Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
21-10-2021 19:48
Static task
static1
Behavioral task
behavioral1
Sample
664920ea617d6c5f15c228b7374aa15f.exe
Resource
win7-en-20210920
General
-
Target
664920ea617d6c5f15c228b7374aa15f.exe
-
Size
482KB
-
MD5
664920ea617d6c5f15c228b7374aa15f
-
SHA1
3cdf04f5f2d732f0a199151ff35af27a4cce12aa
-
SHA256
65acd8c73c518c97a1539bc8e3f62fb8f06431d7030c6cc1463c855aec0ec46f
-
SHA512
ba40b25f6f45b32001929a7da37b512a8d642e0b45ca19ff0dc2edadf82982b84f8b9a51c9781c30226ec6c05cb12bb50ef252f227cf8d790d390a26400c5462
Malware Config
Extracted
formbook
4.1
s18y
http://www.agentpathleurre.space/s18y/
jokes-online.com
dzzdjn.com
lizzieerhardtebnaryepptts.com
interfacehand.xyz
sale-m.site
block-facebook.com
dicasdamadrinha.com
maythewind.com
hasari.net
omnists.com
thevalley-eg.com
rdfj.xyz
szhfcy.com
alkalineage.club
fdf.xyz
absorplus.com
poldolongo.com
badassshirts.club
ferienwohnungenmv.com
bilboondokoak.com
ambrosiaaudio.com
lifeneurologyclub.com
femboys.world
blehmails.com
gametimebg.com
duytienauto.net
owerful.com
amedicalsupplyco.com
americonnlogistics.com
ateamautoglassga.com
clickstool.com
fzdzcnj.com
txtgo.xyz
izassist.com
3bangzhu.com
myesstyle.com
aek181129aek.xyz
daoxinghumaotest.com
jxdg.xyz
restorationculturecon.com
thenaturalnutrient.com
sportsandgames.info
spiderwebinar.net
erqgseidx.com
donutmastermind.com
aidatislemleri-govtr.com
weetsist.com
sunsetschoolportaits.com
exodusguarant.tech
gsnbls.top
huangdashi33.xyz
amazonretoure.net
greathomeinlakewood.com
lenovoidc.com
qiuhenglawfirm.com
surveyorslimited.com
carterscts.com
helmosy.online
bakersfieldlaughingstock.com
as-payjrku.icu
mr-exclusive.com
givepy.info
ifvita.com
obesocarpinteria.online
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1308-62-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1308-63-0x000000000041F120-mapping.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
664920ea617d6c5f15c228b7374aa15f.exedescription pid process target process PID 612 set thread context of 1308 612 664920ea617d6c5f15c228b7374aa15f.exe 664920ea617d6c5f15c228b7374aa15f.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
664920ea617d6c5f15c228b7374aa15f.exepid process 1308 664920ea617d6c5f15c228b7374aa15f.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
664920ea617d6c5f15c228b7374aa15f.exedescription pid process target process PID 612 wrote to memory of 1308 612 664920ea617d6c5f15c228b7374aa15f.exe 664920ea617d6c5f15c228b7374aa15f.exe PID 612 wrote to memory of 1308 612 664920ea617d6c5f15c228b7374aa15f.exe 664920ea617d6c5f15c228b7374aa15f.exe PID 612 wrote to memory of 1308 612 664920ea617d6c5f15c228b7374aa15f.exe 664920ea617d6c5f15c228b7374aa15f.exe PID 612 wrote to memory of 1308 612 664920ea617d6c5f15c228b7374aa15f.exe 664920ea617d6c5f15c228b7374aa15f.exe PID 612 wrote to memory of 1308 612 664920ea617d6c5f15c228b7374aa15f.exe 664920ea617d6c5f15c228b7374aa15f.exe PID 612 wrote to memory of 1308 612 664920ea617d6c5f15c228b7374aa15f.exe 664920ea617d6c5f15c228b7374aa15f.exe PID 612 wrote to memory of 1308 612 664920ea617d6c5f15c228b7374aa15f.exe 664920ea617d6c5f15c228b7374aa15f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\664920ea617d6c5f15c228b7374aa15f.exe"C:\Users\Admin\AppData\Local\Temp\664920ea617d6c5f15c228b7374aa15f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\664920ea617d6c5f15c228b7374aa15f.exe"C:\Users\Admin\AppData\Local\Temp\664920ea617d6c5f15c228b7374aa15f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/612-54-0x0000000001020000-0x0000000001021000-memory.dmpFilesize
4KB
-
memory/612-56-0x0000000075821000-0x0000000075823000-memory.dmpFilesize
8KB
-
memory/612-57-0x0000000000620000-0x0000000000627000-memory.dmpFilesize
28KB
-
memory/612-58-0x0000000004F00000-0x0000000004F01000-memory.dmpFilesize
4KB
-
memory/612-59-0x0000000000E20000-0x0000000000E70000-memory.dmpFilesize
320KB
-
memory/1308-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1308-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1308-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1308-63-0x000000000041F120-mapping.dmp
-
memory/1308-64-0x0000000000900000-0x0000000000C03000-memory.dmpFilesize
3.0MB