Analysis
-
max time kernel
147s -
max time network
180s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
14-10-2021 15:20
Static task
static1
Behavioral task
behavioral1
Sample
Ministry of Health Kingdom of Bahrain.exe
Resource
win7-en-20210920
General
-
Target
Ministry of Health Kingdom of Bahrain.exe
-
Size
358KB
-
MD5
e1a110c51c33c12ee53679c40c954395
-
SHA1
361ca3b8600138c93a6cb8728ddefd7bb1be53ef
-
SHA256
ad4c2025f6a3741ba965e53a40e907b04dd1031c666e80d98afe6fd00c70239d
-
SHA512
8572c6c49eca57c0a89523df94c73eb65617687c4e89045633eeafb05f2844f6c14df7ef0e61fa05a1cae39d5fa664d8e206c6cccadcacc03d749a9b0caefdfb
Malware Config
Extracted
formbook
4.1
ey5a
http://www.puwuved.xyz/ey5a/
lygptkl.com
winsentrade.com
bluprintliving.com
yumohealth.com
cherryadulttoys.com
gianttigar.com
maxhutmacher.net
autostokyocorp.com
calvaryload.com
stixxiepix.com
j98152.com
starsky666.xyz
loadkicks.com
designauraspace.com
wwwfmcna.com
mikakonaitopsychologist.com
kristalsuaritma.com
kh180.com
kulturel.net
araveenapark.com
sniffandwhiffcandles.com
sihambaz.xyz
lcmdcatalogs.com
panncakeswwoap.com
kmxwzl.com
clientes-personas.online
juragantrader.com
tridimensionallab.com
adtechobservability.com
jaqaya.com
w9qdg3f.xyz
shaiyahp.online
algarvebnb.com
travelingpretty.com
terone2pack.com
salonlinw.com
i-craft-admin.com
thejoyismcoach.com
eas-rightofway.com
apacegov.net
endearingmonuments.com
healthyd-ductcleaning.com
av141.xyz
buscatuempresa.com
mobilechor.com
empanadasycakesfranchus.com
demtate.xyz
orlandonotarymobile.com
atdkdesign.com
dijitalportal.net
allisonkimart.online
la-souche.com
mrstonecrest.com
yanghetang.net
takinghe.online
gzdfzx.com
zx0558.top
vimarohomes.com
swm87.com
rewritepapers.com
macrotroics.net
dimitris.life
cornholeleague.life
access-inurance.com
Signatures
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2016-62-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2016-63-0x000000000041F070-mapping.dmp formbook behavioral1/memory/2016-68-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1480-73-0x00000000000B0000-0x00000000000DF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1900 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Ministry of Health Kingdom of Bahrain.exeMinistry of Health Kingdom of Bahrain.execscript.exedescription pid process target process PID 1884 set thread context of 2016 1884 Ministry of Health Kingdom of Bahrain.exe Ministry of Health Kingdom of Bahrain.exe PID 2016 set thread context of 1400 2016 Ministry of Health Kingdom of Bahrain.exe Explorer.EXE PID 2016 set thread context of 1400 2016 Ministry of Health Kingdom of Bahrain.exe Explorer.EXE PID 1480 set thread context of 1400 1480 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
Ministry of Health Kingdom of Bahrain.exeMinistry of Health Kingdom of Bahrain.execscript.exepid process 1884 Ministry of Health Kingdom of Bahrain.exe 2016 Ministry of Health Kingdom of Bahrain.exe 2016 Ministry of Health Kingdom of Bahrain.exe 2016 Ministry of Health Kingdom of Bahrain.exe 1480 cscript.exe 1480 cscript.exe 1480 cscript.exe 1480 cscript.exe 1480 cscript.exe 1480 cscript.exe 1480 cscript.exe 1480 cscript.exe 1480 cscript.exe 1480 cscript.exe 1480 cscript.exe 1480 cscript.exe 1480 cscript.exe 1480 cscript.exe 1480 cscript.exe 1480 cscript.exe 1480 cscript.exe 1480 cscript.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Ministry of Health Kingdom of Bahrain.execscript.exepid process 2016 Ministry of Health Kingdom of Bahrain.exe 2016 Ministry of Health Kingdom of Bahrain.exe 2016 Ministry of Health Kingdom of Bahrain.exe 2016 Ministry of Health Kingdom of Bahrain.exe 1480 cscript.exe 1480 cscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Ministry of Health Kingdom of Bahrain.exeMinistry of Health Kingdom of Bahrain.execscript.exedescription pid process Token: SeDebugPrivilege 1884 Ministry of Health Kingdom of Bahrain.exe Token: SeDebugPrivilege 2016 Ministry of Health Kingdom of Bahrain.exe Token: SeDebugPrivilege 1480 cscript.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1400 Explorer.EXE 1400 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1400 Explorer.EXE 1400 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1400 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
Ministry of Health Kingdom of Bahrain.exeExplorer.EXEcscript.exedescription pid process target process PID 1884 wrote to memory of 1528 1884 Ministry of Health Kingdom of Bahrain.exe Ministry of Health Kingdom of Bahrain.exe PID 1884 wrote to memory of 1528 1884 Ministry of Health Kingdom of Bahrain.exe Ministry of Health Kingdom of Bahrain.exe PID 1884 wrote to memory of 1528 1884 Ministry of Health Kingdom of Bahrain.exe Ministry of Health Kingdom of Bahrain.exe PID 1884 wrote to memory of 1528 1884 Ministry of Health Kingdom of Bahrain.exe Ministry of Health Kingdom of Bahrain.exe PID 1884 wrote to memory of 2016 1884 Ministry of Health Kingdom of Bahrain.exe Ministry of Health Kingdom of Bahrain.exe PID 1884 wrote to memory of 2016 1884 Ministry of Health Kingdom of Bahrain.exe Ministry of Health Kingdom of Bahrain.exe PID 1884 wrote to memory of 2016 1884 Ministry of Health Kingdom of Bahrain.exe Ministry of Health Kingdom of Bahrain.exe PID 1884 wrote to memory of 2016 1884 Ministry of Health Kingdom of Bahrain.exe Ministry of Health Kingdom of Bahrain.exe PID 1884 wrote to memory of 2016 1884 Ministry of Health Kingdom of Bahrain.exe Ministry of Health Kingdom of Bahrain.exe PID 1884 wrote to memory of 2016 1884 Ministry of Health Kingdom of Bahrain.exe Ministry of Health Kingdom of Bahrain.exe PID 1884 wrote to memory of 2016 1884 Ministry of Health Kingdom of Bahrain.exe Ministry of Health Kingdom of Bahrain.exe PID 1400 wrote to memory of 1480 1400 Explorer.EXE cscript.exe PID 1400 wrote to memory of 1480 1400 Explorer.EXE cscript.exe PID 1400 wrote to memory of 1480 1400 Explorer.EXE cscript.exe PID 1400 wrote to memory of 1480 1400 Explorer.EXE cscript.exe PID 1480 wrote to memory of 1900 1480 cscript.exe cmd.exe PID 1480 wrote to memory of 1900 1480 cscript.exe cmd.exe PID 1480 wrote to memory of 1900 1480 cscript.exe cmd.exe PID 1480 wrote to memory of 1900 1480 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ministry of Health Kingdom of Bahrain.exe"C:\Users\Admin\AppData\Local\Temp\Ministry of Health Kingdom of Bahrain.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ministry of Health Kingdom of Bahrain.exe"C:\Users\Admin\AppData\Local\Temp\Ministry of Health Kingdom of Bahrain.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Ministry of Health Kingdom of Bahrain.exe"C:\Users\Admin\AppData\Local\Temp\Ministry of Health Kingdom of Bahrain.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Ministry of Health Kingdom of Bahrain.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1400-66-0x00000000044D0000-0x00000000045BD000-memory.dmpFilesize
948KB
-
memory/1400-77-0x0000000007980000-0x0000000007B03000-memory.dmpFilesize
1.5MB
-
memory/1400-70-0x0000000006A00000-0x0000000006B51000-memory.dmpFilesize
1.3MB
-
memory/1480-71-0x0000000000000000-mapping.dmp
-
memory/1480-76-0x00000000022B0000-0x0000000002344000-memory.dmpFilesize
592KB
-
memory/1480-75-0x0000000001FA0000-0x00000000022A3000-memory.dmpFilesize
3.0MB
-
memory/1480-72-0x0000000000320000-0x0000000000342000-memory.dmpFilesize
136KB
-
memory/1480-73-0x00000000000B0000-0x00000000000DF000-memory.dmpFilesize
188KB
-
memory/1884-57-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/1884-56-0x00000000751A1000-0x00000000751A3000-memory.dmpFilesize
8KB
-
memory/1884-59-0x0000000000E50000-0x0000000000EA0000-memory.dmpFilesize
320KB
-
memory/1884-58-0x0000000000250000-0x0000000000255000-memory.dmpFilesize
20KB
-
memory/1884-54-0x0000000001270000-0x0000000001271000-memory.dmpFilesize
4KB
-
memory/1900-74-0x0000000000000000-mapping.dmp
-
memory/2016-63-0x000000000041F070-mapping.dmp
-
memory/2016-69-0x00000000004C0000-0x00000000004D5000-memory.dmpFilesize
84KB
-
memory/2016-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2016-67-0x00000000002C0000-0x00000000002D5000-memory.dmpFilesize
84KB
-
memory/2016-65-0x0000000000770000-0x0000000000A73000-memory.dmpFilesize
3.0MB
-
memory/2016-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2016-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2016-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB