Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
31-01-2022 12:19
Static task
static1
Behavioral task
behavioral1
Sample
3dd400266e418778615ef84a247687d1.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
3dd400266e418778615ef84a247687d1.exe
Resource
win10v2004-en-20220113
General
-
Target
3dd400266e418778615ef84a247687d1.exe
-
Size
514KB
-
MD5
3dd400266e418778615ef84a247687d1
-
SHA1
995b055ae2eb4f7ed8dd0d603cc3690a2bbe5c3c
-
SHA256
da00ad76bb648365108fb03a95cf69a56608e4605cfe02fcaf933af239ce7ac2
-
SHA512
8a202b59dc234c35a4538c2040ba3b2855df073ef3f32ce06fa7f784f22971362a4efd98ff2a41cb7a3b77ad6f6c840b00fcc55f8662ab10d9edf3d38d8bc16e
Malware Config
Extracted
formbook
4.1
cw22
betvoy206.com
nftstoners.com
tirupatibuilder.com
gulldesigns.com
shemhq.com
boricosmetic.com
bitcoinbillionaireboy.com
theflypaperplanes.com
retrocartours.com
yangzhie326.com
cheepchain.com
sentryr.com
luckirentalhomes.com
pointssquashers.com
dianasarabiantreasures.com
calendarsilo.com
sublike21.xyz
gajubg0up.xyz
lousfoodreviews.com
fades.site
276a.xyz
chopkingstamp.com
parcelfrance.com
lcntrust.com
aeeg-austria.com
trogen24.net
widepeepohappy.xyz
hogekortingen.com
trump-is-right.net
legacyfarmsgeorgia.com
dingbuzhule.com
teckelgruppe-raben.com
qianshuhua.com
onsdia.xyz
sectorquant.com
automatenstudent.com
bathkithcenandtile.com
lasvegasphonerepairs.com
riselsat.com
myvafterdark.com
whispersystems.net
technicolorday.com
renetextile.xyz
cchcolo.com
professorjoshi.com
capybarashop.com
alfredoreyessci.com
w124blog.com
vdsdev77.com
helloentepriseg1.com
denlab.net
triviamillionairewin.com
jelofly.com
09m370uz.xyz
reple-top2.com
riosgames.xyz
teaberryadvisors.com
satgerv.online
galenika.net
landspeedlogistics.com
familiesgivinghope.com
moisuhop-channel.xyz
chambres-d-hotes-marrakech.com
realizefinanceirorennerr.com
playthemove.info
Signatures
-
Formbook Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/384-61-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3dd400266e418778615ef84a247687d1.exedescription pid process target process PID 1680 set thread context of 384 1680 3dd400266e418778615ef84a247687d1.exe 3dd400266e418778615ef84a247687d1.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
3dd400266e418778615ef84a247687d1.exe3dd400266e418778615ef84a247687d1.exepid process 1680 3dd400266e418778615ef84a247687d1.exe 1680 3dd400266e418778615ef84a247687d1.exe 1680 3dd400266e418778615ef84a247687d1.exe 384 3dd400266e418778615ef84a247687d1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3dd400266e418778615ef84a247687d1.exedescription pid process Token: SeDebugPrivilege 1680 3dd400266e418778615ef84a247687d1.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
3dd400266e418778615ef84a247687d1.exedescription pid process target process PID 1680 wrote to memory of 848 1680 3dd400266e418778615ef84a247687d1.exe 3dd400266e418778615ef84a247687d1.exe PID 1680 wrote to memory of 848 1680 3dd400266e418778615ef84a247687d1.exe 3dd400266e418778615ef84a247687d1.exe PID 1680 wrote to memory of 848 1680 3dd400266e418778615ef84a247687d1.exe 3dd400266e418778615ef84a247687d1.exe PID 1680 wrote to memory of 848 1680 3dd400266e418778615ef84a247687d1.exe 3dd400266e418778615ef84a247687d1.exe PID 1680 wrote to memory of 572 1680 3dd400266e418778615ef84a247687d1.exe 3dd400266e418778615ef84a247687d1.exe PID 1680 wrote to memory of 572 1680 3dd400266e418778615ef84a247687d1.exe 3dd400266e418778615ef84a247687d1.exe PID 1680 wrote to memory of 572 1680 3dd400266e418778615ef84a247687d1.exe 3dd400266e418778615ef84a247687d1.exe PID 1680 wrote to memory of 572 1680 3dd400266e418778615ef84a247687d1.exe 3dd400266e418778615ef84a247687d1.exe PID 1680 wrote to memory of 844 1680 3dd400266e418778615ef84a247687d1.exe 3dd400266e418778615ef84a247687d1.exe PID 1680 wrote to memory of 844 1680 3dd400266e418778615ef84a247687d1.exe 3dd400266e418778615ef84a247687d1.exe PID 1680 wrote to memory of 844 1680 3dd400266e418778615ef84a247687d1.exe 3dd400266e418778615ef84a247687d1.exe PID 1680 wrote to memory of 844 1680 3dd400266e418778615ef84a247687d1.exe 3dd400266e418778615ef84a247687d1.exe PID 1680 wrote to memory of 384 1680 3dd400266e418778615ef84a247687d1.exe 3dd400266e418778615ef84a247687d1.exe PID 1680 wrote to memory of 384 1680 3dd400266e418778615ef84a247687d1.exe 3dd400266e418778615ef84a247687d1.exe PID 1680 wrote to memory of 384 1680 3dd400266e418778615ef84a247687d1.exe 3dd400266e418778615ef84a247687d1.exe PID 1680 wrote to memory of 384 1680 3dd400266e418778615ef84a247687d1.exe 3dd400266e418778615ef84a247687d1.exe PID 1680 wrote to memory of 384 1680 3dd400266e418778615ef84a247687d1.exe 3dd400266e418778615ef84a247687d1.exe PID 1680 wrote to memory of 384 1680 3dd400266e418778615ef84a247687d1.exe 3dd400266e418778615ef84a247687d1.exe PID 1680 wrote to memory of 384 1680 3dd400266e418778615ef84a247687d1.exe 3dd400266e418778615ef84a247687d1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3dd400266e418778615ef84a247687d1.exe"C:\Users\Admin\AppData\Local\Temp\3dd400266e418778615ef84a247687d1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3dd400266e418778615ef84a247687d1.exe"C:\Users\Admin\AppData\Local\Temp\3dd400266e418778615ef84a247687d1.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3dd400266e418778615ef84a247687d1.exe"C:\Users\Admin\AppData\Local\Temp\3dd400266e418778615ef84a247687d1.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3dd400266e418778615ef84a247687d1.exe"C:\Users\Admin\AppData\Local\Temp\3dd400266e418778615ef84a247687d1.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3dd400266e418778615ef84a247687d1.exe"C:\Users\Admin\AppData\Local\Temp\3dd400266e418778615ef84a247687d1.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/384-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/384-59-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/384-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/384-62-0x00000000008B0000-0x0000000000BB3000-memory.dmpFilesize
3.0MB
-
memory/1680-54-0x0000000000170000-0x00000000001F6000-memory.dmpFilesize
536KB
-
memory/1680-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmpFilesize
8KB
-
memory/1680-56-0x0000000004E10000-0x0000000004E11000-memory.dmpFilesize
4KB
-
memory/1680-57-0x00000000002A0000-0x00000000002B4000-memory.dmpFilesize
80KB
-
memory/1680-58-0x0000000004960000-0x00000000049C6000-memory.dmpFilesize
408KB