Analysis
-
max time kernel
45s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-06-2022 19:13
Static task
static1
Behavioral task
behavioral1
Sample
1f09f6eb2b8557f4eff4c52252600e69a9efe1df9ba86d4ad1013ccdd57f5bd1.exe
Resource
win7-20220414-en
General
-
Target
1f09f6eb2b8557f4eff4c52252600e69a9efe1df9ba86d4ad1013ccdd57f5bd1.exe
-
Size
480KB
-
MD5
5e498f86a7883500fe650de6eca7626c
-
SHA1
6509de8d6616bdd91d6db83dc058d3a040da95e7
-
SHA256
1f09f6eb2b8557f4eff4c52252600e69a9efe1df9ba86d4ad1013ccdd57f5bd1
-
SHA512
f1265ccaa2804c6336819cc9a845d34511203a0c029d8658b0cea25a05c44f80f509c9fcda940654c1ae0393feec1d3288df13fd4d66702f6179af38815d78f8
Malware Config
Extracted
formbook
3.8
sh
gingerexcept.win
greaterchapter.com
villageprintingkidron.net
luba87871.com
moaaberg.com
stewart-handyman.com
casachapi.net
merdadevida.com
schnorres.info
sunnygardenhoabinh.net
123nuisibles.net
skindentists.care
jardinejewellery.net
nicolekeppler.com
guiyishahou.com
sonnenschutzversand.net
aoizy.com
breathetaking.com
immoweb-rembourser.com
westvirginiamarijuana.net
women4womencoalition.info
qptnkwvf.com
enantatodetestosterona.com
yelentech.com
backhoes.us
shinymctw.com
hortorretamosa.com
reformenumclick.com
msthornburleysresourceroom.com
livingstonmade.com
boredboredom.com
startupf.net
darkmotheryoga.com
847xlt.info
appsdotnet.net
navyleaguebarrie.com
joinroar.com
wvnvx.com
gamebansung.site
shareprice.download
masseriadelborgo.com
gobyreef.com
goodtradies.com
alpha-zoner.net
verygoodeng.com
katadita.com
xn--z7x355ac4k.com
massageyou.review
egofin.com
482bifa.com
filippocalcagno.com
ivopiu.com
vincentsound.com
suryamotordrivingschool.com
joinfad.com
tophandbagplaza.com
drahujaclinic.com
miniangjiu.com
outlook.design
alexmendesproducoes.com
assurityterm.net
casamentocarolerafa.com
humder.com
lvjinyuanyi.com
hacdop.com
Signatures
-
Formbook Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/944-58-0x0000000000400000-0x000000000042A000-memory.dmp formbook -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
1f09f6eb2b8557f4eff4c52252600e69a9efe1df9ba86d4ad1013ccdd57f5bd1.exepid process 944 1f09f6eb2b8557f4eff4c52252600e69a9efe1df9ba86d4ad1013ccdd57f5bd1.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
1f09f6eb2b8557f4eff4c52252600e69a9efe1df9ba86d4ad1013ccdd57f5bd1.exepid process 944 1f09f6eb2b8557f4eff4c52252600e69a9efe1df9ba86d4ad1013ccdd57f5bd1.exe 944 1f09f6eb2b8557f4eff4c52252600e69a9efe1df9ba86d4ad1013ccdd57f5bd1.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
1f09f6eb2b8557f4eff4c52252600e69a9efe1df9ba86d4ad1013ccdd57f5bd1.exepid process 944 1f09f6eb2b8557f4eff4c52252600e69a9efe1df9ba86d4ad1013ccdd57f5bd1.exe 944 1f09f6eb2b8557f4eff4c52252600e69a9efe1df9ba86d4ad1013ccdd57f5bd1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
1f09f6eb2b8557f4eff4c52252600e69a9efe1df9ba86d4ad1013ccdd57f5bd1.exepid process 944 1f09f6eb2b8557f4eff4c52252600e69a9efe1df9ba86d4ad1013ccdd57f5bd1.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
1f09f6eb2b8557f4eff4c52252600e69a9efe1df9ba86d4ad1013ccdd57f5bd1.exepid process 944 1f09f6eb2b8557f4eff4c52252600e69a9efe1df9ba86d4ad1013ccdd57f5bd1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f09f6eb2b8557f4eff4c52252600e69a9efe1df9ba86d4ad1013ccdd57f5bd1.exe"C:\Users\Admin\AppData\Local\Temp\1f09f6eb2b8557f4eff4c52252600e69a9efe1df9ba86d4ad1013ccdd57f5bd1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
PID:944
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/944-56-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB
-
memory/944-58-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/944-59-0x0000000077690000-0x0000000077839000-memory.dmpFilesize
1.7MB
-
memory/944-60-0x0000000077870000-0x00000000779F0000-memory.dmpFilesize
1.5MB
-
memory/944-61-0x000000000B950000-0x000000000BC53000-memory.dmpFilesize
3.0MB