Analysis
-
max time kernel
146s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 07:57
Behavioral task
behavioral1
Sample
0x00090000000133ec-58.exe
Resource
win7-20220901-en
General
-
Target
0x00090000000133ec-58.exe
-
Size
185KB
-
MD5
a20ea9350fa5aa4d9641723f3dfc1b31
-
SHA1
c23cf2953ea071eac81740a687473442c66e73de
-
SHA256
01afe1517575e1fd7f60e86702fc11a97cfc74718e520c6016eef42fa164b4ae
-
SHA512
296b4ace0af1f33abb8c3c0262999b07c8ad6e9a4c075959b43335992f1058865581b2c7d362dc824ed787f61dc9c62338778cd28e12add2ac34b086ca62e035
-
SSDEEP
3072:MvcKNG8E11C6YVIu331anQzzaXqPzOOZy36OWQ8sSCxVCmif6:WNGvKeI3MMzaqPzO9tECxVef6
Malware Config
Extracted
formbook
4.1
a24e
flormarine.co.uk
theglazingsquad.uk
konarkpharma.com
maxpropertyfinanceuk.co.uk
jackson-ifc.com
yvonneazevedoimoveis.net
baystella.com
arexbaba.online
trihgd.xyz
filth520571.com
cikpkg.cfd
jakesupport.com
8863365.com
duniaslot777.online
lop3a.com
berkut-clan.ru
lernnavigator.com
elenaisaprincess.co.uk
daimadaquan.xyz
mychirocart.net
auroraalerts.uk
dunaphotography.com
netspirit.africa
alborhaneye.com
dwentalplans.com
95878.se
family-doctor-49371.com
grafonord.se
avimpactfit.com
growthlabus.com
kidney-life.com
delightfulappearance.com
valleymistst.co.uk
getasalaryraise.com
hongqiqu.vip
arkadiumstore.com
gaskansaja.click
getv3apparel.com
3888my.com
flaginyard.com
applehci.com
politouniversity.com
health-23.com
asciana.com
estheticdoctorturkey.com
bkes-2023.info
6bitly.com
abopappas.online
faridfabrics.com
td0.online
seosquid.co.uk
0731ye.net
alliotcloud.top
gxin-cn.com
96yz857.xyz
tekniik.co.uk
histarfamily.com
industrailglasstech.com
ioqpht6c.store
dacodig.com
emaliaolkusz1907.com
hjd533.com
dentalblueprints.com
amberdrichardson.com
balloonbanarasdecorator.com
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1188-60-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook behavioral1/memory/1188-64-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2044 cmd.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
0x00090000000133ec-58.exewininit.exedescription pid process target process PID 1416 set thread context of 1284 1416 0x00090000000133ec-58.exe Explorer.EXE PID 1188 set thread context of 1284 1188 wininit.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
0x00090000000133ec-58.exewininit.exepid process 1416 0x00090000000133ec-58.exe 1416 0x00090000000133ec-58.exe 1188 wininit.exe 1188 wininit.exe 1188 wininit.exe 1188 wininit.exe 1188 wininit.exe 1188 wininit.exe 1188 wininit.exe 1188 wininit.exe 1188 wininit.exe 1188 wininit.exe 1188 wininit.exe 1188 wininit.exe 1188 wininit.exe 1188 wininit.exe 1188 wininit.exe 1188 wininit.exe 1188 wininit.exe 1188 wininit.exe 1188 wininit.exe 1188 wininit.exe 1188 wininit.exe 1188 wininit.exe 1188 wininit.exe 1188 wininit.exe 1188 wininit.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
0x00090000000133ec-58.exewininit.exepid process 1416 0x00090000000133ec-58.exe 1416 0x00090000000133ec-58.exe 1416 0x00090000000133ec-58.exe 1188 wininit.exe 1188 wininit.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
0x00090000000133ec-58.exewininit.exedescription pid process Token: SeDebugPrivilege 1416 0x00090000000133ec-58.exe Token: SeDebugPrivilege 1188 wininit.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Explorer.EXEwininit.exedescription pid process target process PID 1284 wrote to memory of 1188 1284 Explorer.EXE wininit.exe PID 1284 wrote to memory of 1188 1284 Explorer.EXE wininit.exe PID 1284 wrote to memory of 1188 1284 Explorer.EXE wininit.exe PID 1284 wrote to memory of 1188 1284 Explorer.EXE wininit.exe PID 1188 wrote to memory of 2044 1188 wininit.exe cmd.exe PID 1188 wrote to memory of 2044 1188 wininit.exe cmd.exe PID 1188 wrote to memory of 2044 1188 wininit.exe cmd.exe PID 1188 wrote to memory of 2044 1188 wininit.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\0x00090000000133ec-58.exe"C:\Users\Admin\AppData\Local\Temp\0x00090000000133ec-58.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1416 -
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\0x00090000000133ec-58.exe"3⤵
- Deletes itself
PID:2044
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1188-60-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB
-
memory/1188-57-0x0000000000000000-mapping.dmp
-
memory/1188-59-0x0000000000140000-0x000000000015A000-memory.dmpFilesize
104KB
-
memory/1188-61-0x0000000001E90000-0x0000000002193000-memory.dmpFilesize
3.0MB
-
memory/1188-62-0x0000000001D30000-0x0000000001DC3000-memory.dmpFilesize
588KB
-
memory/1188-64-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB
-
memory/1188-66-0x0000000074DC1000-0x0000000074DC3000-memory.dmpFilesize
8KB
-
memory/1284-56-0x0000000006B70000-0x0000000006D04000-memory.dmpFilesize
1.6MB
-
memory/1284-63-0x0000000006D10000-0x0000000006E6E000-memory.dmpFilesize
1.4MB
-
memory/1284-65-0x0000000006D10000-0x0000000006E6E000-memory.dmpFilesize
1.4MB
-
memory/1416-55-0x0000000000190000-0x00000000001A4000-memory.dmpFilesize
80KB
-
memory/1416-54-0x0000000000930000-0x0000000000C33000-memory.dmpFilesize
3.0MB
-
memory/2044-58-0x0000000000000000-mapping.dmp