Analysis
-
max time kernel
179s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 18:24
Static task
static1
Behavioral task
behavioral1
Sample
94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe
Resource
win7-20220812-en
General
-
Target
94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe
-
Size
962KB
-
MD5
1890b1885ef644775e1f89adfdfe7c67
-
SHA1
b04297e721e9f61b70daaa07ff67bf46e51a4362
-
SHA256
94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a
-
SHA512
4240b80f2b3aaa24bd9356df9a4c75e3bb1551fe4a9730d4e6aeb9a1703f31676fc3ec63f314d1b8e911b30cb4dbbcb708134fe9e573299d70e77821ba112fab
-
SSDEEP
12288:B2vFitrWZLYS4cxSm1wlQba5oGogT0qVSUGeQ40Lv15cE1boHKd6q:B2vFitKZkr0STQba5oRgvQZd1kqd6
Malware Config
Extracted
formbook
4.1
wtb
cocorodance.com
emorytxinsurance.com
issuerevaluation.com
slingshotsmd.com
copperheadcsm.com
datnamgrouphr.com
pdrallstar.com
alphagraphicsdesigner.com
cornerstonerecruitmentasia.com
iowie.com
raminson-mg.com
previem.com
bet-oren.com
frenchyoutlet.com
muqiangzhan.com
kyokids.com
risha-mint.online
albeda.online
xn--v8jwa9c.com
fluffygirlactive.com
dldfreemp3.com
precbt.com
digitalcoin.mobi
ywayzj.com
yourvocalinstrument.com
searko.com
kawserahmed.com
sacredgardenretreat.com
navedeserti.com
cameronandsarah2021.com
sierzuotuo.com
aarowsheds.com
psalmsnotes.com
bpanchal.com
tamalesofcp.com
lamerlin.com
venetostone.com
intersupshop.com
akomameansheart.com
bnmen09wny.men
eatonvancewateroak.info
precursoraviation.com
rarecoins.world
youthrugbycincinnati.com
significationdescouleurs.net
dprealestatelv.com
pamlightdesign.com
theoutdoorscorps.com
birdhousemediagroup.com
preserveeastpoint.com
spanishjaponia.com
qkhjbhqpha.com
savethe.vote
mypathshala.net
leszamoureuxdelaferme.com
merizuban.com
merepiff.info
xxpt8899.com
xn--sterreich-z7a.date
nereyeapp.com
distribuidorazaruma.com
thecardonegroupla.com
xiyuanlu.com
cilibilis.com
fitbros.academy
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4356-140-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exedescription pid process target process PID 4768 set thread context of 4356 4768 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exepid process 4768 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe 4768 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe 4356 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe 4356 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exedescription pid process Token: SeDebugPrivilege 4768 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exedescription pid process target process PID 4768 wrote to memory of 1800 4768 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe PID 4768 wrote to memory of 1800 4768 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe PID 4768 wrote to memory of 1800 4768 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe PID 4768 wrote to memory of 4356 4768 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe PID 4768 wrote to memory of 4356 4768 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe PID 4768 wrote to memory of 4356 4768 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe PID 4768 wrote to memory of 4356 4768 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe PID 4768 wrote to memory of 4356 4768 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe PID 4768 wrote to memory of 4356 4768 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe 94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe"C:\Users\Admin\AppData\Local\Temp\94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe"C:\Users\Admin\AppData\Local\Temp\94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe"2⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe"C:\Users\Admin\AppData\Local\Temp\94d357a6334935b76a77805f41177e94301aa62f009c9a416c6f08f3168a0b1a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4356
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1800-138-0x0000000000000000-mapping.dmp
-
memory/4356-139-0x0000000000000000-mapping.dmp
-
memory/4356-140-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/4356-141-0x0000000001960000-0x0000000001CAA000-memory.dmpFilesize
3.3MB
-
memory/4768-132-0x0000000000140000-0x0000000000236000-memory.dmpFilesize
984KB
-
memory/4768-133-0x0000000004C00000-0x0000000004C9C000-memory.dmpFilesize
624KB
-
memory/4768-134-0x00000000052D0000-0x0000000005874000-memory.dmpFilesize
5.6MB
-
memory/4768-135-0x0000000004D20000-0x0000000004DB2000-memory.dmpFilesize
584KB
-
memory/4768-136-0x0000000004BF0000-0x0000000004BFA000-memory.dmpFilesize
40KB
-
memory/4768-137-0x0000000004EB0000-0x0000000004F06000-memory.dmpFilesize
344KB