Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
14-10-2021 18:55
Static task
static1
Behavioral task
behavioral1
Sample
PO# 11381.exe
Resource
win7-en-20210920
General
-
Target
PO# 11381.exe
-
Size
397KB
-
MD5
358bd28cc6d56ab308c4a413b2de32f5
-
SHA1
88178d1f6e0ad8f120a542f1314f5f4dd907f6ff
-
SHA256
cadf6d6a91c8c4e8576468e393638eb7ee477490c5a8a7d0fe9e919b6a6d93ec
-
SHA512
a52182f20b732e9fc37cb0b163b6378b8720209a1c6670decf95c4f518afe927d367ebb69cadb8483abbb0e32cbd218ef256764ad66fb109fd577eb039545973
Malware Config
Extracted
formbook
4.1
fv89
http://www.keyplus.digital/fv89/
explaodingkittens.com
terapisanak.com
wearenlcs.com
bbcwin128.com
gyrotrader.com
pamvagata.com
1stoplendinggroup.store
sedukapug.rest
practicepicnic.com
moonmonkeyventureclub.com
theaveragedude.com
theintegritytalks.com
andesadventureperu.com
helmrad.com
thurmaniniguezdqkaogyzkbus.com
computetecs.com
regionsi.com
bestyounggirls.site
funnelmymoney.com
hardrocktransport.online
newstowergh.com
lucaslemonholm.com
pinksartistry.com
fepiel.com
pragmaticrhino.net
cunsem.link
boekenroodeweg45.com
junkremovallindenhurst.com
vitkotijelo.online
pacutolit.rest
xkji.xyz
primeworldsecurity.com
bendoregonplants.com
medulisten.com
veterannc.com
hastaneotomasyonu.com
northfacefactoryxoutlet.com
karenmilazzo.com
hilidayk9resorts.com
normajohnston.com
thexena.com
howtohennatattoo.online
roughhelmet.com
waypathconsulting.net
caregiverid.com
devanwesterman.com
gregorywatsonphd.com
it2020.net
giuliadapian.com
royaluxy.com
bigdnet.com
tandhtruckingacademy.com
countofeeti.online
daytonatackle.com
rsukrida.com
ggjh.xyz
knedatec.xyz
cafecitoinfluencers.com
shiqige.com
intescur22.info
lafabriqueduvent.com
mdbootstap.com
havenhopecenter.com
carvalhointernacional.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/520-124-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/520-125-0x000000000041F160-mapping.dmp formbook behavioral2/memory/3848-133-0x0000000002EA0000-0x0000000002ECF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO# 11381.exePO# 11381.exesvchost.exedescription pid process target process PID 2504 set thread context of 520 2504 PO# 11381.exe PO# 11381.exe PID 520 set thread context of 3024 520 PO# 11381.exe Explorer.EXE PID 3848 set thread context of 3024 3848 svchost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
PO# 11381.exesvchost.exepid process 520 PO# 11381.exe 520 PO# 11381.exe 520 PO# 11381.exe 520 PO# 11381.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3024 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PO# 11381.exesvchost.exepid process 520 PO# 11381.exe 520 PO# 11381.exe 520 PO# 11381.exe 3848 svchost.exe 3848 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO# 11381.exesvchost.exedescription pid process Token: SeDebugPrivilege 520 PO# 11381.exe Token: SeDebugPrivilege 3848 svchost.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PO# 11381.exeExplorer.EXEsvchost.exedescription pid process target process PID 2504 wrote to memory of 520 2504 PO# 11381.exe PO# 11381.exe PID 2504 wrote to memory of 520 2504 PO# 11381.exe PO# 11381.exe PID 2504 wrote to memory of 520 2504 PO# 11381.exe PO# 11381.exe PID 2504 wrote to memory of 520 2504 PO# 11381.exe PO# 11381.exe PID 2504 wrote to memory of 520 2504 PO# 11381.exe PO# 11381.exe PID 2504 wrote to memory of 520 2504 PO# 11381.exe PO# 11381.exe PID 3024 wrote to memory of 3848 3024 Explorer.EXE svchost.exe PID 3024 wrote to memory of 3848 3024 Explorer.EXE svchost.exe PID 3024 wrote to memory of 3848 3024 Explorer.EXE svchost.exe PID 3848 wrote to memory of 1896 3848 svchost.exe cmd.exe PID 3848 wrote to memory of 1896 3848 svchost.exe cmd.exe PID 3848 wrote to memory of 1896 3848 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO# 11381.exe"C:\Users\Admin\AppData\Local\Temp\PO# 11381.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO# 11381.exe"C:\Users\Admin\AppData\Local\Temp\PO# 11381.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO# 11381.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/520-124-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/520-128-0x00000000012D0000-0x00000000012E4000-memory.dmpFilesize
80KB
-
memory/520-127-0x00000000012F0000-0x0000000001610000-memory.dmpFilesize
3.1MB
-
memory/520-125-0x000000000041F160-mapping.dmp
-
memory/1896-132-0x0000000000000000-mapping.dmp
-
memory/2504-121-0x0000000004E20000-0x0000000004E25000-memory.dmpFilesize
20KB
-
memory/2504-117-0x0000000004FB0000-0x0000000004FB1000-memory.dmpFilesize
4KB
-
memory/2504-123-0x00000000071D0000-0x0000000007220000-memory.dmpFilesize
320KB
-
memory/2504-115-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/2504-120-0x0000000004AB0000-0x0000000004FAE000-memory.dmpFilesize
5.0MB
-
memory/2504-119-0x00000000049D0000-0x00000000049D1000-memory.dmpFilesize
4KB
-
memory/2504-118-0x0000000004A00000-0x0000000004A01000-memory.dmpFilesize
4KB
-
memory/2504-122-0x0000000007130000-0x0000000007131000-memory.dmpFilesize
4KB
-
memory/3024-129-0x0000000002450000-0x0000000002539000-memory.dmpFilesize
932KB
-
memory/3024-136-0x0000000005D00000-0x0000000005E82000-memory.dmpFilesize
1.5MB
-
memory/3848-130-0x0000000000000000-mapping.dmp
-
memory/3848-133-0x0000000002EA0000-0x0000000002ECF000-memory.dmpFilesize
188KB
-
memory/3848-131-0x0000000000860000-0x000000000086C000-memory.dmpFilesize
48KB
-
memory/3848-134-0x0000000003620000-0x0000000003940000-memory.dmpFilesize
3.1MB
-
memory/3848-135-0x00000000033A0000-0x0000000003433000-memory.dmpFilesize
588KB