Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
16-05-2022 18:49
Static task
static1
Behavioral task
behavioral1
Sample
2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe
Resource
win7-20220414-en
General
-
Target
2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe
-
Size
737KB
-
MD5
38694cf4cf60fc8408f11b40e2e62338
-
SHA1
e42b57f70784715d37794ec05cc0da6ff356345c
-
SHA256
2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a
-
SHA512
fdb9cc5ff5a872bc9f383d06582a726652b4a2ce491bc1482bcf6e1808950835d57144061ee68b73a917db660f8aaaa381d4e6dc1657e69e5dca4d32d7648657
Malware Config
Extracted
formbook
4.1
bnc
iseoguide.com
rogerellisonline.com
thephonelenses.com
reddystone.com
explorehokianga.com
miaflcio.vote
baonihaochi.com
thewiseengineer.com
exciplexinc.com
luewaeeqaredre.com
atharvatechnologysolutions.com
vnsr1234.com
nationswines.com
toaglobalcc.com
texasbusrental.com
sailfishingcostarica.com
superbuy.today
mode-paradox.com
soperlz.xyz
filterdance.com
bllck.com
cocitas.com
hiflips.com
in-unicorn.com
panduitusa.com
pradamany.com
takingcheck.com
thinlinecreations.com
trendycollectionz.com
chantalrenaud.com
bundangsvc.com
stlouisoutdooradventures.com
patcapfinances.com
online-record.com
bangbangfactory.com
zzzttt10.com
jennishewardart.com
number1texasmedium.com
organichighqualityrush.com
ja6g.com
futureballet.com
siliconchips-synctoday.com
mesotherlioma.com
wzditai.com
chemcleandw.com
changhong433sj.com
k2night.com
londonvisas.com
luxuryfloatingflat.com
dgsazeh.com
graeciantiqui.net
finehairedgirls.com
comsweetrbx.com
pcnyyxo.icu
sevilce.com
omhwywwcxorl.com
top10mindset.com
cristinaiovu.com
fcpinnovacion.com
marcelopissardini.com
scorebuddycx.com
xn--lsuoa.net
mrchensauthenticchinese.com
jesse-mansfield.com
ccminghao.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2020-62-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/2020-63-0x000000000041EB20-mapping.dmp formbook behavioral1/memory/1696-71-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exeRegSvcs.exenetsh.exedescription pid process target process PID 1464 set thread context of 2020 1464 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe RegSvcs.exe PID 2020 set thread context of 1400 2020 RegSvcs.exe Explorer.EXE PID 1696 set thread context of 1400 1696 netsh.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exeRegSvcs.exenetsh.exepid process 1464 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe 1464 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe 1464 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe 2020 RegSvcs.exe 2020 RegSvcs.exe 1696 netsh.exe 1696 netsh.exe 1696 netsh.exe 1696 netsh.exe 1696 netsh.exe 1696 netsh.exe 1696 netsh.exe 1696 netsh.exe 1696 netsh.exe 1696 netsh.exe 1696 netsh.exe 1696 netsh.exe 1696 netsh.exe 1696 netsh.exe 1696 netsh.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exenetsh.exepid process 2020 RegSvcs.exe 2020 RegSvcs.exe 2020 RegSvcs.exe 1696 netsh.exe 1696 netsh.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exeRegSvcs.exenetsh.exedescription pid process Token: SeDebugPrivilege 1464 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe Token: SeDebugPrivilege 2020 RegSvcs.exe Token: SeDebugPrivilege 1696 netsh.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1400 Explorer.EXE 1400 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1400 Explorer.EXE 1400 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exeExplorer.EXEnetsh.exedescription pid process target process PID 1464 wrote to memory of 2020 1464 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe RegSvcs.exe PID 1464 wrote to memory of 2020 1464 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe RegSvcs.exe PID 1464 wrote to memory of 2020 1464 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe RegSvcs.exe PID 1464 wrote to memory of 2020 1464 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe RegSvcs.exe PID 1464 wrote to memory of 2020 1464 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe RegSvcs.exe PID 1464 wrote to memory of 2020 1464 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe RegSvcs.exe PID 1464 wrote to memory of 2020 1464 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe RegSvcs.exe PID 1464 wrote to memory of 2020 1464 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe RegSvcs.exe PID 1464 wrote to memory of 2020 1464 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe RegSvcs.exe PID 1464 wrote to memory of 2020 1464 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe RegSvcs.exe PID 1400 wrote to memory of 1696 1400 Explorer.EXE netsh.exe PID 1400 wrote to memory of 1696 1400 Explorer.EXE netsh.exe PID 1400 wrote to memory of 1696 1400 Explorer.EXE netsh.exe PID 1400 wrote to memory of 1696 1400 Explorer.EXE netsh.exe PID 1696 wrote to memory of 1976 1696 netsh.exe cmd.exe PID 1696 wrote to memory of 1976 1696 netsh.exe cmd.exe PID 1696 wrote to memory of 1976 1696 netsh.exe cmd.exe PID 1696 wrote to memory of 1976 1696 netsh.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe"C:\Users\Admin\AppData\Local\Temp\2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1400-67-0x0000000004860000-0x0000000004940000-memory.dmpFilesize
896KB
-
memory/1400-74-0x0000000006070000-0x00000000061B1000-memory.dmpFilesize
1.3MB
-
memory/1464-55-0x0000000000500000-0x0000000000556000-memory.dmpFilesize
344KB
-
memory/1464-56-0x0000000000330000-0x0000000000338000-memory.dmpFilesize
32KB
-
memory/1464-57-0x0000000004B30000-0x0000000004B86000-memory.dmpFilesize
344KB
-
memory/1464-58-0x0000000000B60000-0x0000000000B96000-memory.dmpFilesize
216KB
-
memory/1464-54-0x0000000000BA0000-0x0000000000C60000-memory.dmpFilesize
768KB
-
memory/1696-68-0x0000000000000000-mapping.dmp
-
memory/1696-70-0x0000000000DB0000-0x0000000000DCB000-memory.dmpFilesize
108KB
-
memory/1696-71-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/1696-72-0x00000000021D0000-0x00000000024D3000-memory.dmpFilesize
3.0MB
-
memory/1696-73-0x0000000000B70000-0x0000000000C03000-memory.dmpFilesize
588KB
-
memory/1976-69-0x0000000000000000-mapping.dmp
-
memory/2020-63-0x000000000041EB20-mapping.dmp
-
memory/2020-65-0x00000000008D0000-0x0000000000BD3000-memory.dmpFilesize
3.0MB
-
memory/2020-62-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2020-66-0x0000000000190000-0x00000000001A4000-memory.dmpFilesize
80KB
-
memory/2020-60-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2020-59-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB