Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
22-10-2021 09:13
Static task
static1
Behavioral task
behavioral1
Sample
80838b2b8dd2a2b48b619b2eb7788138.exe
Resource
win7-en-20210920
General
-
Target
80838b2b8dd2a2b48b619b2eb7788138.exe
-
Size
508KB
-
MD5
80838b2b8dd2a2b48b619b2eb7788138
-
SHA1
d3c6a2dc3835768d4e103ddd34bdf016bb34a7ee
-
SHA256
2486c4ebc2834ad7e9517107e7d7813fa1b84d5b2df4f928a0144b81d1273e8c
-
SHA512
f33e9f6b06faa6f44f04c64c66b3c88d406b31d3514b2243f5aa7c1d5b9dcc257d07a0fd9118f8f729a043f371f7e44c385f62fdac1767846a48e151cd0c5f3e
Malware Config
Extracted
formbook
4.1
mxwf
http://www.zahnimplantatangebotede.com/mxwf/
orders-cialis.info
auctionorbuy.com
meanmugsamore.com
yachtcrewmark.com
sacredkashilifestudio.net
themintyard.com
bragafoods.com
sierp.com
hausofdeme.com
anthonyjames915.com
bajardepesoencasa.com
marciaroyal.com
earringlifter.com
dsdjfhd9ddksa1as.info
bmzproekt.com
employmentbc.com
ptsdtreatment.space
vrchance.com
cnrongding.com
welovelit.com
intercourierdelivery.services
ianwhitewrite.com
afcerd.com
beneficiodemedicare.com
gatel3ess.com
salesnksportswt.top
thewellnessloft365.com
totensa.com
jessicatheisen.com
snowtographers.com
executrainpr.com
puttypaw.com
popcorntimeipad.com
heyconi.com
llanoresources.com
ibusinesshero.com
1euro1ad.com
sparkleeapp.com
zhuxiugyh.com
calvinmaphoto.com
bjmaomao.com
isaacfujiki.com
zipwhipper.com
kontrollstutzen.com
hannaheason.media
zgcbw.net
letteringdagabi.com
kitefabrics.com
andherieastoffices.com
thewellnesstravelcompany.info
ohio.works
beacharita.com
alphamillls.com
sassandvinegar.com
usauber.com
ceylonherbslk.com
richardggreenhill.com
groupdae.com
jupiterccc.com
indoovo.com
sunnytheodora.com
gxpgfz.com
shoppandaxpress.com
heiboard.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/676-124-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/676-125-0x000000000041EBA0-mapping.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
80838b2b8dd2a2b48b619b2eb7788138.exedescription pid process target process PID 2460 set thread context of 676 2460 80838b2b8dd2a2b48b619b2eb7788138.exe 80838b2b8dd2a2b48b619b2eb7788138.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
80838b2b8dd2a2b48b619b2eb7788138.exepid process 676 80838b2b8dd2a2b48b619b2eb7788138.exe 676 80838b2b8dd2a2b48b619b2eb7788138.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
80838b2b8dd2a2b48b619b2eb7788138.exedescription pid process target process PID 2460 wrote to memory of 676 2460 80838b2b8dd2a2b48b619b2eb7788138.exe 80838b2b8dd2a2b48b619b2eb7788138.exe PID 2460 wrote to memory of 676 2460 80838b2b8dd2a2b48b619b2eb7788138.exe 80838b2b8dd2a2b48b619b2eb7788138.exe PID 2460 wrote to memory of 676 2460 80838b2b8dd2a2b48b619b2eb7788138.exe 80838b2b8dd2a2b48b619b2eb7788138.exe PID 2460 wrote to memory of 676 2460 80838b2b8dd2a2b48b619b2eb7788138.exe 80838b2b8dd2a2b48b619b2eb7788138.exe PID 2460 wrote to memory of 676 2460 80838b2b8dd2a2b48b619b2eb7788138.exe 80838b2b8dd2a2b48b619b2eb7788138.exe PID 2460 wrote to memory of 676 2460 80838b2b8dd2a2b48b619b2eb7788138.exe 80838b2b8dd2a2b48b619b2eb7788138.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\80838b2b8dd2a2b48b619b2eb7788138.exe"C:\Users\Admin\AppData\Local\Temp\80838b2b8dd2a2b48b619b2eb7788138.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\80838b2b8dd2a2b48b619b2eb7788138.exe"C:\Users\Admin\AppData\Local\Temp\80838b2b8dd2a2b48b619b2eb7788138.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/676-124-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/676-125-0x000000000041EBA0-mapping.dmp
-
memory/676-126-0x0000000001700000-0x0000000001A20000-memory.dmpFilesize
3.1MB
-
memory/2460-115-0x0000000000E60000-0x0000000000E61000-memory.dmpFilesize
4KB
-
memory/2460-117-0x0000000005D90000-0x0000000005D91000-memory.dmpFilesize
4KB
-
memory/2460-118-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/2460-119-0x0000000005890000-0x0000000005D8E000-memory.dmpFilesize
5.0MB
-
memory/2460-120-0x0000000005720000-0x0000000005721000-memory.dmpFilesize
4KB
-
memory/2460-121-0x0000000006510000-0x0000000006517000-memory.dmpFilesize
28KB
-
memory/2460-122-0x0000000009440000-0x0000000009441000-memory.dmpFilesize
4KB
-
memory/2460-123-0x00000000093F0000-0x000000000943F000-memory.dmpFilesize
316KB