Analysis
-
max time kernel
147s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 11:19
Static task
static1
Behavioral task
behavioral1
Sample
YEw0N670fLb3Qwz.exe
Resource
win7-20220414-en
General
-
Target
YEw0N670fLb3Qwz.exe
-
Size
445KB
-
MD5
767febc4e7ba132342b5271a06a370c8
-
SHA1
3997eb76ba7da530ef6624d37d6218bf89400159
-
SHA256
0b6acf8d9861c0c69b88b7a7bf1427c5245bbd968e96db1cdb08b8432442c729
-
SHA512
5d3ff4c987aa5dce84b2ef944214149a2e1723f140182331e5693fc548fbb3c6026a55dc37eeb4ccc55b1173a76c9bebf0d3d7f26179ef99583fc2abf32d5120
Malware Config
Extracted
formbook
4.0
cdm
ldren.net
smtpsystem.com
elbastonazul.com
clickmailservice.com
housesearch.today
jingwei-pingtai.com
briankarenontour.com
wwwjinsha520.com
greenhouseci.net
cyberexpo.events
soundepict.com
hansardtracker.com
abenaasare.net
policemoviefestival.com
cryptocurrencyrocks.money
carliequinnesthetician.com
finestmilan.com
diclar.com
thependletonsurfclub.com
raku.party
ballooncinema.com
amazingtitute.net
sin88.biz
winclubsoccer.com
madzerini.com
vastburg.com
kameko88.com
musud.info
tdomainwithdnstherapy.com
followtrade.site
cre8yourpower.com
cmoauthority.com
southfloridaretinas.com
runningxu.com
allgoodthings50.com
craftysiblings.com
whoispornstar.com
jmp-24.com
brokeindublin.com
telokblangahclinic.com
samanthahough.com
myvelvetmoon.com
abtest.top
goglassautoglass.com
baseballbenchcoach.com
protectivedigital.com
masterplitki-pf.com
venuechicago.club
knjet.com
narvikfjelletbooking.com
jmxqdi.men
554757.top
solarmcommunitygo.com
yzxlbj.com
youatenboutique.com
pyotrilyich.com
dgpymj.com
codercoworking.com
vonwi.com
edlaserstudio.com
reviewmaylockhongkhi.net
thegoodeearth.com
sunburstclosets.com
selfservicekiosk.net
tromagy.com
Signatures
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2024-62-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/2024-63-0x000000000041E2F0-mapping.dmp formbook behavioral1/memory/2024-65-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/2036-72-0x00000000000B0000-0x00000000000DD000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1376 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
YEw0N670fLb3Qwz.exeYEw0N670fLb3Qwz.execmstp.exedescription pid process target process PID 1652 set thread context of 2024 1652 YEw0N670fLb3Qwz.exe YEw0N670fLb3Qwz.exe PID 2024 set thread context of 1252 2024 YEw0N670fLb3Qwz.exe Explorer.EXE PID 2036 set thread context of 1252 2036 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
YEw0N670fLb3Qwz.exeYEw0N670fLb3Qwz.execmstp.exepid process 1652 YEw0N670fLb3Qwz.exe 1652 YEw0N670fLb3Qwz.exe 2024 YEw0N670fLb3Qwz.exe 2024 YEw0N670fLb3Qwz.exe 2036 cmstp.exe 2036 cmstp.exe 2036 cmstp.exe 2036 cmstp.exe 2036 cmstp.exe 2036 cmstp.exe 2036 cmstp.exe 2036 cmstp.exe 2036 cmstp.exe 2036 cmstp.exe 2036 cmstp.exe 2036 cmstp.exe 2036 cmstp.exe 2036 cmstp.exe 2036 cmstp.exe 2036 cmstp.exe 2036 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
YEw0N670fLb3Qwz.execmstp.exepid process 2024 YEw0N670fLb3Qwz.exe 2024 YEw0N670fLb3Qwz.exe 2024 YEw0N670fLb3Qwz.exe 2036 cmstp.exe 2036 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
YEw0N670fLb3Qwz.exeYEw0N670fLb3Qwz.execmstp.exedescription pid process Token: SeDebugPrivilege 1652 YEw0N670fLb3Qwz.exe Token: SeDebugPrivilege 2024 YEw0N670fLb3Qwz.exe Token: SeDebugPrivilege 2036 cmstp.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1252 Explorer.EXE 1252 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1252 Explorer.EXE 1252 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
YEw0N670fLb3Qwz.exeExplorer.EXEcmstp.exedescription pid process target process PID 1652 wrote to memory of 2024 1652 YEw0N670fLb3Qwz.exe YEw0N670fLb3Qwz.exe PID 1652 wrote to memory of 2024 1652 YEw0N670fLb3Qwz.exe YEw0N670fLb3Qwz.exe PID 1652 wrote to memory of 2024 1652 YEw0N670fLb3Qwz.exe YEw0N670fLb3Qwz.exe PID 1652 wrote to memory of 2024 1652 YEw0N670fLb3Qwz.exe YEw0N670fLb3Qwz.exe PID 1652 wrote to memory of 2024 1652 YEw0N670fLb3Qwz.exe YEw0N670fLb3Qwz.exe PID 1652 wrote to memory of 2024 1652 YEw0N670fLb3Qwz.exe YEw0N670fLb3Qwz.exe PID 1652 wrote to memory of 2024 1652 YEw0N670fLb3Qwz.exe YEw0N670fLb3Qwz.exe PID 1252 wrote to memory of 2036 1252 Explorer.EXE cmstp.exe PID 1252 wrote to memory of 2036 1252 Explorer.EXE cmstp.exe PID 1252 wrote to memory of 2036 1252 Explorer.EXE cmstp.exe PID 1252 wrote to memory of 2036 1252 Explorer.EXE cmstp.exe PID 1252 wrote to memory of 2036 1252 Explorer.EXE cmstp.exe PID 1252 wrote to memory of 2036 1252 Explorer.EXE cmstp.exe PID 1252 wrote to memory of 2036 1252 Explorer.EXE cmstp.exe PID 2036 wrote to memory of 1376 2036 cmstp.exe cmd.exe PID 2036 wrote to memory of 1376 2036 cmstp.exe cmd.exe PID 2036 wrote to memory of 1376 2036 cmstp.exe cmd.exe PID 2036 wrote to memory of 1376 2036 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\YEw0N670fLb3Qwz.exe"C:\Users\Admin\AppData\Local\Temp\YEw0N670fLb3Qwz.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\YEw0N670fLb3Qwz.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2024 -
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2012
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2008
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1396
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1888
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:564
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:336
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1016
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1936
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1704
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1452
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1184
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1484
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\YEw0N670fLb3Qwz.exe"3⤵
- Deletes itself
PID:1376
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1252-76-0x00000000079C0000-0x0000000007B4F000-memory.dmpFilesize
1.6MB
-
memory/1252-68-0x0000000007890000-0x00000000079B2000-memory.dmpFilesize
1.1MB
-
memory/1376-73-0x0000000000000000-mapping.dmp
-
memory/1652-54-0x0000000001020000-0x0000000001096000-memory.dmpFilesize
472KB
-
memory/1652-55-0x00000000752B1000-0x00000000752B3000-memory.dmpFilesize
8KB
-
memory/1652-56-0x0000000000350000-0x000000000035A000-memory.dmpFilesize
40KB
-
memory/1652-57-0x0000000000630000-0x0000000000686000-memory.dmpFilesize
344KB
-
memory/1652-58-0x00000000004E0000-0x0000000000512000-memory.dmpFilesize
200KB
-
memory/2024-66-0x0000000000930000-0x0000000000C33000-memory.dmpFilesize
3.0MB
-
memory/2024-67-0x00000000002A0000-0x00000000002B4000-memory.dmpFilesize
80KB
-
memory/2024-63-0x000000000041E2F0-mapping.dmp
-
memory/2024-65-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2024-62-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2024-60-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2024-59-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2036-69-0x0000000000000000-mapping.dmp
-
memory/2036-71-0x0000000000030000-0x0000000000048000-memory.dmpFilesize
96KB
-
memory/2036-72-0x00000000000B0000-0x00000000000DD000-memory.dmpFilesize
180KB
-
memory/2036-74-0x0000000001E80000-0x0000000002183000-memory.dmpFilesize
3.0MB
-
memory/2036-75-0x0000000001D10000-0x0000000001DA3000-memory.dmpFilesize
588KB