Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 16:29
Static task
static1
Behavioral task
behavioral1
Sample
40ee2027d06e0a2ed12888c0e64c43a501ac7f81709625eb1ed61e5b0e43f865.exe
Resource
win7-20221111-en
General
-
Target
40ee2027d06e0a2ed12888c0e64c43a501ac7f81709625eb1ed61e5b0e43f865.exe
-
Size
490KB
-
MD5
204da52ffbac84b1067d3ee2d06a8b15
-
SHA1
05672de9a26d7cb5cfd408f06bc50e71265f32f3
-
SHA256
40ee2027d06e0a2ed12888c0e64c43a501ac7f81709625eb1ed61e5b0e43f865
-
SHA512
0989cf3b1de4c71e664471cfb9ff783c250e8d251e1438dd01815f8ee3d7103b9b55dd8dfaf374e0ce1ec2c605efc3cb6f8f46df9a9e209ee5638fb0762296b5
-
SSDEEP
6144:MTDMAYloj1/L8YEAQwgG5hUf+uJ18yL3gfDj3f4acR2RzqmCGujxggwHDU1W8:+DMAzjN4YEAFKmE0fbcgcVwg1W8
Malware Config
Extracted
formbook
4.1
pep
whitelabelgraphics.pro
futureguidefilms.com
mission-duplex.com
rutherealty.com
acehardwaremall.com
potenb.com
tbhawt.com
momentum-ip.group
m8sr8s.com
cfwagner.com
umiyama-eri.com
klantenvinden.com
simplycasd.com
visionhomerecruiting.com
inkjet-material.com
banking-aib.com
fast1performance.com
eventsbyja.com
breuer.network
smartecelectronics.com
vtbunkie.com
lexingtonclarke.com
ayintapbaklava.com
sugarstyleearrings.com
caiyanxi.com
the2mblueprint.com
bakldx.com
7choicesar.com
jesusencounterminisries.com
lamptail.com
bobkeet.com
chasingplanet.com
obernix.com
managementgpus.mobi
tcunionnet.com
hydzonised.com
jennie-espy.com
animeinkcon.com
hesovery.cool
bvilifemagazine.com
medicareworldnewsreport.net
zdrowykon.com
atenmedilatam.com
dlasso.com
7si3.com
seasonedsupport.com
29essentials.com
cnpuhang.com
yyaa2.net
neocareadvisory.com
tblsportshoes.com
chohub.com
initiationpodcast.com
architex.info
jamietylerlee.com
diusae.com
sun-go24.com
rfeap.com
safunerepublic.com
juanluanzi.com
neptuneribs.com
defocasc.com
tatilingerie.com
all-env.com
triumphantlytransformedbk.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1540-139-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/1540-146-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/552-150-0x00000000004B0000-0x00000000004DE000-memory.dmp formbook behavioral2/memory/552-154-0x00000000004B0000-0x00000000004DE000-memory.dmp formbook -
Executes dropped EXE 1 IoCs
Processes:
AddInProcess32.exepid process 1540 AddInProcess32.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
40ee2027d06e0a2ed12888c0e64c43a501ac7f81709625eb1ed61e5b0e43f865.exeAddInProcess32.exeraserver.exedescription pid process target process PID 3116 set thread context of 1540 3116 40ee2027d06e0a2ed12888c0e64c43a501ac7f81709625eb1ed61e5b0e43f865.exe AddInProcess32.exe PID 1540 set thread context of 1076 1540 AddInProcess32.exe Explorer.EXE PID 552 set thread context of 1076 552 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
40ee2027d06e0a2ed12888c0e64c43a501ac7f81709625eb1ed61e5b0e43f865.exeAddInProcess32.exeraserver.exepid process 3116 40ee2027d06e0a2ed12888c0e64c43a501ac7f81709625eb1ed61e5b0e43f865.exe 3116 40ee2027d06e0a2ed12888c0e64c43a501ac7f81709625eb1ed61e5b0e43f865.exe 1540 AddInProcess32.exe 1540 AddInProcess32.exe 1540 AddInProcess32.exe 1540 AddInProcess32.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe 552 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1076 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
AddInProcess32.exeraserver.exepid process 1540 AddInProcess32.exe 1540 AddInProcess32.exe 1540 AddInProcess32.exe 552 raserver.exe 552 raserver.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
40ee2027d06e0a2ed12888c0e64c43a501ac7f81709625eb1ed61e5b0e43f865.exeAddInProcess32.exeraserver.exedescription pid process Token: SeDebugPrivilege 3116 40ee2027d06e0a2ed12888c0e64c43a501ac7f81709625eb1ed61e5b0e43f865.exe Token: SeDebugPrivilege 1540 AddInProcess32.exe Token: SeDebugPrivilege 552 raserver.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
40ee2027d06e0a2ed12888c0e64c43a501ac7f81709625eb1ed61e5b0e43f865.exeExplorer.EXEraserver.exedescription pid process target process PID 3116 wrote to memory of 1540 3116 40ee2027d06e0a2ed12888c0e64c43a501ac7f81709625eb1ed61e5b0e43f865.exe AddInProcess32.exe PID 3116 wrote to memory of 1540 3116 40ee2027d06e0a2ed12888c0e64c43a501ac7f81709625eb1ed61e5b0e43f865.exe AddInProcess32.exe PID 3116 wrote to memory of 1540 3116 40ee2027d06e0a2ed12888c0e64c43a501ac7f81709625eb1ed61e5b0e43f865.exe AddInProcess32.exe PID 3116 wrote to memory of 1540 3116 40ee2027d06e0a2ed12888c0e64c43a501ac7f81709625eb1ed61e5b0e43f865.exe AddInProcess32.exe PID 3116 wrote to memory of 1540 3116 40ee2027d06e0a2ed12888c0e64c43a501ac7f81709625eb1ed61e5b0e43f865.exe AddInProcess32.exe PID 3116 wrote to memory of 1540 3116 40ee2027d06e0a2ed12888c0e64c43a501ac7f81709625eb1ed61e5b0e43f865.exe AddInProcess32.exe PID 1076 wrote to memory of 552 1076 Explorer.EXE raserver.exe PID 1076 wrote to memory of 552 1076 Explorer.EXE raserver.exe PID 1076 wrote to memory of 552 1076 Explorer.EXE raserver.exe PID 552 wrote to memory of 3152 552 raserver.exe cmd.exe PID 552 wrote to memory of 3152 552 raserver.exe cmd.exe PID 552 wrote to memory of 3152 552 raserver.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\40ee2027d06e0a2ed12888c0e64c43a501ac7f81709625eb1ed61e5b0e43f865.exe"C:\Users\Admin\AppData\Local\Temp\40ee2027d06e0a2ed12888c0e64c43a501ac7f81709625eb1ed61e5b0e43f865.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
42KB
MD59827ff3cdf4b83f9c86354606736ca9c
SHA1e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723
SHA256c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a
SHA5128261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
42KB
MD59827ff3cdf4b83f9c86354606736ca9c
SHA1e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723
SHA256c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a
SHA5128261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579
-
memory/552-152-0x00000000022A0000-0x0000000002333000-memory.dmpFilesize
588KB
-
memory/552-149-0x0000000000840000-0x000000000085F000-memory.dmpFilesize
124KB
-
memory/552-151-0x0000000002460000-0x00000000027AA000-memory.dmpFilesize
3.3MB
-
memory/552-150-0x00000000004B0000-0x00000000004DE000-memory.dmpFilesize
184KB
-
memory/552-154-0x00000000004B0000-0x00000000004DE000-memory.dmpFilesize
184KB
-
memory/552-145-0x0000000000000000-mapping.dmp
-
memory/1076-144-0x00000000087B0000-0x000000000892C000-memory.dmpFilesize
1.5MB
-
memory/1076-153-0x00000000033A0000-0x0000000003456000-memory.dmpFilesize
728KB
-
memory/1076-155-0x00000000033A0000-0x0000000003456000-memory.dmpFilesize
728KB
-
memory/1540-138-0x0000000000000000-mapping.dmp
-
memory/1540-143-0x00000000016A0000-0x00000000016B4000-memory.dmpFilesize
80KB
-
memory/1540-146-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1540-141-0x00000000016C0000-0x0000000001A0A000-memory.dmpFilesize
3.3MB
-
memory/1540-139-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3116-136-0x0000000006BD0000-0x0000000006C36000-memory.dmpFilesize
408KB
-
memory/3116-132-0x0000000000D00000-0x0000000000D80000-memory.dmpFilesize
512KB
-
memory/3116-137-0x0000000006BA0000-0x0000000006BC2000-memory.dmpFilesize
136KB
-
memory/3116-135-0x0000000005790000-0x000000000582C000-memory.dmpFilesize
624KB
-
memory/3116-134-0x00000000055E0000-0x0000000005672000-memory.dmpFilesize
584KB
-
memory/3116-133-0x0000000005CA0000-0x0000000006244000-memory.dmpFilesize
5.6MB
-
memory/3152-148-0x0000000000000000-mapping.dmp