Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
08-08-2022 12:26
Static task
static1
Behavioral task
behavioral1
Sample
CSA73881.exe
Resource
win7-20220718-en
General
-
Target
CSA73881.exe
-
Size
2.1MB
-
MD5
3ed3236517a40602d654555bc912d926
-
SHA1
16dc042b543fe473703e711844f508d353d6d6af
-
SHA256
3702b6cfa76e492d56bd9da5f99f7ff805e32c16b3840ee66bb13a812f5d3155
-
SHA512
05c6c1d72929e8221522452ce757467a05b07a6e6a8a85ef6f0f16f8dc052068fdb54636f8526dd0eeea7c9fe743dcc4eba6fb84f36cc4a3bbc82b7d057f93d2
Malware Config
Extracted
formbook
4.1
mh76
healthgovcalottery.net
wenxinliao.com
rooterphd.com
bbobbo.one
american-mes-de-dezembro.xyz
mintager.com
thespecialtstore.com
wemakegreenhomes.com
occurandmental.xyz
fidelityrealtytitle.com
numerisat.asia
wearestallions.com
supxl.com
rajacumi.com
renaziv.online
blixtindustries.com
fjljq.com
exploretrivenicamping.com
authenticusspa.com
uucloud.press
conclaveraleighapts.com
moqaq.com
graphicressie.com
homebest.online
yisaco.com
thedrybonesareawakening.com
browardhomeappraisal.com
xn--agroisleos-09a.com
clinchrecovery.com
rekoladev.com
mlbl1.xyz
tunecaring.com
avconstant.com
chelseavictorioustravels.com
esrfy.xyz
frijolitoswey.com
zsfsidltd.com
natashasadler.com
kice1.xyz
drivemytrains.xyz
shopalthosa.xyz
merendri.com
yetkiliveznem7.xyz
milestonesconstruction.com
apparodeoexpos.com
momotou.xyz
chatkhoneh.com
cacconsults.com
kigif-indonesia.com
segurambiental.com
verynicegirls.com
curearrow.com
fdupcoffee.com
theclevergolfers.com
moushimonster.com
qdchuangyedaikuan.com
hopefortodayrecovery.com
wk6agoboyxg6.xyz
giybetfm.com
completedn.xyz
eluawastudio.com
legacysportsusatexas.com
comgmaik.com
intelsearchtech.com
northpierangling.info
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1988-60-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1988-61-0x000000000041F1A0-mapping.dmp formbook behavioral1/memory/1988-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2012-71-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/2012-75-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
CSA73881.exeInstallUtil.exemsdt.exedescription pid process target process PID 772 set thread context of 1988 772 CSA73881.exe InstallUtil.exe PID 1988 set thread context of 1268 1988 InstallUtil.exe Explorer.EXE PID 2012 set thread context of 1268 2012 msdt.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
CSA73881.exeInstallUtil.exemsdt.exepid process 772 CSA73881.exe 1988 InstallUtil.exe 1988 InstallUtil.exe 2012 msdt.exe 2012 msdt.exe 2012 msdt.exe 2012 msdt.exe 2012 msdt.exe 2012 msdt.exe 2012 msdt.exe 2012 msdt.exe 2012 msdt.exe 2012 msdt.exe 2012 msdt.exe 2012 msdt.exe 2012 msdt.exe 2012 msdt.exe 2012 msdt.exe 2012 msdt.exe 2012 msdt.exe 2012 msdt.exe 2012 msdt.exe 2012 msdt.exe 2012 msdt.exe 2012 msdt.exe 2012 msdt.exe 2012 msdt.exe 2012 msdt.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
InstallUtil.exemsdt.exepid process 1988 InstallUtil.exe 1988 InstallUtil.exe 1988 InstallUtil.exe 2012 msdt.exe 2012 msdt.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
CSA73881.exeInstallUtil.exemsdt.exedescription pid process Token: SeDebugPrivilege 772 CSA73881.exe Token: SeDebugPrivilege 1988 InstallUtil.exe Token: SeDebugPrivilege 2012 msdt.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
CSA73881.exeExplorer.EXEmsdt.exedescription pid process target process PID 772 wrote to memory of 1988 772 CSA73881.exe InstallUtil.exe PID 772 wrote to memory of 1988 772 CSA73881.exe InstallUtil.exe PID 772 wrote to memory of 1988 772 CSA73881.exe InstallUtil.exe PID 772 wrote to memory of 1988 772 CSA73881.exe InstallUtil.exe PID 772 wrote to memory of 1988 772 CSA73881.exe InstallUtil.exe PID 772 wrote to memory of 1988 772 CSA73881.exe InstallUtil.exe PID 772 wrote to memory of 1988 772 CSA73881.exe InstallUtil.exe PID 772 wrote to memory of 1988 772 CSA73881.exe InstallUtil.exe PID 772 wrote to memory of 1988 772 CSA73881.exe InstallUtil.exe PID 772 wrote to memory of 1988 772 CSA73881.exe InstallUtil.exe PID 1268 wrote to memory of 2012 1268 Explorer.EXE msdt.exe PID 1268 wrote to memory of 2012 1268 Explorer.EXE msdt.exe PID 1268 wrote to memory of 2012 1268 Explorer.EXE msdt.exe PID 1268 wrote to memory of 2012 1268 Explorer.EXE msdt.exe PID 2012 wrote to memory of 1592 2012 msdt.exe cmd.exe PID 2012 wrote to memory of 1592 2012 msdt.exe cmd.exe PID 2012 wrote to memory of 1592 2012 msdt.exe cmd.exe PID 2012 wrote to memory of 1592 2012 msdt.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\CSA73881.exe"C:\Users\Admin\AppData\Local\Temp\CSA73881.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1988 -
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵PID:1592
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/772-55-0x0000000075481000-0x0000000075483000-memory.dmpFilesize
8KB
-
memory/772-56-0x000000000BC90000-0x000000000BEAA000-memory.dmpFilesize
2.1MB
-
memory/772-54-0x0000000000B10000-0x0000000000D2C000-memory.dmpFilesize
2.1MB
-
memory/1268-66-0x0000000006D80000-0x0000000006ED9000-memory.dmpFilesize
1.3MB
-
memory/1268-76-0x0000000006EE0000-0x000000000704D000-memory.dmpFilesize
1.4MB
-
memory/1268-74-0x0000000006EE0000-0x000000000704D000-memory.dmpFilesize
1.4MB
-
memory/1592-69-0x0000000000000000-mapping.dmp
-
memory/1988-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1988-64-0x00000000008A0000-0x0000000000BA3000-memory.dmpFilesize
3.0MB
-
memory/1988-65-0x0000000000190000-0x00000000001A5000-memory.dmpFilesize
84KB
-
memory/1988-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1988-61-0x000000000041F1A0-mapping.dmp
-
memory/1988-58-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1988-57-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2012-67-0x0000000000000000-mapping.dmp
-
memory/2012-70-0x0000000000C00000-0x0000000000CF4000-memory.dmpFilesize
976KB
-
memory/2012-71-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/2012-72-0x00000000022D0000-0x00000000025D3000-memory.dmpFilesize
3.0MB
-
memory/2012-73-0x0000000000A10000-0x0000000000AA4000-memory.dmpFilesize
592KB
-
memory/2012-75-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB