Analysis
-
max time kernel
173s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2022 15:25
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
459KB
-
MD5
7a51e6b13d6568f50f2bbf7650b09403
-
SHA1
1f3f31636c54f1f021afc372fe7f97d74baaf942
-
SHA256
3a26dd85c2956529f42c1622a093f7b817cbd4af7a474d75198df9e455ac753f
-
SHA512
c0d4fbff3c1e31fa688a558340d850dcb637def55882dfe93620c8c92972757d10ffb1c9e99aa8c08a757d92989e898b4710550fbac7d8a14d777daf02c5c2db
-
SSDEEP
12288:i/4TZ+87mkPFUy0fxws0fkrzza48I5pFhjGdiLyo7Qz+Y2wjVMJ2p:iby05ws0izza486lj8Ol7TY2wBMJ+
Malware Config
Extracted
formbook
f4ca
omFHB5ajfJi1UEIEV9XcoRw=
UBjJkmQPyprdhcFF/bdCWQ==
evGKkBUj1je+otcfpw==
KgvGVeOATSt3nug0BIOm2JvOQycB
Lv6o3K0r9aSjI0lr9fg1txw=
LH1jJb/HieQpsEdqWCQTvX2PmsDVIeg=
99dte0XauJfk6Xv+uQxJFgA1gMktBA==
21FkkGB9gMniDQw2ffu6
r4lKBM/q6TZwVZfS
F+14qHeVWi56KdQ=
BgWXRsVoICMvvQ==
I+EozFl0Uy56KdQ=
xoXCgEllKEbWfjFCCLo=
qo9G1lXvvGt5GkxrLQWw
ORNlYic0PJ2ip4geEFSv
Yj+GFpvFxy0uVYx1fLI/XQ==
XL+veIKPjOTe4fjvFs+n
D2JKVAfuakXCAyoEvw==
voWJU81tH56wvt/vImbCcgVd
dVEcwFrmb8bZ4vXvFs+n
CMlcaOUF6cB+8Bnm2Kc=
NpYV3moXNE+ZQ4f9nVGCSA==
/GRkjGd1acLHyeLvImbCcgVd
R52MlF+Ag+LtFr1QKa7Zf/5a
kVD/mSO1YK75pA==
5q3IANfo/JHiDww2ffu6
4i8RFOH2ACRdhzja
VLWOSRe00XX6sNsijPzqiiWfFgf1J+g=
qnsgRFL46lWG
xo1QHOyKS9rj4fjvFs+n
mIHZlAqzS6ymmpMCU1uyZgE=
WCtjiGCFl/4JTiJ0R60=
c0vpAtZ3fY7TeLfdcnASQg==
Y87Xlic9/1+q3g/pUArVoB4=
kKOsRsf05wBOd67a
dDmgYgOZZ0aCMVwgDha4bgc=
ieXCbvcCyja+otcfpw==
Fd0XQwkTHHaBmNDvImbCcgVd
PK/M6eM8xOwqvw==
Pf0q8MdfICMvvQ==
EO8aPQwf7z2Du+XvImbCcgVd
BeUisSg/Ql6uJcg=
ay2v2pz4gomTESLosQ==
AGjX3ak2B+FyQ9ZKrQ==
Du0y0UXomyoxT4/arA8Du3FvpwE=
xhV7OrDTdonq4fjvFs+n
9+s2xTlaW66p2IAAnVkDQA==
AuS2UeN4Nsvl5vo8J67Zf/5a
B1vK2590RiUuuw==
/709BIUfMCIln8sus2u2aAM=
BMpYckjp699wVZfS
Pf2AqIscEhlpHlnV18IvVQk=
RKUTxUbz/zFroN/LLq+kIdZM
IuuiQ9pj7ZzciLVPiks4Rxc=
0KBn8XAV7NNm2xPxuA==
nv7yBtDj4UNE/ju8er1EZSanBXfyLv4=
sBgf41X1vKTwUspTsg==
5bk4+oQWD+X01tBEqQ==
c08KjxWnau8DDSsESMKNI+P5G/6/sYjU6g==
RJiyeEVj/N3rhNAW3qU=
v6O7hhQxA//+Oyq2ms9DWQ==
7MdHCYCb4OT5pg==
Je0NLgIfKIeFuyjxYD+i
68P+tIkhBdlwVZfS
inthecryptolane.com
Signatures
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
file.exeCasPol.execontrol.exedescription pid process target process PID 1904 set thread context of 3656 1904 file.exe CasPol.exe PID 3656 set thread context of 1936 3656 CasPol.exe Explorer.EXE PID 3656 set thread context of 1936 3656 CasPol.exe Explorer.EXE PID 2488 set thread context of 1936 2488 control.exe Explorer.EXE -
Processes:
control.exedescription ioc process Key created \Registry\User\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 control.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
file.exeCasPol.execontrol.exepid process 1904 file.exe 1904 file.exe 3656 CasPol.exe 3656 CasPol.exe 3656 CasPol.exe 3656 CasPol.exe 3656 CasPol.exe 3656 CasPol.exe 3656 CasPol.exe 3656 CasPol.exe 3656 CasPol.exe 3656 CasPol.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1936 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
CasPol.execontrol.exepid process 3656 CasPol.exe 3656 CasPol.exe 3656 CasPol.exe 3656 CasPol.exe 2488 control.exe 2488 control.exe 2488 control.exe 2488 control.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
