Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
14-10-2021 11:35
Static task
static1
Behavioral task
behavioral1
Sample
76d6388e293de04e8ff5b3124a47cb82.exe
Resource
win7-en-20210920
General
-
Target
76d6388e293de04e8ff5b3124a47cb82.exe
-
Size
355KB
-
MD5
76d6388e293de04e8ff5b3124a47cb82
-
SHA1
a6163b93b45573b4a7792588a9fad3e8ba22ef71
-
SHA256
694b9ea09a47c2f24b47c60ddff0a0537828e8ba964c0ad0045b9862bce37d42
-
SHA512
00ebb1aed4182d52704cef6fadb9f81e2cffc8b8eefb6c1268113acd6fdfe882646cd4245856e30624c6bd71dc61e6d64f7230f1ebf22ebbb196446dbb078a99
Malware Config
Extracted
formbook
4.1
vngb
http://www.gvlc0.club/vngb/
omertalasvegas.com
payyep.com
modasportss.com
gestionestrategicadl.com
teamolemiss.club
geektranslate.com
versatileventure.com
athletic-hub.com
vitanovaretreats.com
padison8t.com
tutoeasy.com
ediblewholesale.com
kangrungao.com
satode.com
prohibitionfeeds.com
getmorevacations.com
blinkworldbeauty.com
kdlabsallr.com
almanasef.com
transportationservicellc.com
goodtime.photos
pkmpresensi.com
banddwoodworks.com
agoodhotel.com
sec-waliet.com
unitybookkeepingsolutions.com
msbyjenny.com
thefilipinostory.com
nez-care.com
jobsforjabless.com
joeyzelinka.com
springeqx.com
doubletreeankamall.com
tribal-treasures.com
kickbikedepot.com
ez.money
norpandco.com
alanavieira.online
studybugger.net
giaohangtietkiemhcm.com
soundlifeonline.com
mindbodyweightlossmethod.com
arcelius.one
executivecenterlacey.com
summergreenarea.com
skydaddy.guru
peblish.com
croworld.tools
99099888.com
48rmz6.biz
globalshadowboards.com
420doggy.com
sikratek.com
pradaexch9.com
fashionbusinessmanagement.com
givemeyouroil.com
recifetopschoolteacher.com
dealhay.net
bitpaa.com
insidersbyio.com
atheanas.com
projectcentered.com
mmj0115.xyz
yektaburgers.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/700-62-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/700-63-0x000000000041F0E0-mapping.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
76d6388e293de04e8ff5b3124a47cb82.exedescription pid process target process PID 2008 set thread context of 700 2008 76d6388e293de04e8ff5b3124a47cb82.exe 76d6388e293de04e8ff5b3124a47cb82.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
76d6388e293de04e8ff5b3124a47cb82.exepid process 700 76d6388e293de04e8ff5b3124a47cb82.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
76d6388e293de04e8ff5b3124a47cb82.exedescription pid process target process PID 2008 wrote to memory of 700 2008 76d6388e293de04e8ff5b3124a47cb82.exe 76d6388e293de04e8ff5b3124a47cb82.exe PID 2008 wrote to memory of 700 2008 76d6388e293de04e8ff5b3124a47cb82.exe 76d6388e293de04e8ff5b3124a47cb82.exe PID 2008 wrote to memory of 700 2008 76d6388e293de04e8ff5b3124a47cb82.exe 76d6388e293de04e8ff5b3124a47cb82.exe PID 2008 wrote to memory of 700 2008 76d6388e293de04e8ff5b3124a47cb82.exe 76d6388e293de04e8ff5b3124a47cb82.exe PID 2008 wrote to memory of 700 2008 76d6388e293de04e8ff5b3124a47cb82.exe 76d6388e293de04e8ff5b3124a47cb82.exe PID 2008 wrote to memory of 700 2008 76d6388e293de04e8ff5b3124a47cb82.exe 76d6388e293de04e8ff5b3124a47cb82.exe PID 2008 wrote to memory of 700 2008 76d6388e293de04e8ff5b3124a47cb82.exe 76d6388e293de04e8ff5b3124a47cb82.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\76d6388e293de04e8ff5b3124a47cb82.exe"C:\Users\Admin\AppData\Local\Temp\76d6388e293de04e8ff5b3124a47cb82.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\76d6388e293de04e8ff5b3124a47cb82.exe"C:\Users\Admin\AppData\Local\Temp\76d6388e293de04e8ff5b3124a47cb82.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/700-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/700-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/700-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/700-63-0x000000000041F0E0-mapping.dmp
-
memory/700-64-0x0000000000C20000-0x0000000000F23000-memory.dmpFilesize
3.0MB
-
memory/2008-54-0x0000000000900000-0x0000000000901000-memory.dmpFilesize
4KB
-
memory/2008-56-0x0000000075FA1000-0x0000000075FA3000-memory.dmpFilesize
8KB
-
memory/2008-57-0x0000000004D40000-0x0000000004D41000-memory.dmpFilesize
4KB
-
memory/2008-58-0x0000000000820000-0x0000000000825000-memory.dmpFilesize
20KB
-
memory/2008-59-0x00000000047F0000-0x0000000004840000-memory.dmpFilesize
320KB