Analysis
-
max time kernel
91s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
09-06-2022 09:53
Static task
static1
Behavioral task
behavioral1
Sample
99912794ef989327c3a99a7afd6439ad.exe
Resource
win7-20220414-en
General
-
Target
99912794ef989327c3a99a7afd6439ad.exe
-
Size
688KB
-
MD5
99912794ef989327c3a99a7afd6439ad
-
SHA1
aaee4dbefc9ce54cf45e16b8a921ef16681ee5b5
-
SHA256
4df9647b28defe7c3fc9f88602a582bcccb5005edd7b2784c76abb6383925353
-
SHA512
64c9a72beeff481f5ac0656e7b7f64a1e514a224eb236ff9c9dee03696af0f5f043dc0ef8236d6493ca91d91ae2643c4ac45e0fd9aaf854bd290f43bac244188
Malware Config
Extracted
formbook
4.1
fw02
payer-breakers.com
thesiscoper.com
rental-villa.com
scovikinnovations.com
hydh33.com
allmyshit.rest
lovejaclyn.com
vanessaruizwriting.com
dufonddelaclasse.com
kiddee168.com
monumentalmarketsllc.com
musclegainfatloss.com
avida.info
cosmo-wellness.net
dandelionfusedigital.com
oversizeloadbanners.com
konstelle.store
sdjnsbd.com
czoqg.xyz
5p6xljjse1lq.xyz
10936.loan
primeiropasso.website
salarydetector.net
the6figureshow.com
ritzluxurytransportation.com
5145.design
web3ido.xyz
starweaverdesigns.com
cbdtz.com
sunwall.xyz
ornitv.com
curateddesignsconsulting.com
businesshairways.biz
willacloud.com
accusecures.com
hl243.com
coffellc.icu
eddrugs2018.com
lidakang.xyz
salesstorecolombia.com
ilina.xyz
partieslikethese.com
peymantasnimi.com
datthocu.xyz
cybertechsolutions.xyz
findy.guru
trybes.space
arulinks.com
yuriookinoart.com
largestjerseysstore.com
fortitude-tech.com
ywfjp.com
b1v097f2avze.xyz
abdullahnazhim.com
zhaoav111.info
cegrowing.com
llaveselmuerto.com
7477e.xyz
chabusinessloans.com
ht-brain.com
app-compound.finance
0085208.com
wewinaccidents.com
ztzfirst.xyz
shishlomarket24.biz
Signatures
-
Formbook Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/624-138-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
99912794ef989327c3a99a7afd6439ad.exedescription pid process target process PID 4168 set thread context of 624 4168 99912794ef989327c3a99a7afd6439ad.exe 99912794ef989327c3a99a7afd6439ad.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
99912794ef989327c3a99a7afd6439ad.exe99912794ef989327c3a99a7afd6439ad.exepid process 4168 99912794ef989327c3a99a7afd6439ad.exe 4168 99912794ef989327c3a99a7afd6439ad.exe 4168 99912794ef989327c3a99a7afd6439ad.exe 4168 99912794ef989327c3a99a7afd6439ad.exe 4168 99912794ef989327c3a99a7afd6439ad.exe 4168 99912794ef989327c3a99a7afd6439ad.exe 4168 99912794ef989327c3a99a7afd6439ad.exe 4168 99912794ef989327c3a99a7afd6439ad.exe 4168 99912794ef989327c3a99a7afd6439ad.exe 624 99912794ef989327c3a99a7afd6439ad.exe 624 99912794ef989327c3a99a7afd6439ad.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
99912794ef989327c3a99a7afd6439ad.exedescription pid process Token: SeDebugPrivilege 4168 99912794ef989327c3a99a7afd6439ad.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
99912794ef989327c3a99a7afd6439ad.exedescription pid process target process PID 4168 wrote to memory of 2888 4168 99912794ef989327c3a99a7afd6439ad.exe 99912794ef989327c3a99a7afd6439ad.exe PID 4168 wrote to memory of 2888 4168 99912794ef989327c3a99a7afd6439ad.exe 99912794ef989327c3a99a7afd6439ad.exe PID 4168 wrote to memory of 2888 4168 99912794ef989327c3a99a7afd6439ad.exe 99912794ef989327c3a99a7afd6439ad.exe PID 4168 wrote to memory of 624 4168 99912794ef989327c3a99a7afd6439ad.exe 99912794ef989327c3a99a7afd6439ad.exe PID 4168 wrote to memory of 624 4168 99912794ef989327c3a99a7afd6439ad.exe 99912794ef989327c3a99a7afd6439ad.exe PID 4168 wrote to memory of 624 4168 99912794ef989327c3a99a7afd6439ad.exe 99912794ef989327c3a99a7afd6439ad.exe PID 4168 wrote to memory of 624 4168 99912794ef989327c3a99a7afd6439ad.exe 99912794ef989327c3a99a7afd6439ad.exe PID 4168 wrote to memory of 624 4168 99912794ef989327c3a99a7afd6439ad.exe 99912794ef989327c3a99a7afd6439ad.exe PID 4168 wrote to memory of 624 4168 99912794ef989327c3a99a7afd6439ad.exe 99912794ef989327c3a99a7afd6439ad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\99912794ef989327c3a99a7afd6439ad.exe"C:\Users\Admin\AppData\Local\Temp\99912794ef989327c3a99a7afd6439ad.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\99912794ef989327c3a99a7afd6439ad.exe"C:\Users\Admin\AppData\Local\Temp\99912794ef989327c3a99a7afd6439ad.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\99912794ef989327c3a99a7afd6439ad.exe"C:\Users\Admin\AppData\Local\Temp\99912794ef989327c3a99a7afd6439ad.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/624-137-0x0000000000000000-mapping.dmp
-
memory/624-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/624-139-0x0000000001740000-0x0000000001A8A000-memory.dmpFilesize
3.3MB
-
memory/2888-136-0x0000000000000000-mapping.dmp
-
memory/4168-130-0x00000000000F0000-0x00000000001A0000-memory.dmpFilesize
704KB
-
memory/4168-131-0x00000000050A0000-0x0000000005644000-memory.dmpFilesize
5.6MB
-
memory/4168-132-0x0000000004B90000-0x0000000004C22000-memory.dmpFilesize
584KB
-
memory/4168-133-0x0000000004B70000-0x0000000004B7A000-memory.dmpFilesize
40KB
-
memory/4168-134-0x0000000008910000-0x00000000089AC000-memory.dmpFilesize
624KB
-
memory/4168-135-0x0000000008E70000-0x0000000008ED6000-memory.dmpFilesize
408KB