Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
18-11-2022 22:42
Static task
static1
Behavioral task
behavioral1
Sample
IyEXXDHLEU4cBtq.exe
Resource
win7-20221111-en
General
-
Target
IyEXXDHLEU4cBtq.exe
-
Size
721KB
-
MD5
0dd734598701e5ba50d5596a42b8d94c
-
SHA1
d6cf2163dd892eb8c5e274856c61e9f90b03d1d9
-
SHA256
501d6ddc2677cf909cdf85570bfbf09099004a108236bb25954758387f080b9f
-
SHA512
d22bf5d34170f274883346349b3093d90d15a5769e9d6a1a7fb75e6230b9bce373af1f7601d40c19aa34551bbcbc08170cae464651525bdc02d418efd378c745
-
SSDEEP
12288:yxBnM33302IgFJN0V3foFtswOSf5nHoHY8up3wxb4xZ2cbTEcjZnbCkI:YBnG30YComSxEY8gwxED2SBjZnbCkI
Malware Config
Extracted
formbook
bmr1
q05YNsJC4MpYLGAf4A==
6KUzKCvwX0fwzrFQXvlucw==
KA4ZibW1w+hWN5Q=
TfgNq18tIWtsM7h+DexncQ==
zspNqjUKBdJVHTkiMMXJYeF7G53bVvMPoA==
hopQr+b8KzPIbMWvw0Yxir6cyw==
2thmt+17FR/MVsakbM/+w3xGOhopJw==
5gO5gfA6jwna/4FNSPqrvvHyr2A=
kqtr0wr9KaOXVMyDDexncQ==
PNldyz0Boa5cLGAf4A==
Gysor7fqabd0UzTwWp3Zir6cyw==
pMRgV18gtLorB21prX4=
ukpf+vu2u+hWN5Q=
pcS/rO+KmPMj69G9cMHnoSEm59cbIQ==
4fWGzv347bFNDYJeeIHKG5co
WXlRyM2Yn+4Ab1EgRAFHWdGDCzf1
ZPoM+2U1cwMzteOBsHY=
o8jQoNron4sT3A/KomE=
7QX8tTpv/A+YKw==
wFvmV8SY/A+YKw==
95ZJuruBovPziXkgyca4
DMhVqQXTdWLZcWM3IVNtZg==
Fya6G31VF/eHQ+OBsHY=
Q1AMfbPC2yU1IZV9q4C8vvHyr2A=
fRtdZZssSsG3s6Z7
bxBFLS8FnGv/bdOdDdjmfHz9ww==
0YG+jc1b/A+YKw==
lRliT3IEEDJ4ZoZ8a+7meQ==
dI7SuWbu40M=
Z4oXeMBk6sdDMow=
h5BX2BodM4ChJyEJXWhZEIlmBBTw
cYNHnMHSDHNoFn5XDexncQ==
U4uXeMXGel/Yo5F7JWy7ir6cyw==
w30JX9IHAfmEUkjMfJSh
nyYeAHdAO4ibDfK6+QoHkxDjQ0L/
kRNHMSv9qT1YAOi+/YTEubWayQ==
K84SAQbaiIE2JhEBwkI87fHyr2A=
/TfyyBrkRXG3s6Z7
Xm4DxD9z/A+YKw==
Iiod8GDRqTNm
UQavJOBL1PauNg==
5gHqohpY/A+YKw==
p9NjrOfd7y00suOBsHY=
+QwD0hEcmOH9FrqKOoip
t1ynrb95ITDbVcCcYLbyyYAhz/aC86DP
nsJ4j550C9tdGUvpa9jieQ==
2UyPicBXYsG3s6Z7
JcXRsh7oFKPHNx7+VFi2w/Hyr2A=
3AT+4Rqw0TI3s+OBsHY=
0m73TYSQvcdyP7Khu0w87fHyr2A=
0tyaI3KOu9UtnY5MWuNVKWo=
SXV//PAYkeL6tJB6LnC7ir6cyw==
BZ3ZnFfRqTNm
DIiVdbFCcAQd/3FWhBPOSNDjQ0L/
PzqDVoWG2r6rM5N9histir6cyw==
QFxDG5iTNsm3s6Z7
K07iK1LZc1POTrmDDexncQ==
1WJ3D0tnnQICtizlgdNO55Ii
Y3YBWZCixOhWN5Q=
N1AaNH32m3YaLGAf4A==
2wYTDEnS7XWxVTvMfJSh
Um9jMnNrA+BtRUDMfJSh
8eqyDgzQxuhWN5Q=
JbnNV71HXsW3s6Z7
escortsforme.com
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
IyEXXDHLEU4cBtq.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation IyEXXDHLEU4cBtq.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
IyEXXDHLEU4cBtq.exeIyEXXDHLEU4cBtq.execontrol.exedescription pid process target process PID 4976 set thread context of 1236 4976 IyEXXDHLEU4cBtq.exe IyEXXDHLEU4cBtq.exe PID 1236 set thread context of 2340 1236 IyEXXDHLEU4cBtq.exe Explorer.EXE PID 1440 set thread context of 2340 1440 control.exe Explorer.EXE -
Processes:
control.exedescription ioc process Key created \Registry\User\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 control.exe -
Suspicious behavior: EnumeratesProcesses 38 IoCs
Processes:
IyEXXDHLEU4cBtq.execontrol.exepid process 1236 IyEXXDHLEU4cBtq.exe 1236 IyEXXDHLEU4cBtq.exe 1236 IyEXXDHLEU4cBtq.exe 1236 IyEXXDHLEU4cBtq.exe 1236 IyEXXDHLEU4cBtq.exe 1236 IyEXXDHLEU4cBtq.exe 1236 IyEXXDHLEU4cBtq.exe 1236 IyEXXDHLEU4cBtq.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2340 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
