Analysis
-
max time kernel
155s -
max time network
161s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-01-2022 14:04
Static task
static1
Behavioral task
behavioral1
Sample
H4vBtZsi8xAKaMm.exe
Resource
win7-en-20211208
General
-
Target
H4vBtZsi8xAKaMm.exe
-
Size
1.2MB
-
MD5
7eabab04e4a6fdd45238e32ed81e222c
-
SHA1
e0e1dc469746f5e2e049ea4a93d9b09a9227b342
-
SHA256
b79d2d02fe777cfd64723ad9b3935b30c00cbc75614fcadbf867cce88df4a8fd
-
SHA512
eeaa0f02a15a66b3363f94730ad3cf7c533a4bf303cfa0f53b21959a54dc0f65c50b1ac179aa5f992e3e17bbfaaa1b7393da3d1859ddd51932d36bdf0b7fa21b
Malware Config
Extracted
formbook
4.1
u1p5
yannickrast.com
shitcoin.team
mysweetelissa.com
tpnfrgm2wrld.xyz
freeclothesonline.com
rhoads-music.com
tanglewoodrx.com
sharkeycustoms.com
bonin-island.com
apeutah.com
metacehennem.xyz
deutscheno1.com
e-gate-io.store
hometoto.xyz
jojomove.com
vzn2aai2qj.icu
couponcodes6.com
pbcgotv.com
metarealtyhome.com
geymall.com
cassies.online
panasonicamazingdeals.com
elfontheshelef.com
knoxvillehomelistings.com
codotjonz.site
hokabrazil.com
vinewineltd.com
arcanefiretarot.com
ameustudio.com
missromeroli.com
emagrecerja.site
newsforindia.xyz
runcel.com
hornnbach.com
makemoneyquick.xyz
99468.xyz
anayahgrandmall.com
baskethabitualgoals.xyz
walkemboys.com
living---room.com
halkcigkofte.com
pm4rfg3i.xyz
ovivacious.com
studioaah.com
kailibianminwang.com
talleresjoyca.com
radiosharm.com
aardvanslooten.one
myscrappingkits.com
piertrafesa.com
soil-spot-ms.com
marymarinho.com
diasporagirl.com
cloud02-piggy.xyz
holywaterjewelry.com
policereportingsystems.com
agengrosirfashion.com
neseggidul.com
ymbdyktldh.biz
fizyoterapistmertsevinc.com
dasmonica.com
jovam.xyz
bettingweb365.com
doublecuttrails.com
verifyaxcx.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/852-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1804-70-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
H4vBtZsi8xAKaMm.exeMSBuild.execmstp.exedescription pid process target process PID 1332 set thread context of 852 1332 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 852 set thread context of 1224 852 MSBuild.exe Explorer.EXE PID 1804 set thread context of 1224 1804 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
MSBuild.execmstp.exepid process 852 MSBuild.exe 852 MSBuild.exe 1804 cmstp.exe 1804 cmstp.exe 1804 cmstp.exe 1804 cmstp.exe 1804 cmstp.exe 1804 cmstp.exe 1804 cmstp.exe 1804 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
MSBuild.execmstp.exepid process 852 MSBuild.exe 852 MSBuild.exe 852 MSBuild.exe 1804 cmstp.exe 1804 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
MSBuild.execmstp.exedescription pid process Token: SeDebugPrivilege 852 MSBuild.exe Token: SeDebugPrivilege 1804 cmstp.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1224 Explorer.EXE 1224 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1224 Explorer.EXE 1224 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
H4vBtZsi8xAKaMm.exeExplorer.EXEcmstp.exedescription pid process target process PID 1332 wrote to memory of 852 1332 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 1332 wrote to memory of 852 1332 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 1332 wrote to memory of 852 1332 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 1332 wrote to memory of 852 1332 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 1332 wrote to memory of 852 1332 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 1332 wrote to memory of 852 1332 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 1332 wrote to memory of 852 1332 H4vBtZsi8xAKaMm.exe MSBuild.exe PID 1224 wrote to memory of 1804 1224 Explorer.EXE cmstp.exe PID 1224 wrote to memory of 1804 1224 Explorer.EXE cmstp.exe PID 1224 wrote to memory of 1804 1224 Explorer.EXE cmstp.exe PID 1224 wrote to memory of 1804 1224 Explorer.EXE cmstp.exe PID 1224 wrote to memory of 1804 1224 Explorer.EXE cmstp.exe PID 1224 wrote to memory of 1804 1224 Explorer.EXE cmstp.exe PID 1224 wrote to memory of 1804 1224 Explorer.EXE cmstp.exe PID 1804 wrote to memory of 1968 1804 cmstp.exe cmd.exe PID 1804 wrote to memory of 1968 1804 cmstp.exe cmd.exe PID 1804 wrote to memory of 1968 1804 cmstp.exe cmd.exe PID 1804 wrote to memory of 1968 1804 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\H4vBtZsi8xAKaMm.exe"C:\Users\Admin\AppData\Local\Temp\H4vBtZsi8xAKaMm.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/852-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/852-65-0x00000000007D0000-0x0000000000CA3000-memory.dmpFilesize
4.8MB
-
memory/852-66-0x00000000001E0000-0x00000000001F4000-memory.dmpFilesize
80KB
-
memory/852-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/852-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1224-73-0x00000000050E0000-0x00000000051C5000-memory.dmpFilesize
916KB
-
memory/1224-67-0x0000000006710000-0x000000000682F000-memory.dmpFilesize
1.1MB
-
memory/1332-59-0x0000000005840000-0x00000000058C8000-memory.dmpFilesize
544KB
-
memory/1332-60-0x00000000008B0000-0x00000000008E4000-memory.dmpFilesize
208KB
-
memory/1332-55-0x0000000000900000-0x0000000000A44000-memory.dmpFilesize
1.3MB
-
memory/1332-58-0x0000000000300000-0x000000000030A000-memory.dmpFilesize
40KB
-
memory/1332-57-0x0000000000490000-0x00000000005B3000-memory.dmpFilesize
1.1MB
-
memory/1332-56-0x0000000075F91000-0x0000000075F93000-memory.dmpFilesize
8KB
-
memory/1804-69-0x0000000000EE0000-0x0000000000EF8000-memory.dmpFilesize
96KB
-
memory/1804-70-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/1804-71-0x0000000000A60000-0x0000000000D63000-memory.dmpFilesize
3.0MB
-
memory/1804-72-0x0000000000880000-0x0000000000913000-memory.dmpFilesize
588KB