Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
08-08-2022 12:26
Static task
static1
Behavioral task
behavioral1
Sample
CSA73881.exe
Resource
win7-20220718-en
General
-
Target
CSA73881.exe
-
Size
2.1MB
-
MD5
3ed3236517a40602d654555bc912d926
-
SHA1
16dc042b543fe473703e711844f508d353d6d6af
-
SHA256
3702b6cfa76e492d56bd9da5f99f7ff805e32c16b3840ee66bb13a812f5d3155
-
SHA512
05c6c1d72929e8221522452ce757467a05b07a6e6a8a85ef6f0f16f8dc052068fdb54636f8526dd0eeea7c9fe743dcc4eba6fb84f36cc4a3bbc82b7d057f93d2
Malware Config
Extracted
formbook
4.1
mh76
healthgovcalottery.net
wenxinliao.com
rooterphd.com
bbobbo.one
american-mes-de-dezembro.xyz
mintager.com
thespecialtstore.com
wemakegreenhomes.com
occurandmental.xyz
fidelityrealtytitle.com
numerisat.asia
wearestallions.com
supxl.com
rajacumi.com
renaziv.online
blixtindustries.com
fjljq.com
exploretrivenicamping.com
authenticusspa.com
uucloud.press
conclaveraleighapts.com
moqaq.com
graphicressie.com
homebest.online
yisaco.com
thedrybonesareawakening.com
browardhomeappraisal.com
xn--agroisleos-09a.com
clinchrecovery.com
rekoladev.com
mlbl1.xyz
tunecaring.com
avconstant.com
chelseavictorioustravels.com
esrfy.xyz
frijolitoswey.com
zsfsidltd.com
natashasadler.com
kice1.xyz
drivemytrains.xyz
shopalthosa.xyz
merendri.com
yetkiliveznem7.xyz
milestonesconstruction.com
apparodeoexpos.com
momotou.xyz
chatkhoneh.com
cacconsults.com
kigif-indonesia.com
segurambiental.com
verynicegirls.com
curearrow.com
fdupcoffee.com
theclevergolfers.com
moushimonster.com
qdchuangyedaikuan.com
hopefortodayrecovery.com
wk6agoboyxg6.xyz
giybetfm.com
completedn.xyz
eluawastudio.com
legacysportsusatexas.com
comgmaik.com
intelsearchtech.com
northpierangling.info
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3456-136-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3456-138-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4992-144-0x0000000000B60000-0x0000000000B8F000-memory.dmp formbook behavioral2/memory/4992-149-0x0000000000B60000-0x0000000000B8F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
CSA73881.exeInstallUtil.execontrol.exedescription pid process target process PID 1472 set thread context of 3456 1472 CSA73881.exe InstallUtil.exe PID 3456 set thread context of 1184 3456 InstallUtil.exe Explorer.EXE PID 4992 set thread context of 1184 4992 control.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
CSA73881.exeInstallUtil.execontrol.exepid process 1472 CSA73881.exe 1472 CSA73881.exe 3456 InstallUtil.exe 3456 InstallUtil.exe 3456 InstallUtil.exe 3456 InstallUtil.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe 4992 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1184 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
InstallUtil.execontrol.exepid process 3456 InstallUtil.exe 3456 InstallUtil.exe 3456 InstallUtil.exe 4992 control.exe 4992 control.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
CSA73881.exeInstallUtil.execontrol.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1472 CSA73881.exe Token: SeDebugPrivilege 3456 InstallUtil.exe Token: SeDebugPrivilege 4992 control.exe Token: SeShutdownPrivilege 1184 Explorer.EXE Token: SeCreatePagefilePrivilege 1184 Explorer.EXE Token: SeShutdownPrivilege 1184 Explorer.EXE Token: SeCreatePagefilePrivilege 1184 Explorer.EXE Token: SeShutdownPrivilege 1184 Explorer.EXE Token: SeCreatePagefilePrivilege 1184 Explorer.EXE Token: SeShutdownPrivilege 1184 Explorer.EXE Token: SeCreatePagefilePrivilege 1184 Explorer.EXE Token: SeShutdownPrivilege 1184 Explorer.EXE Token: SeCreatePagefilePrivilege 1184 Explorer.EXE Token: SeShutdownPrivilege 1184 Explorer.EXE Token: SeCreatePagefilePrivilege 1184 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1184 Explorer.EXE 1184 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
CSA73881.exeExplorer.EXEcontrol.exedescription pid process target process PID 1472 wrote to memory of 3456 1472 CSA73881.exe InstallUtil.exe PID 1472 wrote to memory of 3456 1472 CSA73881.exe InstallUtil.exe PID 1472 wrote to memory of 3456 1472 CSA73881.exe InstallUtil.exe PID 1472 wrote to memory of 3456 1472 CSA73881.exe InstallUtil.exe PID 1472 wrote to memory of 3456 1472 CSA73881.exe InstallUtil.exe PID 1472 wrote to memory of 3456 1472 CSA73881.exe InstallUtil.exe PID 1184 wrote to memory of 4992 1184 Explorer.EXE control.exe PID 1184 wrote to memory of 4992 1184 Explorer.EXE control.exe PID 1184 wrote to memory of 4992 1184 Explorer.EXE control.exe PID 4992 wrote to memory of 2172 4992 control.exe cmd.exe PID 4992 wrote to memory of 2172 4992 control.exe cmd.exe PID 4992 wrote to memory of 2172 4992 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CSA73881.exe"C:\Users\Admin\AppData\Local\Temp\CSA73881.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1184-141-0x0000000002EB0000-0x0000000002FEA000-memory.dmpFilesize
1.2MB
-
memory/1184-150-0x0000000003330000-0x00000000033D6000-memory.dmpFilesize
664KB
-
memory/1184-148-0x0000000003330000-0x00000000033D6000-memory.dmpFilesize
664KB
-
memory/1472-131-0x0000000005260000-0x0000000005804000-memory.dmpFilesize
5.6MB
-
memory/1472-132-0x0000000004ED0000-0x0000000004F62000-memory.dmpFilesize
584KB
-
memory/1472-133-0x0000000005020000-0x000000000502A000-memory.dmpFilesize
40KB
-
memory/1472-134-0x00000000051E0000-0x0000000005202000-memory.dmpFilesize
136KB
-
memory/1472-130-0x00000000001C0000-0x00000000003DC000-memory.dmpFilesize
2.1MB
-
memory/2172-146-0x0000000000000000-mapping.dmp
-
memory/3456-140-0x0000000001680000-0x0000000001695000-memory.dmpFilesize
84KB
-
memory/3456-139-0x0000000001330000-0x000000000167A000-memory.dmpFilesize
3.3MB
-
memory/3456-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3456-136-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3456-135-0x0000000000000000-mapping.dmp
-
memory/4992-142-0x0000000000000000-mapping.dmp
-
memory/4992-143-0x0000000000540000-0x0000000000567000-memory.dmpFilesize
156KB
-
memory/4992-145-0x0000000002BF0000-0x0000000002F3A000-memory.dmpFilesize
3.3MB
-
memory/4992-144-0x0000000000B60000-0x0000000000B8F000-memory.dmpFilesize
188KB
-
memory/4992-147-0x0000000002A60000-0x0000000002AF4000-memory.dmpFilesize
592KB
-
memory/4992-149-0x0000000000B60000-0x0000000000B8F000-memory.dmpFilesize
188KB