Analysis
-
max time kernel
115s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 19:17
Static task
static1
Behavioral task
behavioral1
Sample
cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe
Resource
win7-20220812-en
General
-
Target
cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe
-
Size
622KB
-
MD5
c87f83cb7568c13d1049f8308fe2fea0
-
SHA1
984ba41328e151cb09c39dd66a98ceb76b3db8c1
-
SHA256
cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb
-
SHA512
1d7d2c5b6e891cbaf0bdc95eb2b430dbe17036400c142a0e8a72b7b87b31323dd56c31a7e77f08a71fde8864269598067a5f287a17e1d29fbea2dc0b216dc90c
-
SSDEEP
12288:gCGECvxGbhNbsmJvTaw82DhmkF6jvYG11zqfFIkXIu:jCpGTbaghmkivYGXcFY
Malware Config
Extracted
formbook
4.1
grv
morganofatlanta.com
vz473.com
hengetelt.com
bailcally.com
virtuosoonline.com
tenthousandli.com
ohanamascota.com
digi-plates.com
prismagtech.com
we-cinema.com
372680.com
smartautoexpert.xyz
mrxzg.com
apartment-brussels.com
reverseincubator.com
linkasean.com
yummicrabva.com
diguchaye.com
reaktorfatura.com
thecatsaysno.com
mpgcommunications.net
lindustrieetleca.com
seosansar.com
alohalily.com
novergi.com
universityincanada.info
atrocity.xyz
johnsonballoonblessings.com
laurelmcintosh.com
nubedepalabras.com
ycmath.com
daveysdestinations.com
yourgutterguru.com
mayas.website
bessgarments.com
xhegu.com
mybusinessdoor.com
vivaceactivewear.com
nongyan.net
tgi-mail.net
j999a.com
slteka.com
pikipikiit.com
as0594.com
insuremydriverslicense.com
kclundsblades.com
haircleanerpro.com
charlesnwahiwe.com
ervoth.com
authentiekinnovations.com
molvmg.icu
xn--k1abtc6be.xn--p1acf
arm-srl.com
hood2healer.com
austinchapter7.com
clarityentct.com
bryllaw.com
twinworksllc.com
top-trend.website
rueschlink.com
oogilab.com
thewritersbookshelf.com
jademarkproducts.com
400city.com
supinapp.com
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/976-61-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/976-62-0x000000000041EC20-mapping.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exedescription pid process target process PID 1608 set thread context of 976 1608 cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.execc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exepid process 1608 cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe 976 cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exedescription pid process Token: SeDebugPrivilege 1608 cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exedescription pid process target process PID 1608 wrote to memory of 1788 1608 cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe PID 1608 wrote to memory of 1788 1608 cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe PID 1608 wrote to memory of 1788 1608 cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe PID 1608 wrote to memory of 1788 1608 cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe PID 1608 wrote to memory of 976 1608 cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe PID 1608 wrote to memory of 976 1608 cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe PID 1608 wrote to memory of 976 1608 cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe PID 1608 wrote to memory of 976 1608 cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe PID 1608 wrote to memory of 976 1608 cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe PID 1608 wrote to memory of 976 1608 cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe PID 1608 wrote to memory of 976 1608 cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe"C:\Users\Admin\AppData\Local\Temp\cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe"C:\Users\Admin\AppData\Local\Temp\cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe"2⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe"C:\Users\Admin\AppData\Local\Temp\cc7b6a1d27e2c8f4606dd8c6d5746eba33b7ac47a5d032151ceeeaa6ebc184eb.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:976
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/976-58-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/976-59-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/976-61-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/976-62-0x000000000041EC20-mapping.dmp
-
memory/976-63-0x0000000000BB0000-0x0000000000EB3000-memory.dmpFilesize
3.0MB
-
memory/1608-54-0x0000000000830000-0x00000000008D2000-memory.dmpFilesize
648KB
-
memory/1608-55-0x0000000075A91000-0x0000000075A93000-memory.dmpFilesize
8KB
-
memory/1608-56-0x0000000000420000-0x000000000042A000-memory.dmpFilesize
40KB
-
memory/1608-57-0x0000000004D10000-0x0000000004D7C000-memory.dmpFilesize
432KB