Analysis
-
max time kernel
43s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 16:11
Static task
static1
Behavioral task
behavioral1
Sample
3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exe
Resource
win7-20220812-en
General
-
Target
3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exe
-
Size
813KB
-
MD5
1cd16f3fa7973a96a8bd8185f10da1a3
-
SHA1
2ca8e7705af44b14bd4805e12d0c64b787fdf7f1
-
SHA256
3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11
-
SHA512
87bb61ed46130cd7589cd154400bf45ea82eb57c92c3ffb5d163a69cf52de202602bea01f0a1518377d04499c728bd4ad5e02b1789625210dc304cfc7b142f33
-
SSDEEP
12288:Q1pbZyY47t7pa5bNp0A9RTfYfZMa2yydQ8OQ6rgtkl0Ig95lvTHRyoY:qbKaxRIOa2S8J6080IgvpjRpY
Malware Config
Extracted
formbook
4.1
s20g
coconutdap.com
pukka-party.co.uk
apexrp.dev
boostmycredit.info
bipobofficial.com
bjl009.com
kagoshimum.com
crtinha.xyz
longsteephill.co.uk
forfour4.com
adversata.com
lesaek.ru
chafang3.xyz
haungo.net
mynextgen.africa
credit-cards-45560.com
cnc-printing.com
antoniafredrik.se
likemedclinic.ru
gyeakoncert.com
learnssamsung.com
intercoingroup.com
arresting.one
calcestrum.online
kaaafrikamedia.com
lexdetector.com
businessinabox.world
coolsculpting-queries.life
aylawell.com
car-deals-59194.com
atwatercab.com
drvpreneur.com
chinazhileng.net
findguyscolorado.com
landmarkairchitecturalsigns.com
download-rufuus.com
apu532.com
clothesgroup.net
emergenciaparatodos.com
azurepeace.ru
appraiseacar.com
thepartyshopuk.co.uk
businessflorida.top
bewisemind.com
financialtrainingsols.com
mdcomercio.net
royalcashcrown.com
laktaxi.com
groupiify.com
apec-renovations.com
bkes-2023.info
coquitosrestaurant.com
holypay.africa
screenly.co.uk
ichabodathleticsfund.com
cobballplusin.com
momoaccess.co.uk
lagan.rsvp
wisx.net
uyabid.net
emilialakhi.com
izmirbornovanakliyat.com
16gaokk.com
theevent.rsvp
chrisgate.africa
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/964-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/964-64-0x000000000041F120-mapping.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exedescription pid process target process PID 364 set thread context of 964 364 3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exe 3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exepid process 964 3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exedescription pid process target process PID 364 wrote to memory of 964 364 3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exe 3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exe PID 364 wrote to memory of 964 364 3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exe 3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exe PID 364 wrote to memory of 964 364 3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exe 3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exe PID 364 wrote to memory of 964 364 3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exe 3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exe PID 364 wrote to memory of 964 364 3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exe 3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exe PID 364 wrote to memory of 964 364 3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exe 3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exe PID 364 wrote to memory of 964 364 3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exe 3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exe"C:\Users\Admin\AppData\Local\Temp\3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exe"C:\Users\Admin\AppData\Local\Temp\3ff3442c4098aed3f2b0c6cb52ecab522a028b18a9bcd1319a79b3dcff05de11.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:964
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/364-54-0x0000000001310000-0x00000000013E2000-memory.dmpFilesize
840KB
-
memory/364-55-0x0000000075131000-0x0000000075133000-memory.dmpFilesize
8KB
-
memory/364-56-0x00000000003F0000-0x0000000000406000-memory.dmpFilesize
88KB
-
memory/364-57-0x0000000000420000-0x000000000042E000-memory.dmpFilesize
56KB
-
memory/364-58-0x00000000011A0000-0x0000000001210000-memory.dmpFilesize
448KB
-
memory/364-59-0x0000000000AF0000-0x0000000000B24000-memory.dmpFilesize
208KB
-
memory/964-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/964-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/964-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/964-64-0x000000000041F120-mapping.dmp
-
memory/964-65-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB