Analysis
-
max time kernel
118s -
max time network
130s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
27-01-2022 13:52
Static task
static1
Behavioral task
behavioral1
Sample
30960d3f020c7f741a8ef2a0dc78013c.exe
Resource
win7-en-20211208
General
-
Target
30960d3f020c7f741a8ef2a0dc78013c.exe
-
Size
400KB
-
MD5
30960d3f020c7f741a8ef2a0dc78013c
-
SHA1
e7365401cedd20b086cdb9030238baf130edb0bb
-
SHA256
459238db7010365ad248cd0c1afa4947a39bf34b47927dd9ea6e77056979842a
-
SHA512
beb0475cc8bef1cb9ecc5917f4ac26610de0dcfb46560aa8a7557d6d505bbc5173f2a59798f80775c90f27b65b911ecbbe5100248c64300c106d423ebcad1198
Malware Config
Extracted
formbook
4.1
cw22
betvoy206.com
nftstoners.com
tirupatibuilder.com
gulldesigns.com
shemhq.com
boricosmetic.com
bitcoinbillionaireboy.com
theflypaperplanes.com
retrocartours.com
yangzhie326.com
cheepchain.com
sentryr.com
luckirentalhomes.com
pointssquashers.com
dianasarabiantreasures.com
calendarsilo.com
sublike21.xyz
gajubg0up.xyz
lousfoodreviews.com
fades.site
276a.xyz
chopkingstamp.com
parcelfrance.com
lcntrust.com
aeeg-austria.com
trogen24.net
widepeepohappy.xyz
hogekortingen.com
trump-is-right.net
legacyfarmsgeorgia.com
dingbuzhule.com
teckelgruppe-raben.com
qianshuhua.com
onsdia.xyz
sectorquant.com
automatenstudent.com
bathkithcenandtile.com
lasvegasphonerepairs.com
riselsat.com
myvafterdark.com
whispersystems.net
technicolorday.com
renetextile.xyz
cchcolo.com
professorjoshi.com
capybarashop.com
alfredoreyessci.com
w124blog.com
vdsdev77.com
helloentepriseg1.com
denlab.net
triviamillionairewin.com
jelofly.com
09m370uz.xyz
reple-top2.com
riosgames.xyz
teaberryadvisors.com
satgerv.online
galenika.net
landspeedlogistics.com
familiesgivinghope.com
moisuhop-channel.xyz
chambres-d-hotes-marrakech.com
realizefinanceirorennerr.com
playthemove.info
Signatures
-
Formbook Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/784-62-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
30960d3f020c7f741a8ef2a0dc78013c.exedescription pid process target process PID 1316 set thread context of 784 1316 30960d3f020c7f741a8ef2a0dc78013c.exe 30960d3f020c7f741a8ef2a0dc78013c.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
30960d3f020c7f741a8ef2a0dc78013c.exepid process 784 30960d3f020c7f741a8ef2a0dc78013c.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
30960d3f020c7f741a8ef2a0dc78013c.exedescription pid process target process PID 1316 wrote to memory of 784 1316 30960d3f020c7f741a8ef2a0dc78013c.exe 30960d3f020c7f741a8ef2a0dc78013c.exe PID 1316 wrote to memory of 784 1316 30960d3f020c7f741a8ef2a0dc78013c.exe 30960d3f020c7f741a8ef2a0dc78013c.exe PID 1316 wrote to memory of 784 1316 30960d3f020c7f741a8ef2a0dc78013c.exe 30960d3f020c7f741a8ef2a0dc78013c.exe PID 1316 wrote to memory of 784 1316 30960d3f020c7f741a8ef2a0dc78013c.exe 30960d3f020c7f741a8ef2a0dc78013c.exe PID 1316 wrote to memory of 784 1316 30960d3f020c7f741a8ef2a0dc78013c.exe 30960d3f020c7f741a8ef2a0dc78013c.exe PID 1316 wrote to memory of 784 1316 30960d3f020c7f741a8ef2a0dc78013c.exe 30960d3f020c7f741a8ef2a0dc78013c.exe PID 1316 wrote to memory of 784 1316 30960d3f020c7f741a8ef2a0dc78013c.exe 30960d3f020c7f741a8ef2a0dc78013c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\30960d3f020c7f741a8ef2a0dc78013c.exe"C:\Users\Admin\AppData\Local\Temp\30960d3f020c7f741a8ef2a0dc78013c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\30960d3f020c7f741a8ef2a0dc78013c.exe"C:\Users\Admin\AppData\Local\Temp\30960d3f020c7f741a8ef2a0dc78013c.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/784-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/784-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/784-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1316-55-0x00000000011D0000-0x000000000123A000-memory.dmpFilesize
424KB
-
memory/1316-56-0x0000000074B21000-0x0000000074B23000-memory.dmpFilesize
8KB
-
memory/1316-57-0x0000000004F20000-0x0000000004F21000-memory.dmpFilesize
4KB
-
memory/1316-58-0x0000000000600000-0x000000000060C000-memory.dmpFilesize
48KB
-
memory/1316-59-0x0000000005270000-0x00000000052DA000-memory.dmpFilesize
424KB