Analysis
-
max time kernel
122s -
max time network
124s -
submitted
01-01-1970 00:00
Static task
static1
Behavioral task
behavioral1
Sample
15a4b8c6607b8e67b0bba2d1b5dbd43e.exe
Resource
win7-en-20210920
General
-
Target
15a4b8c6607b8e67b0bba2d1b5dbd43e.exe
-
Size
508KB
-
MD5
15a4b8c6607b8e67b0bba2d1b5dbd43e
-
SHA1
c77c0417b07c25c0e567f0d0362a8a80fc7c40e9
-
SHA256
c4b1789371d832969f812bd0a577e380cdac00db6775d7fc251adf8d92c15d74
-
SHA512
b168504f30e0714a8d2ec0eb79a9d49b5c1f84399ac0ee091fe9b4983e9ed77b9fd70398a6c2644b3295f777d3d9b84422f76897e722df579a1ef1dd66d8704c
Malware Config
Extracted
formbook
4.1
mxwf
http://www.zahnimplantatangebotede.com/mxwf/
orders-cialis.info
auctionorbuy.com
meanmugsamore.com
yachtcrewmark.com
sacredkashilifestudio.net
themintyard.com
bragafoods.com
sierp.com
hausofdeme.com
anthonyjames915.com
bajardepesoencasa.com
marciaroyal.com
earringlifter.com
dsdjfhd9ddksa1as.info
bmzproekt.com
employmentbc.com
ptsdtreatment.space
vrchance.com
cnrongding.com
welovelit.com
intercourierdelivery.services
ianwhitewrite.com
afcerd.com
beneficiodemedicare.com
gatel3ess.com
salesnksportswt.top
thewellnessloft365.com
totensa.com
jessicatheisen.com
snowtographers.com
executrainpr.com
puttypaw.com
popcorntimeipad.com
heyconi.com
llanoresources.com
ibusinesshero.com
1euro1ad.com
sparkleeapp.com
zhuxiugyh.com
calvinmaphoto.com
bjmaomao.com
isaacfujiki.com
zipwhipper.com
kontrollstutzen.com
hannaheason.media
zgcbw.net
letteringdagabi.com
kitefabrics.com
andherieastoffices.com
thewellnesstravelcompany.info
ohio.works
beacharita.com
alphamillls.com
sassandvinegar.com
usauber.com
ceylonherbslk.com
richardggreenhill.com
groupdae.com
jupiterccc.com
indoovo.com
sunnytheodora.com
gxpgfz.com
shoppandaxpress.com
heiboard.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3936-124-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3936-125-0x000000000041EBA0-mapping.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
15a4b8c6607b8e67b0bba2d1b5dbd43e.exedescription pid process target process PID 2756 set thread context of 3936 2756 15a4b8c6607b8e67b0bba2d1b5dbd43e.exe 15a4b8c6607b8e67b0bba2d1b5dbd43e.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
15a4b8c6607b8e67b0bba2d1b5dbd43e.exepid process 3936 15a4b8c6607b8e67b0bba2d1b5dbd43e.exe 3936 15a4b8c6607b8e67b0bba2d1b5dbd43e.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
15a4b8c6607b8e67b0bba2d1b5dbd43e.exedescription pid process target process PID 2756 wrote to memory of 3936 2756 15a4b8c6607b8e67b0bba2d1b5dbd43e.exe 15a4b8c6607b8e67b0bba2d1b5dbd43e.exe PID 2756 wrote to memory of 3936 2756 15a4b8c6607b8e67b0bba2d1b5dbd43e.exe 15a4b8c6607b8e67b0bba2d1b5dbd43e.exe PID 2756 wrote to memory of 3936 2756 15a4b8c6607b8e67b0bba2d1b5dbd43e.exe 15a4b8c6607b8e67b0bba2d1b5dbd43e.exe PID 2756 wrote to memory of 3936 2756 15a4b8c6607b8e67b0bba2d1b5dbd43e.exe 15a4b8c6607b8e67b0bba2d1b5dbd43e.exe PID 2756 wrote to memory of 3936 2756 15a4b8c6607b8e67b0bba2d1b5dbd43e.exe 15a4b8c6607b8e67b0bba2d1b5dbd43e.exe PID 2756 wrote to memory of 3936 2756 15a4b8c6607b8e67b0bba2d1b5dbd43e.exe 15a4b8c6607b8e67b0bba2d1b5dbd43e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\15a4b8c6607b8e67b0bba2d1b5dbd43e.exe"C:\Users\Admin\AppData\Local\Temp\15a4b8c6607b8e67b0bba2d1b5dbd43e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\15a4b8c6607b8e67b0bba2d1b5dbd43e.exe"C:\Users\Admin\AppData\Local\Temp\15a4b8c6607b8e67b0bba2d1b5dbd43e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2756-115-0x0000000000740000-0x0000000000741000-memory.dmpFilesize
4KB
-
memory/2756-117-0x00000000056A0000-0x00000000056A1000-memory.dmpFilesize
4KB
-
memory/2756-118-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/2756-119-0x00000000051A0000-0x000000000569E000-memory.dmpFilesize
5.0MB
-
memory/2756-120-0x0000000004FF0000-0x0000000004FF1000-memory.dmpFilesize
4KB
-
memory/2756-121-0x0000000005260000-0x0000000005266000-memory.dmpFilesize
24KB
-
memory/2756-122-0x0000000005DA0000-0x0000000005DA1000-memory.dmpFilesize
4KB
-
memory/2756-123-0x0000000005640000-0x000000000568F000-memory.dmpFilesize
316KB
-
memory/3936-124-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3936-125-0x000000000041EBA0-mapping.dmp
-
memory/3936-126-0x0000000001330000-0x0000000001650000-memory.dmpFilesize
3.1MB