Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18-09-2022 03:06
Static task
static1
Behavioral task
behavioral1
Sample
6c2afb194cebad7f9babba679528aea18b3c7754a9a6e602b91d80353aedd501.exe
Resource
win7-20220812-en
General
-
Target
6c2afb194cebad7f9babba679528aea18b3c7754a9a6e602b91d80353aedd501.exe
-
Size
288KB
-
MD5
b8b284b3a4e835f5b3785b9ffe794e9d
-
SHA1
448bb364b3713aa4cad2637eedf008ad4ba1f05c
-
SHA256
6c2afb194cebad7f9babba679528aea18b3c7754a9a6e602b91d80353aedd501
-
SHA512
9a111fcc66fed623ffbf743649b5a5ec00d6365d7d2afe0ae32d8bfd66b075d4a4e74b25b4d9ff0e14e8a9ea4c5dc206e24af0002ee9130168b9a8708b84b6ea
-
SSDEEP
6144:HyPgfiscyrkdbMjgFP9lpYQKe/YC0R2nBtH6KZyxHro6aRtzG:SPgacw5MjmsQdYC0iIK4xHs6aRt6
Malware Config
Extracted
formbook
dwdp
jPxWFTS1Rn/K/LD47WRRW7+Veuct8yc=
ke1Wv1l26dZZxDikX9dU3s6k8+w=
+vtNyVBkx8VMf5KCaIj8DYR5QyLJgQ==
GHXPhYzwXcKgZwqBb/kejm7rfobj
yalW64iE8+aXs70=
MD83dBR0KSF4fizgRhAM
Xti3uNm2JDWgssPgRhAM
X7gYbv5uJhpvjdI0Qg==
ydxGznbNJ3tCCLAX4arq4nweMuQ=
Ca+fvtST8OBbosPgRhAM
kG1QegD8mU/E/hLw1t0=
g9FFFjEC5C2IvR/BhbSrpw==
PCkpeg38W0aPdg1rav1DFnVASw==
vSq+xBf3qjY27H3yqepK+g+nOmOMc3m7
G7WYirSZS9EYob8=
WbEWaOVIAPlSNNc4LsfL53weMuQ=
hnyAvEY4n3rTKS4g5mHKxR0=
JN7b0uCqVrQydMl7JNw=
XTki/RASDK6BCW0q8sU=
DQMBWA9wJyOKqqGSmGHKxR0=
nJmd4HyE8g0mfqI=
6dfYKMvIhrcUa8l7JNw=
rUlBWHBUCn1c8CQA8PXzeVzrfobj
58Kt4lz9o6QF
cL0w6PZmKlfE8RoS5TDZMyH0
2Lyico9qDju7nr2X
b374NM2N3g0mfqI=
bVEtbg0KgZj533zw7n631TknAk9sHT4=
ZuNZIBhiw04fmLueUhJMOeZf+ilfHy8=
GBxm5ITLhl5XQOlF4DDZMyH0
6zulYX1WAoNl0vXmhkauyDcT8kdhBi0=
pZeodP1cQf3SyQtfUQ==
wsAZpF7WPbCJEDQt62HKxR0=
1A1vRW5BJHzzXsl7JNw=
ubG/Epl9PIb7Xtot5mHKxR0=
ExcR7v/y1XBW6wjRx722VlHrfobj
tvtepCyscmPvrsCd
QM28Ja5N8A0mfqI=
/UuzOsQY+8WgidZJSA==
pk0ZWgUKfY4STnqImJ/ZMyH0
0/4UFT1EL86yidZJSA==
mLH6x//qm+bQvFjJpKLZMyH0
yFLYqcdEtlNQ+ovii1iGrw==
CQUKN8PsFUSwtsPgRhAM
d1JHSBRgO1zvrsCd
EX/80uRL4gztasl7JNw=
VjpQXmhQEpTVRtNISg==
icUPYOYDaj6XzNmfS4jiZkwfc3aMc3m7
YbwogyCIP+zDssTgRhAM
liKeXXL3XdW2idZJSA==
DpZxgK191uNXWDttEgV8qQ==
yCQSTlcofmfvrsCd
0HdbxU5gWZTXChULh3d8uA==
wulP5XjDdoXs8AHdilE/176mQyLJgQ==
ftUzeAdbDsGQTdNB8DTZMyH0
LyYshzZrwiL1rjbYaRIb
FxUI3fDvJSiI4+zJw9Q=
tso/3IMC7yKg1ff08AVG7tGEWT+1Rdqz
2R+QH6SM7g0mfqI=
lshW53vMIIyAR+95LXaOoAb2U3WMc3m7
JGv37fpftjotxk/Fi1iGrw==
QTswdBsMz2xN4nHfi1iGrw==
ATODSoRwHZylR6dFP0+MJBU=
TWfBPutYujsoxlzNi1iGrw==
fedefarmatour.online
Extracted
xloader
3.8
dwdp
jPxWFTS1Rn/K/LD47WRRW7+Veuct8yc=
ke1Wv1l26dZZxDikX9dU3s6k8+w=
+vtNyVBkx8VMf5KCaIj8DYR5QyLJgQ==
GHXPhYzwXcKgZwqBb/kejm7rfobj
yalW64iE8+aXs70=
MD83dBR0KSF4fizgRhAM
Xti3uNm2JDWgssPgRhAM
X7gYbv5uJhpvjdI0Qg==
ydxGznbNJ3tCCLAX4arq4nweMuQ=
Ca+fvtST8OBbosPgRhAM
kG1QegD8mU/E/hLw1t0=
g9FFFjEC5C2IvR/BhbSrpw==
PCkpeg38W0aPdg1rav1DFnVASw==
vSq+xBf3qjY27H3yqepK+g+nOmOMc3m7
G7WYirSZS9EYob8=
WbEWaOVIAPlSNNc4LsfL53weMuQ=
hnyAvEY4n3rTKS4g5mHKxR0=
JN7b0uCqVrQydMl7JNw=
XTki/RASDK6BCW0q8sU=
DQMBWA9wJyOKqqGSmGHKxR0=
