Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 21:23
Static task
static1
Behavioral task
behavioral1
Sample
PO KIPO000903 KIND122822.exe
Resource
win7-20220901-en
General
-
Target
PO KIPO000903 KIND122822.exe
-
Size
636KB
-
MD5
3b61d04e555f74f42e22c71a5885ac71
-
SHA1
9c774e98b87394627d311a552d8bde85d57b327c
-
SHA256
ab2af768a15bf36f36de51389f4ee62cb0816779473a53716cee76734bda7538
-
SHA512
f7363fa7857e791e6fd9320fba7c1d3927fd4c0aa6a7935a88ffabd747323f0e93d12a8f3c4be2625606e86c8f612e4271ef9ee41848d3bf2a8bdc4fed328f70
-
SSDEEP
12288:yucKpbKbf92TXwpL3sMcIobFB5BD8tVvkwkrscPA3QR+:yF4bKOORcIoxBDr1P/
Malware Config
Extracted
formbook
4.1
d94i
drain-pipe-cleaning-74655.com
culligandiiy.com
lknja.shop
salon-atmosfera.ru
steamgeneratorboilers.com
drain-pipe-cleaning-30896.com
dinoton.fun
feed-v.com
aym-brum.co.uk
bxztil.xyz
infinite-transformation.com
caticmicro.com
abrahamgranda.com
cleaninggem.com
hi5279.com
jainsdigitalservices.com
cglsuperset.com
kephatonrx.com
babyhandmold.com
braceelet.com
binotel.online
hengyangwangc.com
177787.com
dapperexperiences.com
perfectlyvintage.co.uk
ivoneartes.com
freightbyu.com
hotelvillaverdehn.com
igor-paixao.com
packmask.co.uk
lotuslandticketspice.com
mgkmanufacturing.com
casamollyshop.com
euterpe-paris-violin.com
imfeelingluckyongoogle.com
1wwxbc.top
9pdygwqg.com
akinsoftayvalik.xyz
kicoat.com
badgescottage.co.uk
bigbagsale.shop
scintillatecreative.com
thisguycancook.africa
truevision.africa
aapainternational.com
andrea-fuchs.com
thetrendshop.co.uk
pinkshea.co.uk
historiafilia.com
imaginationlbrary.com
electionfactsnc.com
cyberparkbhutani.com
freshcouponz.com
altyazili90.xyz
lidraulico.info
cardedeuweb.com
chacossandalsuk.com
10bconsulting.com
koziime.com
peek-a.boo
iuwamz.top
stonebridgetops.co.uk
heck-akunwso.xyz
helveticabold.co.uk
schoolcut.org.uk
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3748-138-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3748-144-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3608-148-0x0000000000B20000-0x0000000000B4F000-memory.dmp formbook behavioral2/memory/3608-151-0x0000000000B20000-0x0000000000B4F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO KIPO000903 KIND122822.exePO KIPO000903 KIND122822.exehelp.exedescription pid process target process PID 1036 set thread context of 3748 1036 PO KIPO000903 KIND122822.exe PO KIPO000903 KIND122822.exe PID 3748 set thread context of 2712 3748 PO KIPO000903 KIND122822.exe Explorer.EXE PID 3608 set thread context of 2712 3608 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
PO KIPO000903 KIND122822.exehelp.exepid process 3748 PO KIPO000903 KIND122822.exe 3748 PO KIPO000903 KIND122822.exe 3748 PO KIPO000903 KIND122822.exe 3748 PO KIPO000903 KIND122822.exe 3608 help.exe 3608 help.exe 3608 help.exe 3608 help.exe 3608 help.exe 3608 help.exe 3608 help.exe 3608 help.exe 3608 help.exe 3608 help.exe 3608 help.exe 3608 help.exe 3608 help.exe 3608 help.exe 3608 help.exe 3608 help.exe 3608 help.exe 3608 help.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PO KIPO000903 KIND122822.exehelp.exepid process 3748 PO KIPO000903 KIND122822.exe 3748 PO KIPO000903 KIND122822.exe 3748 PO KIPO000903 KIND122822.exe 3608 help.exe 3608 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO KIPO000903 KIND122822.exehelp.exedescription pid process Token: SeDebugPrivilege 3748 PO KIPO000903 KIND122822.exe Token: SeDebugPrivilege 3608 help.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PO KIPO000903 KIND122822.exeExplorer.EXEhelp.exedescription pid process target process PID 1036 wrote to memory of 3748 1036 PO KIPO000903 KIND122822.exe PO KIPO000903 KIND122822.exe PID 1036 wrote to memory of 3748 1036 PO KIPO000903 KIND122822.exe PO KIPO000903 KIND122822.exe PID 1036 wrote to memory of 3748 1036 PO KIPO000903 KIND122822.exe PO KIPO000903 KIND122822.exe PID 1036 wrote to memory of 3748 1036 PO KIPO000903 KIND122822.exe PO KIPO000903 KIND122822.exe PID 1036 wrote to memory of 3748 1036 PO KIPO000903 KIND122822.exe PO KIPO000903 KIND122822.exe PID 1036 wrote to memory of 3748 1036 PO KIPO000903 KIND122822.exe PO KIPO000903 KIND122822.exe PID 2712 wrote to memory of 3608 2712 Explorer.EXE help.exe PID 2712 wrote to memory of 3608 2712 Explorer.EXE help.exe PID 2712 wrote to memory of 3608 2712 Explorer.EXE help.exe PID 3608 wrote to memory of 3424 3608 help.exe cmd.exe PID 3608 wrote to memory of 3424 3608 help.exe cmd.exe PID 3608 wrote to memory of 3424 3608 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\PO KIPO000903 KIND122822.exe"C:\Users\Admin\AppData\Local\Temp\PO KIPO000903 KIND122822.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\PO KIPO000903 KIND122822.exe"C:\Users\Admin\AppData\Local\Temp\PO KIPO000903 KIND122822.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3748 -
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO KIPO000903 KIND122822.exe"3⤵PID:3424
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1036-133-0x0000000005D60000-0x0000000006304000-memory.dmpFilesize
5.6MB
-
memory/1036-134-0x0000000005850000-0x00000000058E2000-memory.dmpFilesize
584KB
-
memory/1036-135-0x0000000005840000-0x000000000584A000-memory.dmpFilesize
40KB
-
memory/1036-136-0x00000000092D0000-0x000000000936C000-memory.dmpFilesize
624KB
-
memory/1036-132-0x0000000000DD0000-0x0000000000E76000-memory.dmpFilesize
664KB
-
memory/2712-142-0x0000000002C60000-0x0000000002DF7000-memory.dmpFilesize
1.6MB
-
memory/2712-152-0x0000000002E00000-0x0000000002EBD000-memory.dmpFilesize
756KB
-
memory/2712-150-0x0000000002E00000-0x0000000002EBD000-memory.dmpFilesize
756KB
-
memory/3424-145-0x0000000000000000-mapping.dmp
-
memory/3608-148-0x0000000000B20000-0x0000000000B4F000-memory.dmpFilesize
188KB
-
memory/3608-143-0x0000000000000000-mapping.dmp
-
memory/3608-146-0x0000000000980000-0x0000000000987000-memory.dmpFilesize
28KB
-
memory/3608-147-0x0000000001390000-0x00000000016DA000-memory.dmpFilesize
3.3MB
-
memory/3608-149-0x00000000016E0000-0x0000000001773000-memory.dmpFilesize
588KB
-
memory/3608-151-0x0000000000B20000-0x0000000000B4F000-memory.dmpFilesize
188KB
-
memory/3748-144-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3748-141-0x0000000001620000-0x0000000001634000-memory.dmpFilesize
80KB
-
memory/3748-139-0x0000000001680000-0x00000000019CA000-memory.dmpFilesize
3.3MB
-
memory/3748-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3748-137-0x0000000000000000-mapping.dmp