Analysis
-
max time kernel
119s -
max time network
129s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
31-01-2022 12:20
Static task
static1
Behavioral task
behavioral1
Sample
9e50ed09439b4f2206f6cee1b233677c.exe
Resource
win7-en-20211208
General
-
Target
9e50ed09439b4f2206f6cee1b233677c.exe
-
Size
510KB
-
MD5
9e50ed09439b4f2206f6cee1b233677c
-
SHA1
719705903de481a3c680db18f8cef892efef3dc7
-
SHA256
b45a38f7012d02b12d3613d25450847d87c14c9b3207380594fc5e1f1b1728d9
-
SHA512
927789d6fca24317b1cc41825485cf06cf337204d8007b32220ef2fb28ee48275102a9148682336f76e7586e5ed714d1de2098c08886ea1b76007880a5c45d80
Malware Config
Extracted
formbook
4.1
bt33
mbaonlinefreedegress.info
myforevermaid.com
daoyi365.com
weientm.com
legal-mx.com
formationrigging.com
heidiet.xyz
school-prosto.store
healthvitaminnutrition.com
digitalsolutionusa.com
little-bazar.com
jnbeautycanada.com
optoelek.com
learntoairmail.com
hawkminer.com
kingofearth.love
ktnstay.xyz
zouxin.love
mainlandpr.com
mamm-hummel.com
planosdwgcad.com
dlscordapp.info
northfacecore.online
professionalswhotrade.com
vbcgrp.com
spares245.com
alphasignsatl.online
342731.com
amazingarizonaproperty.com
priorlakecarpetcleaning.com
boardwalksnj.com
shiinebydesign.com
dymends.digital
indie-shopper.com
weihiw.quest
dchehe.com
momshousegeorgia.com
bnvxnohpcuhxbcueuvl.biz
tinyspout.com
hambransupply.com
keywordjord.com
koebnertriangle.com
aodiskoo.com
zgqyjlhw.com
thule-usa.store
western-overseas.online
woofpack-adventures.com
tilallarehome.com
51easyprint.com
arucad.university
llanoseeds.com
3-v0.space
harsors.com
sumiyoshiku-tenisuhiji.xyz
alsafqah.com
wrxworld.net
evrefill.com
multicoopltda.com
ziggytherealtor.com
candidatbellomansour.info
bigpromo.club
evagrombook.com
lyni7lyo.xyz
ways.express
karasevda-jor.com
Signatures
-
Formbook Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1500-61-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9e50ed09439b4f2206f6cee1b233677c.exedescription pid process target process PID 1648 set thread context of 1500 1648 9e50ed09439b4f2206f6cee1b233677c.exe 9e50ed09439b4f2206f6cee1b233677c.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
9e50ed09439b4f2206f6cee1b233677c.exepid process 1500 9e50ed09439b4f2206f6cee1b233677c.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
9e50ed09439b4f2206f6cee1b233677c.exedescription pid process target process PID 1648 wrote to memory of 1500 1648 9e50ed09439b4f2206f6cee1b233677c.exe 9e50ed09439b4f2206f6cee1b233677c.exe PID 1648 wrote to memory of 1500 1648 9e50ed09439b4f2206f6cee1b233677c.exe 9e50ed09439b4f2206f6cee1b233677c.exe PID 1648 wrote to memory of 1500 1648 9e50ed09439b4f2206f6cee1b233677c.exe 9e50ed09439b4f2206f6cee1b233677c.exe PID 1648 wrote to memory of 1500 1648 9e50ed09439b4f2206f6cee1b233677c.exe 9e50ed09439b4f2206f6cee1b233677c.exe PID 1648 wrote to memory of 1500 1648 9e50ed09439b4f2206f6cee1b233677c.exe 9e50ed09439b4f2206f6cee1b233677c.exe PID 1648 wrote to memory of 1500 1648 9e50ed09439b4f2206f6cee1b233677c.exe 9e50ed09439b4f2206f6cee1b233677c.exe PID 1648 wrote to memory of 1500 1648 9e50ed09439b4f2206f6cee1b233677c.exe 9e50ed09439b4f2206f6cee1b233677c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e50ed09439b4f2206f6cee1b233677c.exe"C:\Users\Admin\AppData\Local\Temp\9e50ed09439b4f2206f6cee1b233677c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9e50ed09439b4f2206f6cee1b233677c.exe"C:\Users\Admin\AppData\Local\Temp\9e50ed09439b4f2206f6cee1b233677c.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1500-59-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1500-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1500-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1648-54-0x0000000001120000-0x00000000011A6000-memory.dmpFilesize
536KB
-
memory/1648-55-0x0000000076001000-0x0000000076003000-memory.dmpFilesize
8KB
-
memory/1648-56-0x0000000000290000-0x00000000002A4000-memory.dmpFilesize
80KB
-
memory/1648-57-0x0000000000660000-0x0000000000661000-memory.dmpFilesize
4KB
-
memory/1648-58-0x0000000000F00000-0x0000000000F66000-memory.dmpFilesize
408KB