Analysis
-
max time kernel
153s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
27-05-2022 17:09
Static task
static1
Behavioral task
behavioral1
Sample
05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe
Resource
win7-20220414-en
General
-
Target
05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe
-
Size
463KB
-
MD5
9841dbf9dfa221a4e050db3e92689bc9
-
SHA1
6948e9499fc0bfa41a72107b1fc58b15a9e40f63
-
SHA256
05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0
-
SHA512
c1791b418fbc55d00006f01a9b1dfba21dfed3fc4bb5b25f05a55c02e4c3af435a284979f186ec095bfc4e1d2717c0686d2e9b7a938be6ecf567cfd3e1517298
Malware Config
Extracted
formbook
3.8
h35
maraudersinc.com
liebianwangluo.com
visit-australia.info
machiyane-kasukabe.com
hafizclub.com
merkburn.net
favoritetraffic2updating.win
adrian-oeser.net
nkshopdomaincpplt234.info
imperiodofutebol.com
welometocaloundra.com
thehealthypose.com
squalloptna.com
bobknowsbest.com
damgproperties.com
wastemastershire.co.uk
swacballet.com
japanbreakingnews.com
bjufaa.info
aryakuza.com
ericbellband.com
undecrypt.com
printrade.win
stfuxxxx.com
xn--m7rv64cc7d7q1an8c.com
aeints.net
agrotecsol.com
rntme.com
dqdrpmm.com
inseedbrand.com
0x1tenmoney.men
khudothidongvan2.com
newcasinouk.com
avocatdedieu.com
cagewo.com
tmay.ltd
35s4.review
blipeducated.com
businesscoveragetop.online
syxjsn.com
commspacein.com
johns.zone
cj336.com
mario-vestec.com
saviorpalliative.info
motherloderiches.com
socialworld.site
yongshiquan.com
listingbussiness.com
irritablebowelsyndromeip.com
brazoriacountynavy.info
greencoffeebeans.store
kk6z.com
blacktaxi.online
homeremedyforum.com
khujn.com
pipeai.com
www502789.com
bbz168.com
copydinner.win
wwwdld005.com
forumin3d.net
bacarragroup.com
sarandipiagaldar.com
dotcex.com
Signatures
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4880-136-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/4880-142-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/2452-144-0x0000000000A40000-0x0000000000A6A000-memory.dmp formbook behavioral2/memory/2452-149-0x0000000000A40000-0x0000000000A6A000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exeRegAsm.execmstp.exedescription pid process target process PID 3536 set thread context of 4880 3536 05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe RegAsm.exe PID 4880 set thread context of 3056 4880 RegAsm.exe Explorer.EXE PID 2452 set thread context of 3056 2452 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
RegAsm.execmstp.exepid process 4880 RegAsm.exe 4880 RegAsm.exe 4880 RegAsm.exe 4880 RegAsm.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe 2452 cmstp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3056 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegAsm.execmstp.exepid process 4880 RegAsm.exe 4880 RegAsm.exe 4880 RegAsm.exe 2452 cmstp.exe 2452 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exeRegAsm.execmstp.exedescription pid process Token: SeDebugPrivilege 3536 05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe Token: SeDebugPrivilege 4880 RegAsm.exe Token: SeDebugPrivilege 2452 cmstp.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exeExplorer.EXEcmstp.exedescription pid process target process PID 3536 wrote to memory of 4880 3536 05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe RegAsm.exe PID 3536 wrote to memory of 4880 3536 05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe RegAsm.exe PID 3536 wrote to memory of 4880 3536 05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe RegAsm.exe PID 3536 wrote to memory of 4880 3536 05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe RegAsm.exe PID 3536 wrote to memory of 4880 3536 05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe RegAsm.exe PID 3536 wrote to memory of 4880 3536 05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe RegAsm.exe PID 3056 wrote to memory of 2452 3056 Explorer.EXE cmstp.exe PID 3056 wrote to memory of 2452 3056 Explorer.EXE cmstp.exe PID 3056 wrote to memory of 2452 3056 Explorer.EXE cmstp.exe PID 2452 wrote to memory of 340 2452 cmstp.exe cmd.exe PID 2452 wrote to memory of 340 2452 cmstp.exe cmd.exe PID 2452 wrote to memory of 340 2452 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe"C:\Users\Admin\AppData\Local\Temp\05ab9004968d1a9d4187dac4e629ef8ea777fb66c4d009ad411f2f945f2a53f0.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/340-146-0x0000000000000000-mapping.dmp
-
memory/2452-141-0x0000000000000000-mapping.dmp
-
memory/2452-143-0x0000000000530000-0x0000000000546000-memory.dmpFilesize
88KB
-
memory/2452-149-0x0000000000A40000-0x0000000000A6A000-memory.dmpFilesize
168KB
-
memory/2452-147-0x0000000002760000-0x00000000027F3000-memory.dmpFilesize
588KB
-
memory/2452-145-0x00000000028D0000-0x0000000002C1A000-memory.dmpFilesize
3.3MB
-
memory/2452-144-0x0000000000A40000-0x0000000000A6A000-memory.dmpFilesize
168KB
-
memory/3056-150-0x0000000008420000-0x0000000008556000-memory.dmpFilesize
1.2MB
-
memory/3056-148-0x0000000008420000-0x0000000008556000-memory.dmpFilesize
1.2MB
-
memory/3056-140-0x00000000035B0000-0x0000000003689000-memory.dmpFilesize
868KB
-
memory/3536-133-0x00000000058C0000-0x00000000058CA000-memory.dmpFilesize
40KB
-
memory/3536-132-0x0000000005940000-0x00000000059D2000-memory.dmpFilesize
584KB
-
memory/3536-131-0x0000000005E50000-0x00000000063F4000-memory.dmpFilesize
5.6MB
-
memory/3536-134-0x0000000006CE0000-0x0000000006D7C000-memory.dmpFilesize
624KB
-
memory/3536-130-0x0000000000EB0000-0x0000000000F2A000-memory.dmpFilesize
488KB
-
memory/4880-139-0x0000000000AC0000-0x0000000000AD4000-memory.dmpFilesize
80KB
-
memory/4880-137-0x0000000002790000-0x0000000002ADA000-memory.dmpFilesize
3.3MB
-
memory/4880-142-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/4880-136-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/4880-135-0x0000000000000000-mapping.dmp