.exe 816 explorer.exe 816 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
DpiScaling.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1996 DpiScaling.exe Token: SeDebugPrivilege 816 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Nueva lista de pedidos.exeExplorer.EXEexplorer.exedescription pid process target process PID 2072 wrote to memory of 1996 2072 Nueva lista de pedidos.exe DpiScaling.exe PID 2072 wrote to memory of 1996 2072 Nueva lista de pedidos.exe DpiScaling.exe PID 2072 wrote to memory of 1996 2072 Nueva lista de pedidos.exe DpiScaling.exe PID 2072 wrote to memory of 1996 2072 Nueva lista de pedidos.exe DpiScaling.exe PID 2072 wrote to memory of 1996 2072 Nueva lista de pedidos.exe DpiScaling.exe PID 2072 wrote to memory of 1996 2072 Nueva lista de pedidos.exe DpiScaling.exe PID 3068 wrote to memory of 816 3068 Explorer.EXE explorer.exe PID 3068 wrote to memory of 816 3068 Explorer.EXE explorer.exe PID 3068 wrote to memory of 816 3068 Explorer.EXE explorer.exe PID 816 wrote to memory of 3940 816 explorer.exe cmd.exe PID 816 wrote to memory of 3940 816 explorer.exe cmd.exe PID 816 wrote to memory of 3940 816 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Nueva lista de pedidos.exe"C:\Users\Admin\AppData\Local\Temp\Nueva lista de pedidos.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\DpiScaling.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/816-123-0x0000000000000000-mapping.dmp
-
memory/816-128-0x0000000000DB0000-0x0000000000E43000-memory.dmpFilesize
588KB
-
memory/816-127-0x0000000004850000-0x0000000004B70000-memory.dmpFilesize
3.1MB
-
memory/816-124-0x0000000000E70000-0x00000000012AF000-memory.dmpFilesize
4.2MB
-
memory/816-125-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1996-119-0x0000000072480000-0x00000000724AE000-memory.dmpFilesize
184KB
-
memory/1996-121-0x0000000002C00000-0x0000000002D4A000-memory.dmpFilesize
1.3MB
-
memory/1996-120-0x00000000048B0000-0x0000000004BD0000-memory.dmpFilesize
3.1MB
-
memory/1996-118-0x0000000000730000-0x0000000000731000-memory.dmpFilesize
4KB
-
memory/1996-116-0x0000000000000000-mapping.dmp
-
memory/2072-115-0x0000000000630000-0x0000000000631000-memory.dmpFilesize
4KB
-
memory/3068-122-0x00000000052A0000-0x00000000053E3000-memory.dmpFilesize
1.3MB
-
memory/3068-129-0x00000000053F0000-0x000000000551D000-memory.dmpFilesize
1.2MB
-
memory/3940-126-0x0000000000000000-mapping.dmp