Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
21-10-2021 11:53
Static task
static1
Behavioral task
behavioral1
Sample
villarzx.exe
Resource
win7-en-20210920
General
-
Target
villarzx.exe
-
Size
483KB
-
MD5
43185ba5682dbd5b9a4aeefd052f2ba7
-
SHA1
9fb2ca5d4998c28ed9637e7f8c62e001a4a262d1
-
SHA256
ddcee2fa36f568c004181f3d91b4b75eeb935a28e9b5a3d32d1c0fd78be4fa70
-
SHA512
b7f148d97395b0ad4ba5dc0166d6e0c15df1514763a367c5518f0df771b64dee9f411a9bc295acec0a07b27d58d639704488a2c93531c5f34fa227449aba2ad0
Malware Config
Extracted
formbook
4.1
jy0b
http://www.filecrev.com/jy0b/
lamejorimagen.com
mykabukibrush.com
modgon.com
barefoottherapeutics.com
shimpeg.net
trade-sniper.com
chiangkhancityhotel.com
joblessmoni.club
stespritsubways.com
chico-group.com
nni8.xyz
searchtypically.online
jobsyork.com
bestsales-crypto.com
iqmarketing.info
bullcityphotobooths.com
fwssc.icu
1oc87s.icu
usdiesel.xyz
secrets2optimumnutrition.com
charlotte-s-creations.com
homenetmidrand.com
sytypij.xyz
tapehitsscriptsparty.com
adelenashville.com
greendylife.com
agbqs.com
lilcrox.xyz
thepersonalevolutionmaven.com
graciasmiangel.com
heidisgifts.com
flchimneyspecialists.com
yorkrehabclinic.com
cent-pour-centsons.com
marcoislandsupsurf.net
expressdiagnostics.info
surferjackproductions.com
duscopy.store
uekra.tech
campaigncupgunplant.xyz
cheetahadvance.com
blickosinski.icu
laketacostahoe.com
drippysupplyco.com
isomassagegun.com
clarition.com
andrew-pillar.com
truthbudgeting.com
cloudfixr.com
cfasministries.com
compliant-now-beta.com
kssc17.icu
plewabuilders.com
uslugi-email.site
167hours.com
sodo6697.com
voyagesify.com
ranodalei.com
culturao.com
littlepotato-id.com
integtiryhvacsanmateo.com
neatmounts.com
reddictnflstream.com
digistore-maya.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1656-62-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1656-63-0x000000000041F150-mapping.dmp formbook behavioral1/memory/672-70-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 432 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
villarzx.exevillarzx.exewininit.exedescription pid process target process PID 368 set thread context of 1656 368 villarzx.exe villarzx.exe PID 1656 set thread context of 1376 1656 villarzx.exe Explorer.EXE PID 672 set thread context of 1376 672 wininit.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
villarzx.exewininit.exepid process 1656 villarzx.exe 1656 villarzx.exe 672 wininit.exe 672 wininit.exe 672 wininit.exe 672 wininit.exe 672 wininit.exe 672 wininit.exe 672 wininit.exe 672 wininit.exe 672 wininit.exe 672 wininit.exe 672 wininit.exe 672 wininit.exe 672 wininit.exe 672 wininit.exe 672 wininit.exe 672 wininit.exe 672 wininit.exe 672 wininit.exe 672 wininit.exe 672 wininit.exe 672 wininit.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
villarzx.exewininit.exepid process 1656 villarzx.exe 1656 villarzx.exe 1656 villarzx.exe 672 wininit.exe 672 wininit.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
villarzx.exewininit.exedescription pid process Token: SeDebugPrivilege 1656 villarzx.exe Token: SeDebugPrivilege 672 wininit.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1376 Explorer.EXE 1376 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1376 Explorer.EXE 1376 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
villarzx.exeExplorer.EXEwininit.exedescription pid process target process PID 368 wrote to memory of 1656 368 villarzx.exe villarzx.exe PID 368 wrote to memory of 1656 368 villarzx.exe villarzx.exe PID 368 wrote to memory of 1656 368 villarzx.exe villarzx.exe PID 368 wrote to memory of 1656 368 villarzx.exe villarzx.exe PID 368 wrote to memory of 1656 368 villarzx.exe villarzx.exe PID 368 wrote to memory of 1656 368 villarzx.exe villarzx.exe PID 368 wrote to memory of 1656 368 villarzx.exe villarzx.exe PID 1376 wrote to memory of 672 1376 Explorer.EXE wininit.exe PID 1376 wrote to memory of 672 1376 Explorer.EXE wininit.exe PID 1376 wrote to memory of 672 1376 Explorer.EXE wininit.exe PID 1376 wrote to memory of 672 1376 Explorer.EXE wininit.exe PID 672 wrote to memory of 432 672 wininit.exe cmd.exe PID 672 wrote to memory of 432 672 wininit.exe cmd.exe PID 672 wrote to memory of 432 672 wininit.exe cmd.exe PID 672 wrote to memory of 432 672 wininit.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\villarzx.exe"C:\Users\Admin\AppData\Local\Temp\villarzx.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\villarzx.exe"C:\Users\Admin\AppData\Local\Temp\villarzx.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\villarzx.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/368-54-0x0000000000010000-0x0000000000011000-memory.dmpFilesize
4KB
-
memory/368-56-0x0000000074B91000-0x0000000074B93000-memory.dmpFilesize
8KB
-
memory/368-57-0x0000000000500000-0x0000000000507000-memory.dmpFilesize
28KB
-
memory/368-58-0x0000000004E90000-0x0000000004E91000-memory.dmpFilesize
4KB
-
memory/368-59-0x0000000004CD0000-0x0000000004D20000-memory.dmpFilesize
320KB
-
memory/432-72-0x0000000000000000-mapping.dmp
-
memory/672-68-0x0000000000000000-mapping.dmp
-
memory/672-70-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/672-71-0x0000000001EE0000-0x00000000021E3000-memory.dmpFilesize
3.0MB
-
memory/672-69-0x0000000000230000-0x000000000024A000-memory.dmpFilesize
104KB
-
memory/672-73-0x0000000001D40000-0x0000000001DD3000-memory.dmpFilesize
588KB
-
memory/1376-67-0x00000000068C0000-0x0000000006A01000-memory.dmpFilesize
1.3MB
-
memory/1376-74-0x0000000004F90000-0x00000000050A1000-memory.dmpFilesize
1.1MB
-
memory/1656-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1656-63-0x000000000041F150-mapping.dmp
-
memory/1656-65-0x0000000000950000-0x0000000000C53000-memory.dmpFilesize
3.0MB
-
memory/1656-66-0x0000000000310000-0x0000000000324000-memory.dmpFilesize
80KB
-
memory/1656-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1656-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB