Analysis
-
max time kernel
194s -
max time network
204s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 14:04
Static task
static1
Behavioral task
behavioral1
Sample
H4vBtZsi8xAKaMm.exe
Resource
win7-en-20211208
General
-
Target
H4vBtZsi8xAKaMm.exe
-
Size
1.2MB
-
MD5
7eabab04e4a6fdd45238e32ed81e222c
-
SHA1
e0e1dc469746f5e2e049ea4a93d9b09a9227b342
-
SHA256
b79d2d02fe777cfd64723ad9b3935b30c00cbc75614fcadbf867cce88df4a8fd
-
SHA512
eeaa0f02a15a66b3363f94730ad3cf7c533a4bf303cfa0f53b21959a54dc0f65c50b1ac179aa5f992e3e17bbfaaa1b7393da3d1859ddd51932d36bdf0b7fa21b
Malware Config
Extracted
formbook
4.1
u1p5
yannickrast.com
shitcoin.team
mysweetelissa.com
tpnfrgm2wrld.xyz
freeclothesonline.com
rhoads-music.com
tanglewoodrx.com
sharkeycustoms.com
bonin-island.com
apeutah.com
metacehennem.xyz
deutscheno1.com
e-gate-io.store
hometoto.xyz
jojomove.com
vzn2aai2qj.icu
couponcodes6.com
pbcgotv.com
metarealtyhome.com
geymall.com
cassies.online
panasonicamazingdeals.com
elfontheshelef.com
knoxvillehomelistings.com
codotjonz.site
hokabrazil.com
vinewineltd.com
arcanefiretarot.com
ameustudio.com
missromeroli.com
emagrecerja.site
newsforindia.xyz
runcel.com
hornnbach.com
makemoneyquick.xyz
99468.xyz
anayahgrandmall.com
baskethabitualgoals.xyz
walkemboys.com
living---room.com
halkcigkofte.com
pm4rfg3i.xyz
ovivacious.com
studioaah.com
kailibianminwang.com
talleresjoyca.com
radiosharm.com
aardvanslooten.one
myscrappingkits.com
piertrafesa.com
soil-spot-ms.com
marymarinho.com
diasporagirl.com
cloud02-piggy.xyz
holywaterjewelry.com
policereportingsystems.com
agengrosirfashion.com
neseggidul.com
ymbdyktldh.biz
fizyoterapistmertsevinc.com
dasmonica.com
jovam.xyz
bettingweb365.com
doublecuttrails.com
verifyaxcx.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/932-128-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/932-131-0x0000000000B00000-0x0000000000C4A000-memory.dmp formbook behavioral2/memory/2648-134-0x0000000003080000-0x00000000030AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
H4vBtZsi8xAKaMm.exeMSBuild.exenetsh.exedescription pid process target process PID 2352 set thread context of 932 2352 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 932 set thread context of 2084 932 MSBuild.exe Explorer.EXE PID 2648 set thread context of 2084 2648 netsh.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
H4vBtZsi8xAKaMm.exeMSBuild.exenetsh.exepid process 2352 H4vBtZsi8xAKaMm.exe 2352 H4vBtZsi8xAKaMm.exe 2352 H4vBtZsi8xAKaMm.exe 932 MSBuild.exe 932 MSBuild.exe 932 MSBuild.exe 932 MSBuild.exe 2648 netsh.exe 2648 netsh.exe 2648 netsh.exe 2648 netsh.exe 2648 netsh.exe 2648 netsh.exe 2648 netsh.exe 2648 netsh.exe 2648 netsh.exe 2648 netsh.exe 2648 netsh.exe 2648 netsh.exe 2648 netsh.exe 2648 netsh.exe 2648 netsh.exe 2648 netsh.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
MSBuild.exenetsh.exepid process 932 MSBuild.exe 932 MSBuild.exe 932 MSBuild.exe 2648 netsh.exe 2648 netsh.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
H4vBtZsi8xAKaMm.exeMSBuild.exenetsh.exedescription pid process Token: SeDebugPrivilege 2352 H4vBtZsi8xAKaMm.exe Token: SeDebugPrivilege 932 MSBuild.exe Token: SeDebugPrivilege 2648 netsh.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
H4vBtZsi8xAKaMm.exeExplorer.EXEnetsh.exedescription pid process target process PID 2352 wrote to memory of 1108 2352 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 2352 wrote to memory of 1108 2352 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 2352 wrote to memory of 1108 2352 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 2352 wrote to memory of 932 2352 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 2352 wrote to memory of 932 2352 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 2352 wrote to memory of 932 2352 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 2352 wrote to memory of 932 2352 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 2352 wrote to memory of 932 2352 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 2352 wrote to memory of 932 2352 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 2084 wrote to memory of 2648 2084 Explorer.EXE netsh.exe PID 2084 wrote to memory of 2648 2084 Explorer.EXE netsh.exe PID 2084 wrote to memory of 2648 2084 Explorer.EXE netsh.exe PID 2648 wrote to memory of 2576 2648 netsh.exe cmd.exe PID 2648 wrote to memory of 2576 2648 netsh.exe cmd.exe PID 2648 wrote to memory of 2576 2648 netsh.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\H4vBtZsi8xAKaMm.exe"C:\Users\Admin\AppData\Local\Temp\H4vBtZsi8xAKaMm.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/932-128-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/932-131-0x0000000000B00000-0x0000000000C4A000-memory.dmpFilesize
1.3MB
-
memory/932-130-0x0000000001080000-0x00000000013A0000-memory.dmpFilesize
3.1MB
-
memory/2084-137-0x0000000002770000-0x00000000028B5000-memory.dmpFilesize
1.3MB
-
memory/2084-132-0x0000000002650000-0x000000000276E000-memory.dmpFilesize
1.1MB
-
memory/2352-122-0x0000000002800000-0x000000000289C000-memory.dmpFilesize
624KB
-
memory/2352-121-0x0000000004F10000-0x0000000004FA2000-memory.dmpFilesize
584KB
-
memory/2352-125-0x00000000053C0000-0x00000000053CA000-memory.dmpFilesize
40KB
-
memory/2352-126-0x0000000000DB0000-0x0000000000E38000-memory.dmpFilesize
544KB
-
memory/2352-127-0x0000000005B30000-0x0000000005B64000-memory.dmpFilesize
208KB
-
memory/2352-123-0x0000000002900000-0x000000000290A000-memory.dmpFilesize
40KB
-
memory/2352-118-0x0000000000330000-0x0000000000474000-memory.dmpFilesize
1.3MB
-
memory/2352-124-0x0000000005350000-0x00000000053A6000-memory.dmpFilesize
344KB
-
memory/2352-120-0x0000000005530000-0x0000000005A2E000-memory.dmpFilesize
5.0MB
-
memory/2352-119-0x0000000004E70000-0x0000000004F0C000-memory.dmpFilesize
624KB
-
memory/2648-134-0x0000000003080000-0x00000000030AF000-memory.dmpFilesize
188KB
-
memory/2648-135-0x0000000003BE0000-0x0000000003F00000-memory.dmpFilesize
3.1MB
-
memory/2648-136-0x00000000038A0000-0x0000000003A36000-memory.dmpFilesize
1.6MB
-
memory/2648-133-0x0000000001050000-0x000000000106E000-memory.dmpFilesize
120KB