Analysis
-
max time kernel
109s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
18-06-2022 21:32
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Inject4.7626.27045.exe
Resource
win7-20220414-en
General
-
Target
SecuriteInfo.com.Trojan.Inject4.7626.27045.exe
-
Size
465KB
-
MD5
2f54478ff3ea553fd34af1a0d207d704
-
SHA1
20a9f40fe6b15c8fe7de61b85a730e01c2b71661
-
SHA256
259275b0c056a9fec50378b2d268c48447e8ebe8827e8e55aae4484aba8b1939
-
SHA512
41212e6d4add91df9173ac0429f8f3532f98a2cd11418c5c0577f6784f31a4d411057cdd1a331f87ede1326a85f824184b7c1ee8106cd812ca6cecffb80bbc5f
Malware Config
Extracted
formbook
4.1
n7ak
audereventur.com
huro14.com
wwwjinsha155.com
antiquevendor.com
samuraisoulfood.net
traffic4updates.download
hypersarv.com
rapport-happy-wedding.com
rokutechnosupport.online
allworljob.com
hanaleedossmann.com
kauai-marathon.com
bepbosch.com
kangen-international.com
zoneshopemenowz.com
belviderewrestling.com
ipllink.com
sellingforcreators.com
wwwswty6655.com
qtumboa.com
bazarmoney.net
librosdecienciaficcion.com
shopmomsthebomb.com
vanjacob.com
tgyaa.com
theporncollective.net
hydrabadproperties.com
brindesecologicos.com
sayagayrimenkul.net
4btoken.com
shycedu.com
overall789.top
maison-pierre-bayle.com
elitemediamasters.com
sharmasfabrics.com
hoshamp.com
myultimateleadgenerator.com
office4u.info
thaimart1.com
ultimatewindowusa.com
twoblazesartworks.com
airteloffer.com
shoupaizhao.com
741dakotadr.info
books4arab.net
artedelcioccolato.biz
tjqcu.info
teccoop.net
maturebridesdressguide.com
excelcapfunding.com
bitcoinak.com
profileorderflow.com
unbelievabowboutique.com
midlandshomesolutionsltd.com
healthywithhook.com
stirlingpiper.com
manfast.online
arikorin.com
texastrustedinsurance.com
moodandmystery.com
yh77808.com
s-immotanger.com
runzexd.com
meteoannecy.net
joomlas123.info
Signatures
-
Formbook Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3988-137-0x0000000000400000-0x000000000042D000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Trojan.Inject4.7626.27045.exedescription pid process target process PID 4944 set thread context of 3988 4944 SecuriteInfo.com.Trojan.Inject4.7626.27045.exe SecuriteInfo.com.Trojan.Inject4.7626.27045.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
SecuriteInfo.com.Trojan.Inject4.7626.27045.exeSecuriteInfo.com.Trojan.Inject4.7626.27045.exepid process 4944 SecuriteInfo.com.Trojan.Inject4.7626.27045.exe 3988 SecuriteInfo.com.Trojan.Inject4.7626.27045.exe 3988 SecuriteInfo.com.Trojan.Inject4.7626.27045.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SecuriteInfo.com.Trojan.Inject4.7626.27045.exedescription pid process Token: SeDebugPrivilege 4944 SecuriteInfo.com.Trojan.Inject4.7626.27045.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
SecuriteInfo.com.Trojan.Inject4.7626.27045.exedescription pid process target process PID 4944 wrote to memory of 3988 4944 SecuriteInfo.com.Trojan.Inject4.7626.27045.exe SecuriteInfo.com.Trojan.Inject4.7626.27045.exe PID 4944 wrote to memory of 3988 4944 SecuriteInfo.com.Trojan.Inject4.7626.27045.exe SecuriteInfo.com.Trojan.Inject4.7626.27045.exe PID 4944 wrote to memory of 3988 4944 SecuriteInfo.com.Trojan.Inject4.7626.27045.exe SecuriteInfo.com.Trojan.Inject4.7626.27045.exe PID 4944 wrote to memory of 3988 4944 SecuriteInfo.com.Trojan.Inject4.7626.27045.exe SecuriteInfo.com.Trojan.Inject4.7626.27045.exe PID 4944 wrote to memory of 3988 4944 SecuriteInfo.com.Trojan.Inject4.7626.27045.exe SecuriteInfo.com.Trojan.Inject4.7626.27045.exe PID 4944 wrote to memory of 3988 4944 SecuriteInfo.com.Trojan.Inject4.7626.27045.exe SecuriteInfo.com.Trojan.Inject4.7626.27045.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.7626.27045.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.7626.27045.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.7626.27045.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.7626.27045.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3988-136-0x0000000000000000-mapping.dmp
-
memory/3988-137-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/3988-138-0x0000000001710000-0x0000000001A5A000-memory.dmpFilesize
3.3MB
-
memory/4944-130-0x0000000000F30000-0x0000000000FAA000-memory.dmpFilesize
488KB
-
memory/4944-131-0x00000000059A0000-0x0000000005A3C000-memory.dmpFilesize
624KB
-
memory/4944-132-0x0000000005FF0000-0x0000000006594000-memory.dmpFilesize
5.6MB
-
memory/4944-133-0x0000000005A40000-0x0000000005AD2000-memory.dmpFilesize
584KB
-
memory/4944-134-0x0000000005930000-0x000000000593A000-memory.dmpFilesize
40KB
-
memory/4944-135-0x0000000005C40000-0x0000000005C96000-memory.dmpFilesize
344KB