Analysis
-
max time kernel
121s -
max time network
136s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
30-10-2021 07:38
Static task
static1
Behavioral task
behavioral1
Sample
e4e70cbe4544ca19c27375301c98f929.exe
Resource
win7-en-20211014
General
-
Target
e4e70cbe4544ca19c27375301c98f929.exe
-
Size
413KB
-
MD5
e4e70cbe4544ca19c27375301c98f929
-
SHA1
5f2225968268a5e443ef5148fd4c457cd679efe1
-
SHA256
81ca6e69c74078c286b640b713714f3c8dd178bf231736919a01d653422fa5b5
-
SHA512
ff83bfa157f7ff9ea77d2b805f90194a171222bfaf44a2843343ec0f75bbf4d517f64aeb30f4e5761990dce3357aa4a8d8c086dffb47560af167964a604afba6
Malware Config
Extracted
formbook
4.1
mxwf
http://www.zahnimplantatangebotede.com/mxwf/
orders-cialis.info
auctionorbuy.com
meanmugsamore.com
yachtcrewmark.com
sacredkashilifestudio.net
themintyard.com
bragafoods.com
sierp.com
hausofdeme.com
anthonyjames915.com
bajardepesoencasa.com
marciaroyal.com
earringlifter.com
dsdjfhd9ddksa1as.info
bmzproekt.com
employmentbc.com
ptsdtreatment.space
vrchance.com
cnrongding.com
welovelit.com
intercourierdelivery.services
ianwhitewrite.com
afcerd.com
beneficiodemedicare.com
gatel3ess.com
salesnksportswt.top
thewellnessloft365.com
totensa.com
jessicatheisen.com
snowtographers.com
executrainpr.com
puttypaw.com
popcorntimeipad.com
heyconi.com
llanoresources.com
ibusinesshero.com
1euro1ad.com
sparkleeapp.com
zhuxiugyh.com
calvinmaphoto.com
bjmaomao.com
isaacfujiki.com
zipwhipper.com
kontrollstutzen.com
hannaheason.media
zgcbw.net
letteringdagabi.com
kitefabrics.com
andherieastoffices.com
thewellnesstravelcompany.info
ohio.works
beacharita.com
alphamillls.com
sassandvinegar.com
usauber.com
ceylonherbslk.com
richardggreenhill.com
groupdae.com
jupiterccc.com
indoovo.com
sunnytheodora.com
gxpgfz.com
shoppandaxpress.com
heiboard.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1784-124-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/1784-125-0x000000000041EBA0-mapping.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e4e70cbe4544ca19c27375301c98f929.exedescription pid process target process PID 3804 set thread context of 1784 3804 e4e70cbe4544ca19c27375301c98f929.exe e4e70cbe4544ca19c27375301c98f929.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
e4e70cbe4544ca19c27375301c98f929.exepid process 1784 e4e70cbe4544ca19c27375301c98f929.exe 1784 e4e70cbe4544ca19c27375301c98f929.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
e4e70cbe4544ca19c27375301c98f929.exedescription pid process target process PID 3804 wrote to memory of 1784 3804 e4e70cbe4544ca19c27375301c98f929.exe e4e70cbe4544ca19c27375301c98f929.exe PID 3804 wrote to memory of 1784 3804 e4e70cbe4544ca19c27375301c98f929.exe e4e70cbe4544ca19c27375301c98f929.exe PID 3804 wrote to memory of 1784 3804 e4e70cbe4544ca19c27375301c98f929.exe e4e70cbe4544ca19c27375301c98f929.exe PID 3804 wrote to memory of 1784 3804 e4e70cbe4544ca19c27375301c98f929.exe e4e70cbe4544ca19c27375301c98f929.exe PID 3804 wrote to memory of 1784 3804 e4e70cbe4544ca19c27375301c98f929.exe e4e70cbe4544ca19c27375301c98f929.exe PID 3804 wrote to memory of 1784 3804 e4e70cbe4544ca19c27375301c98f929.exe e4e70cbe4544ca19c27375301c98f929.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4e70cbe4544ca19c27375301c98f929.exe"C:\Users\Admin\AppData\Local\Temp\e4e70cbe4544ca19c27375301c98f929.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e4e70cbe4544ca19c27375301c98f929.exe"C:\Users\Admin\AppData\Local\Temp\e4e70cbe4544ca19c27375301c98f929.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1784-124-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1784-125-0x000000000041EBA0-mapping.dmp
-
memory/1784-126-0x0000000001020000-0x0000000001340000-memory.dmpFilesize
3.1MB
-
memory/3804-115-0x0000000000620000-0x0000000000621000-memory.dmpFilesize
4KB
-
memory/3804-117-0x00000000055F0000-0x00000000055F1000-memory.dmpFilesize
4KB
-
memory/3804-118-0x0000000004F10000-0x0000000004F11000-memory.dmpFilesize
4KB
-
memory/3804-119-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/3804-120-0x00000000050F0000-0x00000000055EE000-memory.dmpFilesize
5.0MB
-
memory/3804-121-0x00000000052B0000-0x00000000052B6000-memory.dmpFilesize
24KB
-
memory/3804-122-0x0000000006BC0000-0x0000000006BC1000-memory.dmpFilesize
4KB
-
memory/3804-123-0x0000000006B70000-0x0000000006BBF000-memory.dmpFilesize
316KB