Analysis
-
max time kernel
40s -
max time network
29s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 19:10
Static task
static1
Behavioral task
behavioral1
Sample
b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe
Resource
win7-20221111-en
General
-
Target
b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe
-
Size
636KB
-
MD5
d7d2f2ecdb1920f275aef8d228bdff57
-
SHA1
01a1c36ff40f3c3ee8f3e668da6d1d0f4c33fcfc
-
SHA256
b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f
-
SHA512
596e488eb6f795ad1a65a3f66a97a9bff8fa8bd7f512a366c7da2fe5601fe10ed24c079eedd7c302b6e2fb71fe3cd3476ab1dc3a3d884aeaaa25f3e9296fca1c
-
SSDEEP
6144:nzlmhhPnpn8XMxRWZUV7H+zvLCLSxnUXqAx:zghhP9IM/bV7ePcgmf
Malware Config
Extracted
formbook
3.8
di
baoxiaofan.com
bestwaycartage.com
sag-architecture.com
salamcanteen.com
clinicalpsychologistkerala.com
mttv222.com
theweproject.com
fybbracelets.net
vv666h.com
bangfupin.com
arkprojetos.com
realgoaldigger.com
pilotedphotography.com
6zonxm55.biz
gaoduanmi.com
aminahmad.com
bountymarketing.net
christopher-rennebach.com
02xjys.faith
estilomiau.com
emoneysinhalen.com
av3rytin.com
chinabigtree.com
bless-corporation.com
archispectus.com
thedesignerslab.com
happylax.com
haxballeu.com
tryincubator.com
xmchenhe.com
icantwaittovoteagain.com
xahhr.net
allsaddledup.com
sanjuanislandsoap.net
alkhalid-group.com
fuji-qlick.com
knattertones.info
crackionic.com
zublin-perriere.net
shopesg.com
breastcarehk.com
ttnyfw.com
communistv.com
thfcfirstvariablelimited.com
rickeracheatingplumbing.com
susanamartineznotario.com
fuje.ltd
278manbet.com
elshabory.com
gaxxe.loan
florespreservadas.net
millionethomepage.com
cqkxcg.com
blockchhain.info
atiwhere.com
iot-king.com
pbbzh.win
colachain.com
verifuurbank.com
theplastercompany.com
ad-3.biz
tacootje.com
rushmad.win
galleryjoelle.com
spotekw.com
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1664-58-0x0000000000000000-mapping.dmp formbook behavioral1/memory/1664-60-0x0000000000400000-0x000000000042A000-memory.dmp formbook -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exepid process 1664 b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exepid process 836 b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exedescription pid process target process PID 836 wrote to memory of 1664 836 b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe PID 836 wrote to memory of 1664 836 b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe PID 836 wrote to memory of 1664 836 b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe PID 836 wrote to memory of 1664 836 b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe PID 836 wrote to memory of 1664 836 b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe PID 836 wrote to memory of 1664 836 b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe PID 836 wrote to memory of 1664 836 b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe PID 836 wrote to memory of 1664 836 b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe PID 836 wrote to memory of 1664 836 b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe PID 836 wrote to memory of 1664 836 b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe PID 836 wrote to memory of 1664 836 b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe PID 836 wrote to memory of 1664 836 b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe PID 836 wrote to memory of 1664 836 b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe"C:\Users\Admin\AppData\Local\Temp\b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe"C:\Users\Admin\AppData\Local\Temp\b9dea66719022448c18b4eb0ad45dea4ba4e1f5d58e7ce9b3a1ce7882429d02f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1664
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/836-56-0x0000000000240000-0x0000000000246000-memory.dmpFilesize
24KB
-
memory/836-57-0x0000000075C81000-0x0000000075C83000-memory.dmpFilesize
8KB
-
memory/836-59-0x0000000000240000-0x0000000000246000-memory.dmpFilesize
24KB
-
memory/1664-58-0x0000000000000000-mapping.dmp
-
memory/1664-60-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1664-61-0x0000000000920000-0x0000000000C23000-memory.dmpFilesize
3.0MB