Analysis
-
max time kernel
138s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 21:22
Static task
static1
Behavioral task
behavioral1
Sample
PO KIPO000903 KIND122822.exe
Resource
win7-20220901-en
General
-
Target
PO KIPO000903 KIND122822.exe
-
Size
636KB
-
MD5
3b61d04e555f74f42e22c71a5885ac71
-
SHA1
9c774e98b87394627d311a552d8bde85d57b327c
-
SHA256
ab2af768a15bf36f36de51389f4ee62cb0816779473a53716cee76734bda7538
-
SHA512
f7363fa7857e791e6fd9320fba7c1d3927fd4c0aa6a7935a88ffabd747323f0e93d12a8f3c4be2625606e86c8f612e4271ef9ee41848d3bf2a8bdc4fed328f70
-
SSDEEP
12288:yucKpbKbf92TXwpL3sMcIobFB5BD8tVvkwkrscPA3QR+:yF4bKOORcIoxBDr1P/
Malware Config
Extracted
formbook
4.1
d94i
drain-pipe-cleaning-74655.com
culligandiiy.com
lknja.shop
salon-atmosfera.ru
steamgeneratorboilers.com
drain-pipe-cleaning-30896.com
dinoton.fun
feed-v.com
aym-brum.co.uk
bxztil.xyz
infinite-transformation.com
caticmicro.com
abrahamgranda.com
cleaninggem.com
hi5279.com
jainsdigitalservices.com
cglsuperset.com
kephatonrx.com
babyhandmold.com
braceelet.com
binotel.online
hengyangwangc.com
177787.com
dapperexperiences.com
perfectlyvintage.co.uk
ivoneartes.com
freightbyu.com
hotelvillaverdehn.com
igor-paixao.com
packmask.co.uk
lotuslandticketspice.com
mgkmanufacturing.com
casamollyshop.com
euterpe-paris-violin.com
imfeelingluckyongoogle.com
1wwxbc.top
9pdygwqg.com
akinsoftayvalik.xyz
kicoat.com
badgescottage.co.uk
bigbagsale.shop
scintillatecreative.com
thisguycancook.africa
truevision.africa
aapainternational.com
andrea-fuchs.com
thetrendshop.co.uk
pinkshea.co.uk
historiafilia.com
imaginationlbrary.com
electionfactsnc.com
cyberparkbhutani.com
freshcouponz.com
altyazili90.xyz
lidraulico.info
cardedeuweb.com
chacossandalsuk.com
10bconsulting.com
koziime.com
peek-a.boo
iuwamz.top
stonebridgetops.co.uk
heck-akunwso.xyz
helveticabold.co.uk
schoolcut.org.uk
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/768-64-0x000000000041F160-mapping.dmp formbook behavioral1/memory/768-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/768-66-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/768-73-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO KIPO000903 KIND122822.exePO KIPO000903 KIND122822.exedescription pid process target process PID 1048 set thread context of 768 1048 PO KIPO000903 KIND122822.exe PO KIPO000903 KIND122822.exe PID 768 set thread context of 1400 768 PO KIPO000903 KIND122822.exe Explorer.EXE PID 768 set thread context of 1400 768 PO KIPO000903 KIND122822.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
PO KIPO000903 KIND122822.exepid process 768 PO KIPO000903 KIND122822.exe 768 PO KIPO000903 KIND122822.exe 768 PO KIPO000903 KIND122822.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1400 Explorer.EXE -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
PO KIPO000903 KIND122822.exepid process 768 PO KIPO000903 KIND122822.exe 768 PO KIPO000903 KIND122822.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PO KIPO000903 KIND122822.exedescription pid process Token: SeDebugPrivilege 768 PO KIPO000903 KIND122822.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
PO KIPO000903 KIND122822.exedescription pid process target process PID 1048 wrote to memory of 768 1048 PO KIPO000903 KIND122822.exe PO KIPO000903 KIND122822.exe PID 1048 wrote to memory of 768 1048 PO KIPO000903 KIND122822.exe PO KIPO000903 KIND122822.exe PID 1048 wrote to memory of 768 1048 PO KIPO000903 KIND122822.exe PO KIPO000903 KIND122822.exe PID 1048 wrote to memory of 768 1048 PO KIPO000903 KIND122822.exe PO KIPO000903 KIND122822.exe PID 1048 wrote to memory of 768 1048 PO KIPO000903 KIND122822.exe PO KIPO000903 KIND122822.exe PID 1048 wrote to memory of 768 1048 PO KIPO000903 KIND122822.exe PO KIPO000903 KIND122822.exe PID 1048 wrote to memory of 768 1048 PO KIPO000903 KIND122822.exe PO KIPO000903 KIND122822.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\PO KIPO000903 KIND122822.exe"C:\Users\Admin\AppData\Local\Temp\PO KIPO000903 KIND122822.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\PO KIPO000903 KIND122822.exe"C:\Users\Admin\AppData\Local\Temp\PO KIPO000903 KIND122822.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:768
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/768-68-0x00000000002E0000-0x00000000002F4000-memory.dmpFilesize
80KB
-
memory/768-67-0x0000000000890000-0x0000000000B93000-memory.dmpFilesize
3.0MB
-
memory/768-64-0x000000000041F160-mapping.dmp
-
memory/768-71-0x00000000003A0000-0x00000000003B4000-memory.dmpFilesize
80KB
-
memory/768-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/768-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/768-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/768-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/768-73-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1048-55-0x00000000759F1000-0x00000000759F3000-memory.dmpFilesize
8KB
-
memory/1048-56-0x00000000004B0000-0x00000000004C6000-memory.dmpFilesize
88KB
-
memory/1048-59-0x0000000000650000-0x0000000000684000-memory.dmpFilesize
208KB
-
memory/1048-54-0x0000000000EE0000-0x0000000000F86000-memory.dmpFilesize
664KB
-
memory/1048-58-0x0000000004EB0000-0x0000000004F20000-memory.dmpFilesize
448KB
-
memory/1048-57-0x0000000000500000-0x000000000050E000-memory.dmpFilesize
56KB
-
memory/1400-75-0x000007FE86870000-0x000007FE8687A000-memory.dmpFilesize
40KB
-
memory/1400-72-0x0000000007040000-0x0000000007180000-memory.dmpFilesize
1.2MB
-
memory/1400-74-0x000007FEF6970000-0x000007FEF6AB3000-memory.dmpFilesize
1.3MB
-
memory/1400-69-0x0000000006960000-0x0000000006AA2000-memory.dmpFilesize
1.3MB