Analysis
-
max time kernel
110s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
21-10-2021 19:48
Static task
static1
Behavioral task
behavioral1
Sample
664920ea617d6c5f15c228b7374aa15f.exe
Resource
win7-en-20210920
General
-
Target
664920ea617d6c5f15c228b7374aa15f.exe
-
Size
482KB
-
MD5
664920ea617d6c5f15c228b7374aa15f
-
SHA1
3cdf04f5f2d732f0a199151ff35af27a4cce12aa
-
SHA256
65acd8c73c518c97a1539bc8e3f62fb8f06431d7030c6cc1463c855aec0ec46f
-
SHA512
ba40b25f6f45b32001929a7da37b512a8d642e0b45ca19ff0dc2edadf82982b84f8b9a51c9781c30226ec6c05cb12bb50ef252f227cf8d790d390a26400c5462
Malware Config
Extracted
formbook
4.1
s18y
http://www.agentpathleurre.space/s18y/
jokes-online.com
dzzdjn.com
lizzieerhardtebnaryepptts.com
interfacehand.xyz
sale-m.site
block-facebook.com
dicasdamadrinha.com
maythewind.com
hasari.net
omnists.com
thevalley-eg.com
rdfj.xyz
szhfcy.com
alkalineage.club
fdf.xyz
absorplus.com
poldolongo.com
badassshirts.club
ferienwohnungenmv.com
bilboondokoak.com
ambrosiaaudio.com
lifeneurologyclub.com
femboys.world
blehmails.com
gametimebg.com
duytienauto.net
owerful.com
amedicalsupplyco.com
americonnlogistics.com
ateamautoglassga.com
clickstool.com
fzdzcnj.com
txtgo.xyz
izassist.com
3bangzhu.com
myesstyle.com
aek181129aek.xyz
daoxinghumaotest.com
jxdg.xyz
restorationculturecon.com
thenaturalnutrient.com
sportsandgames.info
spiderwebinar.net
erqgseidx.com
donutmastermind.com
aidatislemleri-govtr.com
weetsist.com
sunsetschoolportaits.com
exodusguarant.tech
gsnbls.top
huangdashi33.xyz
amazonretoure.net
greathomeinlakewood.com
lenovoidc.com
qiuhenglawfirm.com
surveyorslimited.com
carterscts.com
helmosy.online
bakersfieldlaughingstock.com
as-payjrku.icu
mr-exclusive.com
givepy.info
ifvita.com
obesocarpinteria.online
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/68-124-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/68-125-0x000000000041F120-mapping.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
664920ea617d6c5f15c228b7374aa15f.exedescription pid process target process PID 1172 set thread context of 68 1172 664920ea617d6c5f15c228b7374aa15f.exe 664920ea617d6c5f15c228b7374aa15f.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
664920ea617d6c5f15c228b7374aa15f.exepid process 68 664920ea617d6c5f15c228b7374aa15f.exe 68 664920ea617d6c5f15c228b7374aa15f.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
664920ea617d6c5f15c228b7374aa15f.exedescription pid process target process PID 1172 wrote to memory of 68 1172 664920ea617d6c5f15c228b7374aa15f.exe 664920ea617d6c5f15c228b7374aa15f.exe PID 1172 wrote to memory of 68 1172 664920ea617d6c5f15c228b7374aa15f.exe 664920ea617d6c5f15c228b7374aa15f.exe PID 1172 wrote to memory of 68 1172 664920ea617d6c5f15c228b7374aa15f.exe 664920ea617d6c5f15c228b7374aa15f.exe PID 1172 wrote to memory of 68 1172 664920ea617d6c5f15c228b7374aa15f.exe 664920ea617d6c5f15c228b7374aa15f.exe PID 1172 wrote to memory of 68 1172 664920ea617d6c5f15c228b7374aa15f.exe 664920ea617d6c5f15c228b7374aa15f.exe PID 1172 wrote to memory of 68 1172 664920ea617d6c5f15c228b7374aa15f.exe 664920ea617d6c5f15c228b7374aa15f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\664920ea617d6c5f15c228b7374aa15f.exe"C:\Users\Admin\AppData\Local\Temp\664920ea617d6c5f15c228b7374aa15f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\664920ea617d6c5f15c228b7374aa15f.exe"C:\Users\Admin\AppData\Local\Temp\664920ea617d6c5f15c228b7374aa15f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/68-124-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/68-125-0x000000000041F120-mapping.dmp
-
memory/68-126-0x00000000014B0000-0x00000000017D0000-memory.dmpFilesize
3.1MB
-
memory/1172-115-0x0000000000350000-0x0000000000351000-memory.dmpFilesize
4KB
-
memory/1172-117-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/1172-118-0x0000000004C40000-0x0000000004C41000-memory.dmpFilesize
4KB
-
memory/1172-119-0x0000000004C00000-0x0000000004C01000-memory.dmpFilesize
4KB
-
memory/1172-120-0x0000000004D40000-0x000000000523E000-memory.dmpFilesize
5.0MB
-
memory/1172-121-0x0000000004C30000-0x0000000004C37000-memory.dmpFilesize
28KB
-
memory/1172-122-0x00000000059E0000-0x00000000059E1000-memory.dmpFilesize
4KB
-
memory/1172-123-0x00000000051F0000-0x0000000005240000-memory.dmpFilesize
320KB