file.exeCasPol.execontrol.exedescription pid process Token: SeDebugPrivilege 1904 file.exe Token: SeDebugPrivilege 3656 CasPol.exe Token: SeDebugPrivilege 2488 control.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
file.exeExplorer.EXEcontrol.exedescription pid process target process PID 1904 wrote to memory of 2796 1904 file.exe CasPol.exe PID 1904 wrote to memory of 2796 1904 file.exe CasPol.exe PID 1904 wrote to memory of 2796 1904 file.exe CasPol.exe PID 1904 wrote to memory of 3656 1904 file.exe CasPol.exe PID 1904 wrote to memory of 3656 1904 file.exe CasPol.exe PID 1904 wrote to memory of 3656 1904 file.exe CasPol.exe PID 1904 wrote to memory of 3656 1904 file.exe CasPol.exe PID 1904 wrote to memory of 3656 1904 file.exe CasPol.exe PID 1904 wrote to memory of 3656 1904 file.exe CasPol.exe PID 1936 wrote to memory of 2488 1936 Explorer.EXE control.exe PID 1936 wrote to memory of 2488 1936 Explorer.EXE control.exe PID 1936 wrote to memory of 2488 1936 Explorer.EXE control.exe PID 2488 wrote to memory of 4260 2488 control.exe Firefox.exe PID 2488 wrote to memory of 4260 2488 control.exe Firefox.exe PID 2488 wrote to memory of 4260 2488 control.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"3⤵PID:2796
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3656 -
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:4260
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1904-137-0x00007FFE7DFA0000-0x00007FFE7EA61000-memory.dmpFilesize
10.8MB
-
memory/1904-133-0x00007FFE7DFA0000-0x00007FFE7EA61000-memory.dmpFilesize
10.8MB
-
memory/1904-132-0x0000028573080000-0x00000285730F8000-memory.dmpFilesize
480KB
-
memory/1936-143-0x0000000002680000-0x00000000027A9000-memory.dmpFilesize
1.2MB
-
memory/1936-155-0x0000000007FD0000-0x0000000008098000-memory.dmpFilesize
800KB
-
memory/1936-157-0x0000000007FD0000-0x0000000008098000-memory.dmpFilesize
800KB
-
memory/1936-147-0x0000000007E30000-0x0000000007FCC000-memory.dmpFilesize
1.6MB
-
memory/2488-156-0x0000000001030000-0x000000000105D000-memory.dmpFilesize
180KB
-
memory/2488-154-0x0000000002D30000-0x0000000002DBF000-memory.dmpFilesize
572KB
-
memory/2488-153-0x0000000002FD0000-0x000000000331A000-memory.dmpFilesize
3.3MB
-
memory/2488-151-0x0000000000CC0000-0x0000000000CE7000-memory.dmpFilesize
156KB
-
memory/2488-152-0x0000000001030000-0x000000000105D000-memory.dmpFilesize
180KB
-
memory/2488-148-0x0000000000000000-mapping.dmp
-
memory/3656-139-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/3656-146-0x0000000000C00000-0x0000000000C10000-memory.dmpFilesize
64KB
-
memory/3656-149-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3656-150-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/3656-145-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/3656-144-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3656-142-0x00000000005F0000-0x0000000000600000-memory.dmpFilesize
64KB
-
memory/3656-140-0x00000000010C0000-0x000000000140A000-memory.dmpFilesize
3.3MB
-
memory/3656-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3656-135-0x00000000004012B0-mapping.dmp
-
memory/3656-134-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB