Analysis
-
max time kernel
78s -
max time network
29s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 08:34
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe
Resource
win7-20221111-en
General
-
Target
SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe
-
Size
902KB
-
MD5
2c37cb553314943214dc79d2d5cd95d2
-
SHA1
8d729ace154aae255cc7d20e0038889c1a16b30b
-
SHA256
5cfdb9f856907336025bbd526f7383ae8edbce669348b8e330251dfe21072c8f
-
SHA512
fea37cc09a83b578a2911924becca74df9fa1cec27fe182a455cc88b31c91033ceaee5f32bb4ce4e51cb354156da295c3d5281f383264261be0aa467b2bc6686
-
SSDEEP
24576:0YLeTgdo0x708aTH0wikFauuPZA2FDdEPf:0YLKgDx70j0wikFauuPZAzP
Malware Config
Extracted
formbook
4.1
ndgi
vuicotvxrejp3il.xyz
w3fa6.net
sappuno02.com
konstruksirumah.xyz
usalifehealth.com
and1f.xyz
atenmentfstinfdow.beauty
primepipe.net
roundhouseny.com
alexandermcqueen.icu
transporteavalos.com
spankmetaverse.xyz
jhccowholesale.com
bielefeldgebaeudereinigung.com
saintraphaelschool.com
larifaa.online
dejabrew.info
izabelaeraphael.com
granniestoneet.com
greensourceseed.com
jawaahirulhikmah.com
2lipcolours.com
ginzou.com
vestradgivning.online
atlasdublinresidence.com
bfine.xyz
decision-art.com
nicebayloans.com
pendingissue.biz
troiancircular.com
raftingtennesssee.com
autistal.xyz
purposeinplans.com
socofm.com
dafuweng0471.com
transformcoach.info
vugz.info
isabellesroom.com
kasdawerf.xyz
angelicindia.com
jmakerpumploc.com
departmen.store
kalpataruplotsariaplots.net
mosqueenarbonne.com
tititinews.com
santeoglobal.com
cornharvestdirect.com
chickensoesco.com
softelbow30.com
fuxeonfire.com
soospeter.com
lastikfiyatlari.online
northlandproshop.com
youbelongstojoy.com
asfalt-podrezkovo.store
servequin.com
heti.ink
gulfingroupinvest.com
gastries.info
spunklane.com
acompanhanteslux.com
bbti.world
juiceofjoy.com
tlaaccounting.net
2635westkaylaneprescott.com
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/560-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/560-64-0x000000000041F180-mapping.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exedescription pid process target process PID 1552 set thread context of 560 1552 SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeSecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exepid process 1552 SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe 560 SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exedescription pid process Token: SeDebugPrivilege 1552 SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exedescription pid process target process PID 1552 wrote to memory of 524 1552 SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe PID 1552 wrote to memory of 524 1552 SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe PID 1552 wrote to memory of 524 1552 SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe PID 1552 wrote to memory of 524 1552 SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe PID 1552 wrote to memory of 560 1552 SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe PID 1552 wrote to memory of 560 1552 SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe PID 1552 wrote to memory of 560 1552 SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe PID 1552 wrote to memory of 560 1552 SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe PID 1552 wrote to memory of 560 1552 SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe PID 1552 wrote to memory of 560 1552 SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe PID 1552 wrote to memory of 560 1552 SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe"2⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:560
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/560-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/560-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/560-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/560-64-0x000000000041F180-mapping.dmp
-
memory/560-65-0x0000000000970000-0x0000000000C73000-memory.dmpFilesize
3.0MB
-
memory/1552-54-0x0000000000D40000-0x0000000000E28000-memory.dmpFilesize
928KB
-
memory/1552-55-0x0000000075C81000-0x0000000075C83000-memory.dmpFilesize
8KB
-
memory/1552-56-0x00000000003B0000-0x00000000003C6000-memory.dmpFilesize
88KB
-
memory/1552-57-0x00000000003D0000-0x00000000003DE000-memory.dmpFilesize
56KB
-
memory/1552-58-0x0000000005690000-0x0000000005724000-memory.dmpFilesize
592KB
-
memory/1552-59-0x0000000005170000-0x00000000051CC000-memory.dmpFilesize
368KB