nJmd4HyE8g0mfqI=
6dfYKMvIhrcUa8l7JNw=
rUlBWHBUCn1c8CQA8PXzeVzrfobj
58Kt4lz9o6QF
cL0w6PZmKlfE8RoS5TDZMyH0
2Lyico9qDju7nr2X
b374NM2N3g0mfqI=
bVEtbg0KgZj533zw7n631TknAk9sHT4=
ZuNZIBhiw04fmLueUhJMOeZf+ilfHy8=
GBxm5ITLhl5XQOlF4DDZMyH0
6zulYX1WAoNl0vXmhkauyDcT8kdhBi0=
pZeodP1cQf3SyQtfUQ==
wsAZpF7WPbCJEDQt62HKxR0=
1A1vRW5BJHzzXsl7JNw=
ubG/Epl9PIb7Xtot5mHKxR0=
ExcR7v/y1XBW6wjRx722VlHrfobj
tvtepCyscmPvrsCd
QM28Ja5N8A0mfqI=
/UuzOsQY+8WgidZJSA==
pk0ZWgUKfY4STnqImJ/ZMyH0
0/4UFT1EL86yidZJSA==
mLH6x//qm+bQvFjJpKLZMyH0
yFLYqcdEtlNQ+ovii1iGrw==
CQUKN8PsFUSwtsPgRhAM
d1JHSBRgO1zvrsCd
EX/80uRL4gztasl7JNw=
VjpQXmhQEpTVRtNISg==
icUPYOYDaj6XzNmfS4jiZkwfc3aMc3m7
YbwogyCIP+zDssTgRhAM
liKeXXL3XdW2idZJSA==
DpZxgK191uNXWDttEgV8qQ==
yCQSTlcofmfvrsCd
0HdbxU5gWZTXChULh3d8uA==
wulP5XjDdoXs8AHdilE/176mQyLJgQ==
ftUzeAdbDsGQTdNB8DTZMyH0
LyYshzZrwiL1rjbYaRIb
FxUI3fDvJSiI4+zJw9Q=
tso/3IMC7yKg1ff08AVG7tGEWT+1Rdqz
2R+QH6SM7g0mfqI=
lshW53vMIIyAR+95LXaOoAb2U3WMc3m7
JGv37fpftjotxk/Fi1iGrw==
QTswdBsMz2xN4nHfi1iGrw==
ATODSoRwHZylR6dFP0+MJBU=
TWfBPutYujsoxlzNi1iGrw==
fedefarmatour.online
Signatures
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
6c2afb194cebad7f9babba679528aea18b3c7754a9a6e602b91d80353aedd501.execvtres.execontrol.exedescription pid process target process PID 3208 set thread context of 2028 3208 6c2afb194cebad7f9babba679528aea18b3c7754a9a6e602b91d80353aedd501.exe cvtres.exe PID 2028 set thread context of 3080 2028 cvtres.exe Explorer.EXE PID 3392 set thread context of 3080 3392 control.exe Explorer.EXE -
Processes:
control.exedescription ioc process Key created \Registry\User\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 control.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
cvtres.execontrol.exepid process 2028 cvtres.exe 2028 cvtres.exe 2028 cvtres.exe 2028 cvtres.exe 2028 cvtres.exe 2028 cvtres.exe 2028 cvtres.exe 2028 cvtres.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
cvtres.execontrol.exepid process 2028 cvtres.exe 2028 cvtres.exe 2028 cvtres.exe 3392 control.exe 3392 control.exe 3392 control.exe 3392 control.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
cvtres.execontrol.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 2028 cvtres.exe Token: SeDebugPrivilege 3392 control.exe Token: SeShutdownPrivilege 3080 Explorer.EXE Token: SeCreatePagefilePrivilege 3080 Explorer.EXE Token: SeShutdownPrivilege 3080 Explorer.EXE Token: SeCreatePagefilePrivilege 3080 Explorer.EXE Token: SeShutdownPrivilege 3080 Explorer.EXE Token: SeCreatePagefilePrivilege 3080 Explorer.EXE Token: SeShutdownPrivilege 3080 Explorer.EXE Token: SeCreatePagefilePrivilege 3080 Explorer.EXE Token: SeShutdownPrivilege 3080 Explorer.EXE Token: SeCreatePagefilePrivilege 3080 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
6c2afb194cebad7f9babba679528aea18b3c7754a9a6e602b91d80353aedd501.exeExplorer.EXEcontrol.exedescription pid process target process PID 3208 wrote to memory of 2028 3208 6c2afb194cebad7f9babba679528aea18b3c7754a9a6e602b91d80353aedd501.exe cvtres.exe PID 3208 wrote to memory of 2028 3208 6c2afb194cebad7f9babba679528aea18b3c7754a9a6e602b91d80353aedd501.exe cvtres.exe PID 3208 wrote to memory of 2028 3208 6c2afb194cebad7f9babba679528aea18b3c7754a9a6e602b91d80353aedd501.exe cvtres.exe PID 3208 wrote to memory of 2028 3208 6c2afb194cebad7f9babba679528aea18b3c7754a9a6e602b91d80353aedd501.exe cvtres.exe PID 3208 wrote to memory of 2028 3208 6c2afb194cebad7f9babba679528aea18b3c7754a9a6e602b91d80353aedd501.exe cvtres.exe PID 3208 wrote to memory of 2028 3208 6c2afb194cebad7f9babba679528aea18b3c7754a9a6e602b91d80353aedd501.exe cvtres.exe PID 3080 wrote to memory of 3392 3080 Explorer.EXE control.exe PID 3080 wrote to memory of 3392 3080 Explorer.EXE control.exe PID 3080 wrote to memory of 3392 3080 Explorer.EXE control.exe PID 3392 wrote to memory of 1248 3392 control.exe Firefox.exe PID 3392 wrote to memory of 1248 3392 control.exe Firefox.exe PID 3392 wrote to memory of 1248 3392 control.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6c2afb194cebad7f9babba679528aea18b3c7754a9a6e602b91d80353aedd501.exe"C:\Users\Admin\AppData\Local\Temp\6c2afb194cebad7f9babba679528aea18b3c7754a9a6e602b91d80353aedd501.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2028-144-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/2028-133-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2028-134-0x00000000004012B0-mapping.dmp
-
memory/2028-137-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/2028-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2028-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2028-140-0x0000000001420000-0x000000000176A000-memory.dmpFilesize
3.3MB
-
memory/2028-141-0x0000000000DE0000-0x0000000000DF0000-memory.dmpFilesize
64KB
-
memory/3080-152-0x00000000029B0000-0x0000000002AF9000-memory.dmpFilesize
1.3MB
-
memory/3080-142-0x0000000002900000-0x00000000029B0000-memory.dmpFilesize
704KB
-
memory/3080-150-0x00000000029B0000-0x0000000002AF9000-memory.dmpFilesize
1.3MB
-
memory/3208-148-0x00007FFC66290000-0x00007FFC66D51000-memory.dmpFilesize
10.8MB
-
memory/3208-132-0x0000000000930000-0x000000000097E000-memory.dmpFilesize
312KB
-
memory/3208-136-0x00007FFC66290000-0x00007FFC66D51000-memory.dmpFilesize
10.8MB
-
memory/3392-145-0x0000000000060000-0x0000000000087000-memory.dmpFilesize
156KB
-
memory/3392-146-0x0000000000A70000-0x0000000000A9D000-memory.dmpFilesize
180KB
-
memory/3392-147-0x0000000002990000-0x0000000002CDA000-memory.dmpFilesize
3.3MB
-
memory/3392-143-0x0000000000000000-mapping.dmp
-
memory/3392-149-0x00000000027D0000-0x000000000285F000-memory.dmpFilesize
572KB
-
memory/3392-151-0x0000000000A70000-0x0000000000A9D000-memory.dmpFilesize
180KB