Analysis
-
max time kernel
146s -
max time network
143s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
14-10-2021 18:55
Static task
static1
Behavioral task
behavioral1
Sample
PO# 11381.exe
Resource
win7-en-20210920
General
-
Target
PO# 11381.exe
-
Size
397KB
-
MD5
358bd28cc6d56ab308c4a413b2de32f5
-
SHA1
88178d1f6e0ad8f120a542f1314f5f4dd907f6ff
-
SHA256
cadf6d6a91c8c4e8576468e393638eb7ee477490c5a8a7d0fe9e919b6a6d93ec
-
SHA512
a52182f20b732e9fc37cb0b163b6378b8720209a1c6670decf95c4f518afe927d367ebb69cadb8483abbb0e32cbd218ef256764ad66fb109fd577eb039545973
Malware Config
Extracted
formbook
4.1
fv89
http://www.keyplus.digital/fv89/
explaodingkittens.com
terapisanak.com
wearenlcs.com
bbcwin128.com
gyrotrader.com
pamvagata.com
1stoplendinggroup.store
sedukapug.rest
practicepicnic.com
moonmonkeyventureclub.com
theaveragedude.com
theintegritytalks.com
andesadventureperu.com
helmrad.com
thurmaniniguezdqkaogyzkbus.com
computetecs.com
regionsi.com
bestyounggirls.site
funnelmymoney.com
hardrocktransport.online
newstowergh.com
lucaslemonholm.com
pinksartistry.com
fepiel.com
pragmaticrhino.net
cunsem.link
boekenroodeweg45.com
junkremovallindenhurst.com
vitkotijelo.online
pacutolit.rest
xkji.xyz
primeworldsecurity.com
bendoregonplants.com
medulisten.com
veterannc.com
hastaneotomasyonu.com
northfacefactoryxoutlet.com
karenmilazzo.com
hilidayk9resorts.com
normajohnston.com
thexena.com
howtohennatattoo.online
roughhelmet.com
waypathconsulting.net
caregiverid.com
devanwesterman.com
gregorywatsonphd.com
it2020.net
giuliadapian.com
royaluxy.com
bigdnet.com
tandhtruckingacademy.com
countofeeti.online
daytonatackle.com
rsukrida.com
ggjh.xyz
knedatec.xyz
cafecitoinfluencers.com
shiqige.com
intescur22.info
lafabriqueduvent.com
mdbootstap.com
havenhopecenter.com
carvalhointernacional.com
Signatures
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/788-61-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/788-62-0x000000000041F160-mapping.dmp formbook behavioral1/memory/788-67-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1680-75-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1320 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
PO# 11381.exePO# 11381.exeexplorer.exedescription pid process target process PID 1108 set thread context of 788 1108 PO# 11381.exe PO# 11381.exe PID 788 set thread context of 1336 788 PO# 11381.exe Explorer.EXE PID 788 set thread context of 1336 788 PO# 11381.exe Explorer.EXE PID 1680 set thread context of 1336 1680 explorer.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
PO# 11381.exeexplorer.exepid process 788 PO# 11381.exe 788 PO# 11381.exe 788 PO# 11381.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
PO# 11381.exeexplorer.exepid process 788 PO# 11381.exe 788 PO# 11381.exe 788 PO# 11381.exe 788 PO# 11381.exe 1680 explorer.exe 1680 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO# 11381.exeexplorer.exedescription pid process Token: SeDebugPrivilege 788 PO# 11381.exe Token: SeDebugPrivilege 1680 explorer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1336 Explorer.EXE 1336 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1336 Explorer.EXE 1336 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
PO# 11381.exeExplorer.EXEexplorer.exedescription pid process target process PID 1108 wrote to memory of 788 1108 PO# 11381.exe PO# 11381.exe PID 1108 wrote to memory of 788 1108 PO# 11381.exe PO# 11381.exe PID 1108 wrote to memory of 788 1108 PO# 11381.exe PO# 11381.exe PID 1108 wrote to memory of 788 1108 PO# 11381.exe PO# 11381.exe PID 1108 wrote to memory of 788 1108 PO# 11381.exe PO# 11381.exe PID 1108 wrote to memory of 788 1108 PO# 11381.exe PO# 11381.exe PID 1108 wrote to memory of 788 1108 PO# 11381.exe PO# 11381.exe PID 1336 wrote to memory of 1680 1336 Explorer.EXE explorer.exe PID 1336 wrote to memory of 1680 1336 Explorer.EXE explorer.exe PID 1336 wrote to memory of 1680 1336 Explorer.EXE explorer.exe PID 1336 wrote to memory of 1680 1336 Explorer.EXE explorer.exe PID 1680 wrote to memory of 1320 1680 explorer.exe cmd.exe PID 1680 wrote to memory of 1320 1680 explorer.exe cmd.exe PID 1680 wrote to memory of 1320 1680 explorer.exe cmd.exe PID 1680 wrote to memory of 1320 1680 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO# 11381.exe"C:\Users\Admin\AppData\Local\Temp\PO# 11381.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO# 11381.exe"C:\Users\Admin\AppData\Local\Temp\PO# 11381.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO# 11381.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/788-64-0x0000000000850000-0x0000000000B53000-memory.dmpFilesize
3.0MB
-
memory/788-62-0x000000000041F160-mapping.dmp
-
memory/788-65-0x0000000000350000-0x0000000000364000-memory.dmpFilesize
80KB
-
memory/788-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/788-68-0x0000000000390000-0x00000000003A4000-memory.dmpFilesize
80KB
-
memory/788-59-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/788-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/788-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1108-58-0x0000000000740000-0x0000000000790000-memory.dmpFilesize
320KB
-
memory/1108-57-0x0000000000470000-0x0000000000475000-memory.dmpFilesize
20KB
-
memory/1108-56-0x0000000001080000-0x0000000001081000-memory.dmpFilesize
4KB
-
memory/1108-55-0x0000000075BF1000-0x0000000075BF3000-memory.dmpFilesize
8KB
-
memory/1108-53-0x0000000001240000-0x0000000001241000-memory.dmpFilesize
4KB
-
memory/1320-73-0x0000000000000000-mapping.dmp
-
memory/1336-78-0x00000000068F0000-0x0000000006A50000-memory.dmpFilesize
1.4MB
-
memory/1336-69-0x0000000007050000-0x00000000071E2000-memory.dmpFilesize
1.6MB
-
memory/1336-66-0x00000000065F0000-0x000000000671E000-memory.dmpFilesize
1.2MB
-
memory/1680-70-0x0000000000000000-mapping.dmp
-
memory/1680-72-0x00000000749D1000-0x00000000749D3000-memory.dmpFilesize
8KB
-
memory/1680-74-0x00000000000D0000-0x0000000000351000-memory.dmpFilesize
2.5MB
-
memory/1680-75-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1680-76-0x0000000002300000-0x0000000002603000-memory.dmpFilesize
3.0MB
-
memory/1680-77-0x00000000020D0000-0x0000000002163000-memory.dmpFilesize
588KB