Analysis
-
max time kernel
148s -
max time network
158s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
21-10-2021 11:53
Static task
static1
Behavioral task
behavioral1
Sample
villarzx.exe
Resource
win7-en-20210920
General
-
Target
villarzx.exe
-
Size
483KB
-
MD5
43185ba5682dbd5b9a4aeefd052f2ba7
-
SHA1
9fb2ca5d4998c28ed9637e7f8c62e001a4a262d1
-
SHA256
ddcee2fa36f568c004181f3d91b4b75eeb935a28e9b5a3d32d1c0fd78be4fa70
-
SHA512
b7f148d97395b0ad4ba5dc0166d6e0c15df1514763a367c5518f0df771b64dee9f411a9bc295acec0a07b27d58d639704488a2c93531c5f34fa227449aba2ad0
Malware Config
Extracted
formbook
4.1
jy0b
http://www.filecrev.com/jy0b/
lamejorimagen.com
mykabukibrush.com
modgon.com
barefoottherapeutics.com
shimpeg.net
trade-sniper.com
chiangkhancityhotel.com
joblessmoni.club
stespritsubways.com
chico-group.com
nni8.xyz
searchtypically.online
jobsyork.com
bestsales-crypto.com
iqmarketing.info
bullcityphotobooths.com
fwssc.icu
1oc87s.icu
usdiesel.xyz
secrets2optimumnutrition.com
charlotte-s-creations.com
homenetmidrand.com
sytypij.xyz
tapehitsscriptsparty.com
adelenashville.com
greendylife.com
agbqs.com
lilcrox.xyz
thepersonalevolutionmaven.com
graciasmiangel.com
heidisgifts.com
flchimneyspecialists.com
yorkrehabclinic.com
cent-pour-centsons.com
marcoislandsupsurf.net
expressdiagnostics.info
surferjackproductions.com
duscopy.store
uekra.tech
campaigncupgunplant.xyz
cheetahadvance.com
blickosinski.icu
laketacostahoe.com
drippysupplyco.com
isomassagegun.com
clarition.com
andrew-pillar.com
truthbudgeting.com
cloudfixr.com
cfasministries.com
compliant-now-beta.com
kssc17.icu
plewabuilders.com
uslugi-email.site
167hours.com
sodo6697.com
voyagesify.com
ranodalei.com
culturao.com
littlepotato-id.com
integtiryhvacsanmateo.com
neatmounts.com
reddictnflstream.com
digistore-maya.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3784-124-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3784-125-0x000000000041F150-mapping.dmp formbook behavioral2/memory/2612-132-0x00000000005C0000-0x00000000005EF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
villarzx.exevillarzx.exewlanext.exedescription pid process target process PID 508 set thread context of 3784 508 villarzx.exe villarzx.exe PID 3784 set thread context of 3020 3784 villarzx.exe Explorer.EXE PID 2612 set thread context of 3020 2612 wlanext.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
villarzx.exevillarzx.exewlanext.exepid process 508 villarzx.exe 508 villarzx.exe 3784 villarzx.exe 3784 villarzx.exe 3784 villarzx.exe 3784 villarzx.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe 2612 wlanext.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3020 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
villarzx.exewlanext.exepid process 3784 villarzx.exe 3784 villarzx.exe 3784 villarzx.exe 2612 wlanext.exe 2612 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
villarzx.exevillarzx.exewlanext.exedescription pid process Token: SeDebugPrivilege 508 villarzx.exe Token: SeDebugPrivilege 3784 villarzx.exe Token: SeDebugPrivilege 2612 wlanext.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
villarzx.exeExplorer.EXEwlanext.exedescription pid process target process PID 508 wrote to memory of 3012 508 villarzx.exe villarzx.exe PID 508 wrote to memory of 3012 508 villarzx.exe villarzx.exe PID 508 wrote to memory of 3012 508 villarzx.exe villarzx.exe PID 508 wrote to memory of 3784 508 villarzx.exe villarzx.exe PID 508 wrote to memory of 3784 508 villarzx.exe villarzx.exe PID 508 wrote to memory of 3784 508 villarzx.exe villarzx.exe PID 508 wrote to memory of 3784 508 villarzx.exe villarzx.exe PID 508 wrote to memory of 3784 508 villarzx.exe villarzx.exe PID 508 wrote to memory of 3784 508 villarzx.exe villarzx.exe PID 3020 wrote to memory of 2612 3020 Explorer.EXE wlanext.exe PID 3020 wrote to memory of 2612 3020 Explorer.EXE wlanext.exe PID 3020 wrote to memory of 2612 3020 Explorer.EXE wlanext.exe PID 2612 wrote to memory of 4568 2612 wlanext.exe cmd.exe PID 2612 wrote to memory of 4568 2612 wlanext.exe cmd.exe PID 2612 wrote to memory of 4568 2612 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\villarzx.exe"C:\Users\Admin\AppData\Local\Temp\villarzx.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\villarzx.exe"C:\Users\Admin\AppData\Local\Temp\villarzx.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\villarzx.exe"C:\Users\Admin\AppData\Local\Temp\villarzx.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\villarzx.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/508-115-0x00000000008D0000-0x00000000008D1000-memory.dmpFilesize
4KB
-
memory/508-117-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/508-118-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/508-119-0x0000000005220000-0x0000000005221000-memory.dmpFilesize
4KB
-
memory/508-120-0x0000000005400000-0x0000000005407000-memory.dmpFilesize
28KB
-
memory/508-121-0x00000000050E0000-0x00000000055DE000-memory.dmpFilesize
5.0MB
-
memory/508-122-0x0000000005F00000-0x0000000005F01000-memory.dmpFilesize
4KB
-
memory/508-123-0x0000000005FA0000-0x0000000005FF0000-memory.dmpFilesize
320KB
-
memory/2612-131-0x0000000000C60000-0x0000000000C77000-memory.dmpFilesize
92KB
-
memory/2612-130-0x0000000000000000-mapping.dmp
-
memory/2612-132-0x00000000005C0000-0x00000000005EF000-memory.dmpFilesize
188KB
-
memory/2612-134-0x0000000002FC0000-0x00000000032E0000-memory.dmpFilesize
3.1MB
-
memory/2612-135-0x0000000002D20000-0x0000000002DB3000-memory.dmpFilesize
588KB
-
memory/3020-129-0x0000000005CA0000-0x0000000005DD5000-memory.dmpFilesize
1.2MB
-
memory/3020-136-0x00000000024E0000-0x00000000025D5000-memory.dmpFilesize
980KB
-
memory/3784-125-0x000000000041F150-mapping.dmp
-
memory/3784-128-0x0000000000FF0000-0x0000000001004000-memory.dmpFilesize
80KB
-
memory/3784-127-0x0000000001040000-0x0000000001360000-memory.dmpFilesize
3.1MB
-
memory/3784-124-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4568-133-0x0000000000000000-mapping.dmp