Analysis
-
max time kernel
75s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 11:39
Static task
static1
Behavioral task
behavioral1
Sample
5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe
Resource
win7-20220901-en
General
-
Target
5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe
-
Size
814KB
-
MD5
eccc5475dd661be20724e6b8a131f664
-
SHA1
adbd86d7ccdab284d0080f0a08e3d426a8df21b8
-
SHA256
5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a
-
SHA512
f61dfbb25c44e9bcc5334b95c1c54c2275876ee50610995dfda2fc6090b9b05e5da66831d288b53e313b6c1aec4b0e24d001792425965914eb03f6d6bdfd19c6
-
SSDEEP
12288:vFyMNTl159j9G9+a3DY366UqXbAyBWWapIg95lvTHRyoY:3b1XZGAaT56VrAyepIgvpjRpY
Malware Config
Extracted
formbook
4.1
g28p
whhmgs.asia
wellmedcaredirect.net
beggarded.com
wtpjiv.site
todo-celulares.com
parkitny.net
43345.top
pro-genie.com
cwdxz.com
cbc-inc.xyz
healthspots.net
rulil.top
pyramidaudit.solutions
k8sb15.live
hempaware.report
usclink.life
stayefs.net
05262.top
shop-izakaya-jin.com
iccworldcupnews.com
lulamail.xyz
dubaistocks.club
royaleyeandearhospital.com
cash-date.biz
hbfcjgj.com
zcx625.fun
compra-venta-autos.online
waltherchen.xyz
asyimpo.xyz
gayxxxporn.info
xn--igvy44d.xn--55qx5d
teaktime.net
aydesign.xyz
hfamq.site
tunayreklam.net
rxof.rest
naturebody.love
elijahelijah.com
lojasiadis.com
amazrsxrszwna.com
realtranzex.com
elelfo3d.fun
fse.community
28369.xyz
minigolfauthority.net
venturebestdeals.click
robeholidayrentals.store
edarva.skin
xikixvtj.work
ecolabspeyua.store
infidelitytoolkit.com
crawfordbayoysterroast.net
adenongel.dentist
appliancegrey.site
ky7769.com
kshd.xyz
ausbonusbets.com
aks.capital
rv8288.xyz
retetelebunicii.com
younginheart.net
ps4controller.net
todotutoriales10.com
boletosdeavionbaratos.com
spartanburgwebdesign.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1564-141-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exedescription pid process target process PID 2868 set thread context of 1564 2868 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exepid process 2868 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe 2868 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe 2868 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe 2868 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe 1564 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe 1564 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exedescription pid process Token: SeDebugPrivilege 2868 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exedescription pid process target process PID 2868 wrote to memory of 3968 2868 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe PID 2868 wrote to memory of 3968 2868 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe PID 2868 wrote to memory of 3968 2868 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe PID 2868 wrote to memory of 1416 2868 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe PID 2868 wrote to memory of 1416 2868 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe PID 2868 wrote to memory of 1416 2868 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe PID 2868 wrote to memory of 1564 2868 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe PID 2868 wrote to memory of 1564 2868 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe PID 2868 wrote to memory of 1564 2868 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe PID 2868 wrote to memory of 1564 2868 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe PID 2868 wrote to memory of 1564 2868 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe PID 2868 wrote to memory of 1564 2868 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe"C:\Users\Admin\AppData\Local\Temp\5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe"C:\Users\Admin\AppData\Local\Temp\5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe"2⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe"C:\Users\Admin\AppData\Local\Temp\5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe"2⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe"C:\Users\Admin\AppData\Local\Temp\5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1564
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1416-139-0x0000000000000000-mapping.dmp
-
memory/1564-140-0x0000000000000000-mapping.dmp
-
memory/1564-141-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1564-142-0x0000000001950000-0x0000000001C9A000-memory.dmpFilesize
3.3MB
-
memory/2868-133-0x00000000001B0000-0x0000000000282000-memory.dmpFilesize
840KB
-
memory/2868-134-0x00000000051E0000-0x0000000005784000-memory.dmpFilesize
5.6MB
-
memory/2868-135-0x0000000004C30000-0x0000000004CC2000-memory.dmpFilesize
584KB
-
memory/2868-136-0x0000000004DC0000-0x0000000004DCA000-memory.dmpFilesize
40KB
-
memory/2868-137-0x0000000008840000-0x00000000088DC000-memory.dmpFilesize
624KB
-
memory/3968-138-0x0000000000000000-mapping.dmp