Analysis
-
max time kernel
157s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 01:24
Static task
static1
Behavioral task
behavioral1
Sample
Salary.exe
Resource
win7-20220414-en
General
-
Target
Salary.exe
-
Size
354KB
-
MD5
3abc3bd58ec7ecd38e1f25823a3a1833
-
SHA1
887ac2315f548e3699d0ad340b4b677a679ec434
-
SHA256
9c5d88a1518cd310e763757d9acd267ed5741d6c79036e1053381729a0d700ca
-
SHA512
393e69f3741a477a77aefb9e2082829e05a2b68f173e29f2cae909661739f307754161b16b1a8820cd5d614e51adddf95f111696edd33c066c7fc77ad931b067
Malware Config
Extracted
formbook
4.0
g8u
stuition.com
mj-sculpture.com
cannatainmentevents.com
dianjintang.com
rmlusitania.info
effet-spiruline.com
flatheme.com
supergaminator-vip.com
craftyourmagic.com
lakai.ltd
electionshawaii.com
iqpdct.com
thebestfourstarhotels.com
satoshiceo.com
saintmartiner.com
brothersmarinetoronto.com
citicoin.online
scentsationalsniffers.com
hellonighbourgameees.com
displayonline-france.com
cait-compare.com
aprenderoratoria.com
stehtisch24.com
cocktailandcocktalk.com
hybridtablesaw.com
ynnkfs.com
capitolman.com
xccomm.com
dannyhustle.com
9jiuhao.com
ossigenopoliatomicoliquido.biz
casayards.com
hotelmesonreal.com
lffcfftl.com
raiserobo.com
ssav33.com
oceanicmarinerisks.com
star-fairtrading.com
universecoolest.com
www8557v.com
reparaciones-ordenadores.com
residenteyecarepa.com
x-hom.com
finestsalon.com
xn--n8jydrczh8g7f7a7lp527d.com
dallasfortworthseopro.com
talentsplanner.com
gdmen.com
life-insurer-zone.live
tunnelrobot.com
vietnamexport.net
inlishui.site
inaneufeld.com
sleepingsling.com
huaian.ltd
iluxol.com
mahavirjwellersnoida.com
fastaskme.men
rsinsur.com
datingevo.com
bringmesomething.online
banjiasanti.com
zhixinchain.net
medifloors.com
tromagy.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4276-135-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/4988-143-0x0000000000750000-0x000000000077D000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Salary.exeSalary.execmstp.exedescription pid process target process PID 2212 set thread context of 4276 2212 Salary.exe Salary.exe PID 4276 set thread context of 3084 4276 Salary.exe Explorer.EXE PID 4988 set thread context of 3084 4988 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
Salary.execmstp.exepid process 4276 Salary.exe 4276 Salary.exe 4276 Salary.exe 4276 Salary.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe 4988 cmstp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3084 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Salary.execmstp.exepid process 4276 Salary.exe 4276 Salary.exe 4276 Salary.exe 4988 cmstp.exe 4988 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Salary.execmstp.exedescription pid process Token: SeDebugPrivilege 4276 Salary.exe Token: SeDebugPrivilege 4988 cmstp.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Salary.exeExplorer.EXEcmstp.exedescription pid process target process PID 2212 wrote to memory of 4276 2212 Salary.exe Salary.exe PID 2212 wrote to memory of 4276 2212 Salary.exe Salary.exe PID 2212 wrote to memory of 4276 2212 Salary.exe Salary.exe PID 2212 wrote to memory of 4276 2212 Salary.exe Salary.exe PID 2212 wrote to memory of 4276 2212 Salary.exe Salary.exe PID 2212 wrote to memory of 4276 2212 Salary.exe Salary.exe PID 3084 wrote to memory of 4988 3084 Explorer.EXE cmstp.exe PID 3084 wrote to memory of 4988 3084 Explorer.EXE cmstp.exe PID 3084 wrote to memory of 4988 3084 Explorer.EXE cmstp.exe PID 4988 wrote to memory of 1696 4988 cmstp.exe cmd.exe PID 4988 wrote to memory of 1696 4988 cmstp.exe cmd.exe PID 4988 wrote to memory of 1696 4988 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Salary.exe"C:\Users\Admin\AppData\Local\Temp\Salary.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Salary.exe"C:\Users\Admin\AppData\Local\Temp\Salary.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Salary.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1696-141-0x0000000000000000-mapping.dmp
-
memory/2212-131-0x00000000055C0000-0x0000000005B64000-memory.dmpFilesize
5.6MB
-
memory/2212-132-0x0000000005010000-0x00000000050A2000-memory.dmpFilesize
584KB
-
memory/2212-133-0x0000000005150000-0x00000000051EC000-memory.dmpFilesize
624KB
-
memory/2212-130-0x00000000005A0000-0x00000000005FE000-memory.dmpFilesize
376KB
-
memory/3084-139-0x0000000002B10000-0x0000000002BF0000-memory.dmpFilesize
896KB
-
memory/3084-146-0x0000000002BF0000-0x0000000002CB6000-memory.dmpFilesize
792KB
-
memory/4276-134-0x0000000000000000-mapping.dmp
-
memory/4276-138-0x00000000016E0000-0x00000000016F4000-memory.dmpFilesize
80KB
-
memory/4276-137-0x0000000001770000-0x0000000001ABA000-memory.dmpFilesize
3.3MB
-
memory/4276-135-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/4988-140-0x0000000000000000-mapping.dmp
-
memory/4988-143-0x0000000000750000-0x000000000077D000-memory.dmpFilesize
180KB
-
memory/4988-142-0x0000000000170000-0x0000000000186000-memory.dmpFilesize
88KB
-
memory/4988-144-0x00000000028F0000-0x0000000002C3A000-memory.dmpFilesize
3.3MB
-
memory/4988-145-0x0000000002730000-0x00000000027C3000-memory.dmpFilesize
588KB