IyEXXDHLEU4cBtq.execontrol.exepid process 1236 IyEXXDHLEU4cBtq.exe 1236 IyEXXDHLEU4cBtq.exe 1236 IyEXXDHLEU4cBtq.exe 1440 control.exe 1440 control.exe 1440 control.exe 1440 control.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
IyEXXDHLEU4cBtq.execontrol.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1236 IyEXXDHLEU4cBtq.exe Token: SeDebugPrivilege 1440 control.exe Token: SeShutdownPrivilege 2340 Explorer.EXE Token: SeCreatePagefilePrivilege 2340 Explorer.EXE Token: SeShutdownPrivilege 2340 Explorer.EXE Token: SeCreatePagefilePrivilege 2340 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 2340 Explorer.EXE 2340 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
IyEXXDHLEU4cBtq.exeExplorer.EXEcontrol.exedescription pid process target process PID 4976 wrote to memory of 1236 4976 IyEXXDHLEU4cBtq.exe IyEXXDHLEU4cBtq.exe PID 4976 wrote to memory of 1236 4976 IyEXXDHLEU4cBtq.exe IyEXXDHLEU4cBtq.exe PID 4976 wrote to memory of 1236 4976 IyEXXDHLEU4cBtq.exe IyEXXDHLEU4cBtq.exe PID 4976 wrote to memory of 1236 4976 IyEXXDHLEU4cBtq.exe IyEXXDHLEU4cBtq.exe PID 4976 wrote to memory of 1236 4976 IyEXXDHLEU4cBtq.exe IyEXXDHLEU4cBtq.exe PID 4976 wrote to memory of 1236 4976 IyEXXDHLEU4cBtq.exe IyEXXDHLEU4cBtq.exe PID 2340 wrote to memory of 1440 2340 Explorer.EXE control.exe PID 2340 wrote to memory of 1440 2340 Explorer.EXE control.exe PID 2340 wrote to memory of 1440 2340 Explorer.EXE control.exe PID 1440 wrote to memory of 3464 1440 control.exe Firefox.exe PID 1440 wrote to memory of 3464 1440 control.exe Firefox.exe PID 1440 wrote to memory of 3464 1440 control.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IyEXXDHLEU4cBtq.exe"C:\Users\Admin\AppData\Local\Temp\IyEXXDHLEU4cBtq.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IyEXXDHLEU4cBtq.exe"C:\Users\Admin\AppData\Local\Temp\IyEXXDHLEU4cBtq.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1236-143-0x0000000000FA0000-0x00000000012EA000-memory.dmpFilesize
3.3MB
-
memory/1236-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1236-142-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1236-141-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1236-144-0x00000000009E0000-0x00000000009F0000-memory.dmpFilesize
64KB
-
memory/1236-137-0x0000000000000000-mapping.dmp
-
memory/1236-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1440-149-0x0000000002CD0000-0x000000000301A000-memory.dmpFilesize
3.3MB
-
memory/1440-150-0x0000000002BB0000-0x0000000002C3F000-memory.dmpFilesize
572KB
-
memory/1440-151-0x0000000000B70000-0x0000000000B9D000-memory.dmpFilesize
180KB
-
memory/1440-147-0x0000000000530000-0x0000000000557000-memory.dmpFilesize
156KB
-
memory/1440-148-0x0000000000B70000-0x0000000000B9D000-memory.dmpFilesize
180KB
-
memory/1440-146-0x0000000000000000-mapping.dmp
-
memory/2340-145-0x00000000031E0000-0x00000000032B6000-memory.dmpFilesize
856KB
-
memory/2340-152-0x0000000008A30000-0x0000000008B43000-memory.dmpFilesize
1.1MB
-
memory/2340-153-0x0000000008A30000-0x0000000008B43000-memory.dmpFilesize
1.1MB
-
memory/4976-135-0x0000000005710000-0x000000000571A000-memory.dmpFilesize
40KB
-
memory/4976-136-0x00000000079C0000-0x0000000007A5C000-memory.dmpFilesize
624KB
-
memory/4976-134-0x0000000005660000-0x00000000056F2000-memory.dmpFilesize
584KB
-
memory/4976-133-0x0000000005D70000-0x0000000006314000-memory.dmpFilesize
5.6MB
-
memory/4976-132-0x0000000000C20000-0x0000000000CDA000-memory.dmpFilesize
744KB