Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 07:57
Behavioral task
behavioral1
Sample
0x00090000000133ec-58.exe
Resource
win7-20220901-en
General
-
Target
0x00090000000133ec-58.exe
-
Size
185KB
-
MD5
a20ea9350fa5aa4d9641723f3dfc1b31
-
SHA1
c23cf2953ea071eac81740a687473442c66e73de
-
SHA256
01afe1517575e1fd7f60e86702fc11a97cfc74718e520c6016eef42fa164b4ae
-
SHA512
296b4ace0af1f33abb8c3c0262999b07c8ad6e9a4c075959b43335992f1058865581b2c7d362dc824ed787f61dc9c62338778cd28e12add2ac34b086ca62e035
-
SSDEEP
3072:MvcKNG8E11C6YVIu331anQzzaXqPzOOZy36OWQ8sSCxVCmif6:WNGvKeI3MMzaqPzO9tECxVef6
Malware Config
Extracted
formbook
4.1
a24e
flormarine.co.uk
theglazingsquad.uk
konarkpharma.com
maxpropertyfinanceuk.co.uk
jackson-ifc.com
yvonneazevedoimoveis.net
baystella.com
arexbaba.online
trihgd.xyz
filth520571.com
cikpkg.cfd
jakesupport.com
8863365.com
duniaslot777.online
lop3a.com
berkut-clan.ru
lernnavigator.com
elenaisaprincess.co.uk
daimadaquan.xyz
mychirocart.net
auroraalerts.uk
dunaphotography.com
netspirit.africa
alborhaneye.com
dwentalplans.com
95878.se
family-doctor-49371.com
grafonord.se
avimpactfit.com
growthlabus.com
kidney-life.com
delightfulappearance.com
valleymistst.co.uk
getasalaryraise.com
hongqiqu.vip
arkadiumstore.com
gaskansaja.click
getv3apparel.com
3888my.com
flaginyard.com
applehci.com
politouniversity.com
health-23.com
asciana.com
estheticdoctorturkey.com
bkes-2023.info
6bitly.com
abopappas.online
faridfabrics.com
td0.online
seosquid.co.uk
0731ye.net
alliotcloud.top
gxin-cn.com
96yz857.xyz
tekniik.co.uk
histarfamily.com
industrailglasstech.com
ioqpht6c.store
dacodig.com
emaliaolkusz1907.com
hjd533.com
dentalblueprints.com
amberdrichardson.com
balloonbanarasdecorator.com
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/884-137-0x00000000004B0000-0x00000000004DF000-memory.dmp formbook behavioral2/memory/884-143-0x00000000004B0000-0x00000000004DF000-memory.dmp formbook -
Suspicious use of SetThreadContext 2 IoCs
Processes:
0x00090000000133ec-58.exesystray.exedescription pid process target process PID 5104 set thread context of 2824 5104 0x00090000000133ec-58.exe Explorer.EXE PID 884 set thread context of 2824 884 systray.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
0x00090000000133ec-58.exesystray.exepid process 5104 0x00090000000133ec-58.exe 5104 0x00090000000133ec-58.exe 5104 0x00090000000133ec-58.exe 5104 0x00090000000133ec-58.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe 884 systray.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2824 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
0x00090000000133ec-58.exesystray.exepid process 5104 0x00090000000133ec-58.exe 5104 0x00090000000133ec-58.exe 5104 0x00090000000133ec-58.exe 884 systray.exe 884 systray.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
0x00090000000133ec-58.exesystray.exedescription pid process Token: SeDebugPrivilege 5104 0x00090000000133ec-58.exe Token: SeDebugPrivilege 884 systray.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Explorer.EXEsystray.exedescription pid process target process PID 2824 wrote to memory of 884 2824 Explorer.EXE systray.exe PID 2824 wrote to memory of 884 2824 Explorer.EXE systray.exe PID 2824 wrote to memory of 884 2824 Explorer.EXE systray.exe PID 884 wrote to memory of 4708 884 systray.exe cmd.exe PID 884 wrote to memory of 4708 884 systray.exe cmd.exe PID 884 wrote to memory of 4708 884 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\0x00090000000133ec-58.exe"C:\Users\Admin\AppData\Local\Temp\0x00090000000133ec-58.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:5104 -
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\0x00090000000133ec-58.exe"3⤵PID:4708
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/884-141-0x00000000021F0000-0x0000000002283000-memory.dmpFilesize
588KB
-
memory/884-135-0x0000000000000000-mapping.dmp
-
memory/884-137-0x00000000004B0000-0x00000000004DF000-memory.dmpFilesize
188KB
-
memory/884-136-0x0000000000AA0000-0x0000000000AA6000-memory.dmpFilesize
24KB
-
memory/884-139-0x00000000023B0000-0x00000000026FA000-memory.dmpFilesize
3.3MB
-
memory/884-143-0x00000000004B0000-0x00000000004DF000-memory.dmpFilesize
188KB
-
memory/2824-134-0x0000000003290000-0x0000000003389000-memory.dmpFilesize
996KB
-
memory/2824-140-0x0000000003290000-0x0000000003389000-memory.dmpFilesize
996KB
-
memory/2824-142-0x0000000008550000-0x0000000008663000-memory.dmpFilesize
1.1MB
-
memory/2824-144-0x0000000008550000-0x0000000008663000-memory.dmpFilesize
1.1MB
-
memory/4708-138-0x0000000000000000-mapping.dmp
-
memory/5104-133-0x0000000001A10000-0x0000000001A24000-memory.dmpFilesize
80KB
-
memory/5104-132-0x0000000001670000-0x00000000019BA000-memory.dmpFilesize
3.3MB