Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 11:50
Static task
static1
Behavioral task
behavioral1
Sample
PO 31287.exe
Resource
win7-20220414-en
General
-
Target
PO 31287.exe
-
Size
713KB
-
MD5
d4d301c9e1554996470078236b71ee3d
-
SHA1
df42e6511611746e410735758e41dc1d9bed1f97
-
SHA256
378a7a9a7d15d9a8a477751a956475909953f739d65d92a85d0e7997279c1bd5
-
SHA512
ca46d025ed7ea28f4e2928a60ff86ac1948016bb774798cb42bbaaa8ff0238ec0210fc717bd1d1e40a63ff8e51bf35b138508b4de5cfd5b03fbefd2fae3b4416
Malware Config
Extracted
formbook
4.0
w9z
crazzysex.com
hanferd.com
gteesrd.com
bayfrontbabyplace.com
jicuiquan.net
relationshiplink.net
ohchacyberphoto.com
kauegimenes.com
powerful-seldom.com
ketotoken.com
make-money-online-success.com
redgoldcollection.com
hannan-football.com
hamptondc.com
vllii.com
aa8520.com
platform35markethall.com
larozeimmo.com
oligopoly.net
llhak.info
fisioservice.com
tesla-magnumopus.com
cocodrilodigital.com
pinegrovesg.com
traveladventureswithme.com
hebitaixin.com
golphysi.com
gayjeans.com
quickhire.expert
randomviews1.com
eatatnobu.com
topmabati.com
mediaupside.com
spillerakademi.com
thebowtie.store
sensomaticloadcell.com
turismodemadrid.net
yuhe89.com
wernerkrug.com
cdpogo.net
dannynhois.com
realestatestructureddata.com
matewhereareyou.net
laimeibei.ltd
sw328.com
lmwworks.net
xtremefish.com
tonerias.com
dsooneclinicianexpert.com
281clara.com
smmcommunity.net
dreamneeds.info
twocraft.com
yasasiite.salon
advk8qi.top
drabist.com
europartnersplus.com
saltbgone.com
teslaoceanic.info
bestmedicationstore.com
buynewcartab.live
prospect.money
viebrocks.com
transportationhappy.com
worstig.com
Signatures
-
Formbook Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/784-62-0x00000000000C0000-0x00000000000ED000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1544 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
NETSTAT.EXEdescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run NETSTAT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\X6QLGPYHK8 = "C:\\Program Files (x86)\\Ophot\\autochkzhg4m4x8.exe" NETSTAT.EXE -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO 31287.exePO 31287.exeNETSTAT.EXEdescription pid process target process PID 1672 set thread context of 1668 1672 PO 31287.exe PO 31287.exe PID 1668 set thread context of 1212 1668 PO 31287.exe Explorer.EXE PID 784 set thread context of 1212 784 NETSTAT.EXE Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
NETSTAT.EXEdescription ioc process File opened for modification C:\Program Files (x86)\Ophot\autochkzhg4m4x8.exe NETSTAT.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 784 NETSTAT.EXE -
Processes:
NETSTAT.EXEdescription ioc process Key created \Registry\User\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
PO 31287.exePO 31287.exeNETSTAT.EXEpid process 1672 PO 31287.exe 1668 PO 31287.exe 1668 PO 31287.exe 784 NETSTAT.EXE 784 NETSTAT.EXE 784 NETSTAT.EXE 784 NETSTAT.EXE 784 NETSTAT.EXE 784 NETSTAT.EXE 784 NETSTAT.EXE 784 NETSTAT.EXE 784 NETSTAT.EXE 784 NETSTAT.EXE 784 NETSTAT.EXE 784 NETSTAT.EXE 784 NETSTAT.EXE 784 NETSTAT.EXE 784 NETSTAT.EXE 784 NETSTAT.EXE 784 NETSTAT.EXE 784 NETSTAT.EXE 784 NETSTAT.EXE 784 NETSTAT.EXE 784 NETSTAT.EXE 784 NETSTAT.EXE 784 NETSTAT.EXE 784 NETSTAT.EXE 784 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
PO 31287.exePO 31287.exeNETSTAT.EXEpid process 1672 PO 31287.exe 1668 PO 31287.exe 1668 PO 31287.exe 1668 PO 31287.exe 784 NETSTAT.EXE 784 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO 31287.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 1668 PO 31287.exe Token: SeDebugPrivilege 784 NETSTAT.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PO 31287.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 1672 wrote to memory of 1668 1672 PO 31287.exe PO 31287.exe PID 1672 wrote to memory of 1668 1672 PO 31287.exe PO 31287.exe PID 1672 wrote to memory of 1668 1672 PO 31287.exe PO 31287.exe PID 1672 wrote to memory of 1668 1672 PO 31287.exe PO 31287.exe PID 1212 wrote to memory of 784 1212 Explorer.EXE NETSTAT.EXE PID 1212 wrote to memory of 784 1212 Explorer.EXE NETSTAT.EXE PID 1212 wrote to memory of 784 1212 Explorer.EXE NETSTAT.EXE PID 1212 wrote to memory of 784 1212 Explorer.EXE NETSTAT.EXE PID 784 wrote to memory of 1544 784 NETSTAT.EXE cmd.exe PID 784 wrote to memory of 1544 784 NETSTAT.EXE cmd.exe PID 784 wrote to memory of 1544 784 NETSTAT.EXE cmd.exe PID 784 wrote to memory of 1544 784 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO 31287.exe"C:\Users\Admin\AppData\Local\Temp\PO 31287.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO 31287.exe"C:\Users\Admin\AppData\Local\Temp\PO 31287.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Gathers network information
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO 31287.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\O5N16ST5\O5Nlogim.jpegFilesize
60KB
MD539f51dfd45bc517220cad0f0a9fffed2
SHA11effde319bee232d4039f19c985848fd8ba55b47
SHA25633eb4980e7f0af65597b354b43c82717c3435c5735bfd3c5cf77ae5514d8c880
SHA512e960131fd6aa79cda118160156f1d1d69f01d74c566825c962073174e53e3ddb13234a9e5c1e50555368e4f698e17241c5012a072199cb7a3024b5a3efc80c2b
-
C:\Users\Admin\AppData\Roaming\O5N16ST5\O5Nlogri.iniFilesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\O5N16ST5\O5Nlogrv.iniFilesize
40B
MD5ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf
-
memory/784-62-0x00000000000C0000-0x00000000000ED000-memory.dmpFilesize
180KB
-
memory/784-65-0x0000000001F90000-0x0000000002023000-memory.dmpFilesize
588KB
-
memory/784-63-0x0000000002230000-0x0000000002533000-memory.dmpFilesize
3.0MB
-
memory/784-60-0x0000000000000000-mapping.dmp
-
memory/784-61-0x0000000000260000-0x0000000000269000-memory.dmpFilesize
36KB
-
memory/1212-66-0x0000000003D00000-0x0000000003DA0000-memory.dmpFilesize
640KB
-
memory/1212-59-0x0000000004A60000-0x0000000004B65000-memory.dmpFilesize
1.0MB
-
memory/1544-64-0x0000000000000000-mapping.dmp
-
memory/1668-58-0x00000000002B0000-0x00000000002C4000-memory.dmpFilesize
80KB
-
memory/1668-57-0x0000000000830000-0x0000000000B33000-memory.dmpFilesize
3.0MB
-
memory/1668-55-0x000000000041E2D0-mapping.dmp
-
memory/1672-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmpFilesize
8KB
-
memory/1672-56-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB