Analysis
-
max time kernel
329s -
max time network
341s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 15:14
Static task
static1
Behavioral task
behavioral1
Sample
re, lista de productos qu¡micos.exe
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
re, lista de productos qu¡micos.exe
Resource
win7-20221111-en
General
-
Target
re, lista de productos qu¡micos.exe
-
Size
696KB
-
MD5
65a7879d2875f36c8450555c6c98f293
-
SHA1
1464a6da1bf0438544946aadde4a6254f2d2400b
-
SHA256
2cb3478355fda005cf47b9c74d29944815892efe821a57b0974969939c106d09
-
SHA512
874b289d769145908b92f74b374b1e4e3b86f56dfea3838f73845365b099c198a256c2c998446c03b94a713071070640b0b41a19a0969e37ed2f3d35b861533d
-
SSDEEP
12288:Dtpgh/PsZ1DX/VDJDAaIkDQoriWWl/pe1CDxfLo1:Rpgh/PCAr0ORB+CD6
Malware Config
Extracted
formbook
4.1
ng04
tevimaq.com
easterspecialtystore.com
smartlever.tech
10312.uk
tanjawiharbi.co.uk
471338.com
horusventure.com
empress-care.com
sinrian.com
465951.com
aemsti.com
nxcourier.com
stargatefarms.com
lalyquainvestment.com
dailysportsadvice.com
justlistmoore.com
stoneonroll.online
tatianakolomiets.com
barcodebbm.com
protectorship.world
datingventure.info
aurora-body.com
sohomusicclub.com
postapudding.co.uk
mps-24.store
fengjianghu.com
fenostoreshop.site
julietterosebarney.com
1a-datenschutz.com
yejinxia.com
firstmortgagedebt.com
greengood.store
skynet-one.net
allianthrs.com
centralflfc.com
46caminosobrante.com
informatique07.com
keebu.net
gamebe.store
nicestartech.top
smbxd.com
dyadent.store
xiangmeihao.com
exac7.com
vesiensuojelu.com
youhaometal.com
jiewo.top
xmfaucet.com
avocadotaco.com
nicelove.online
beautytimelashesnails.com
domainand.site
tlqf.net
mentionevery.online
jeuxjetx.fr
device-track.co
re364t6.top
teamlepleiadi.com
againsubpackaddr.com
blemchi.xyz
yxzhcpa.com
cycle-xchange.store
medimattress.info
cosme-mochi.net
wekurd.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral3/memory/3908-138-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral3/memory/3908-140-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral3/memory/3908-147-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral3/memory/2380-150-0x0000000001140000-0x000000000116F000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
re, lista de productos qu¡micos.exere, lista de productos qu¡micos.exenetsh.exedescription pid process target process PID 428 set thread context of 3908 428 re, lista de productos qu¡micos.exe re, lista de productos qu¡micos.exe PID 3908 set thread context of 2596 3908 re, lista de productos qu¡micos.exe Explorer.EXE PID 3908 set thread context of 2596 3908 re, lista de productos qu¡micos.exe Explorer.EXE PID 2380 set thread context of 2596 2380 netsh.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
re, lista de productos qu¡micos.exenetsh.exepid process 3908 re, lista de productos qu¡micos.exe 3908 re, lista de productos qu¡micos.exe 3908 re, lista de productos qu¡micos.exe 3908 re, lista de productos qu¡micos.exe 3908 re, lista de productos qu¡micos.exe 3908 re, lista de productos qu¡micos.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe 2380 netsh.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2596 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
re, lista de productos qu¡micos.exenetsh.exepid process 3908 re, lista de productos qu¡micos.exe 3908 re, lista de productos qu¡micos.exe 3908 re, lista de productos qu¡micos.exe 3908 re, lista de productos qu¡micos.exe 2380 netsh.exe 2380 netsh.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
re, lista de productos qu¡micos.exenetsh.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3908 re, lista de productos qu¡micos.exe Token: SeDebugPrivilege 2380 netsh.exe Token: SeShutdownPrivilege 2596 Explorer.EXE Token: SeCreatePagefilePrivilege 2596 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
re, lista de productos qu¡micos.exere, lista de productos qu¡micos.exenetsh.exedescription pid process target process PID 428 wrote to memory of 3908 428 re, lista de productos qu¡micos.exe re, lista de productos qu¡micos.exe PID 428 wrote to memory of 3908 428 re, lista de productos qu¡micos.exe re, lista de productos qu¡micos.exe PID 428 wrote to memory of 3908 428 re, lista de productos qu¡micos.exe re, lista de productos qu¡micos.exe PID 428 wrote to memory of 3908 428 re, lista de productos qu¡micos.exe re, lista de productos qu¡micos.exe PID 428 wrote to memory of 3908 428 re, lista de productos qu¡micos.exe re, lista de productos qu¡micos.exe PID 428 wrote to memory of 3908 428 re, lista de productos qu¡micos.exe re, lista de productos qu¡micos.exe PID 3908 wrote to memory of 2380 3908 re, lista de productos qu¡micos.exe netsh.exe PID 3908 wrote to memory of 2380 3908 re, lista de productos qu¡micos.exe netsh.exe PID 3908 wrote to memory of 2380 3908 re, lista de productos qu¡micos.exe netsh.exe PID 2380 wrote to memory of 3348 2380 netsh.exe cmd.exe PID 2380 wrote to memory of 3348 2380 netsh.exe cmd.exe PID 2380 wrote to memory of 3348 2380 netsh.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\re, lista de productos qu¡micos.exe"C:\Users\Admin\AppData\Local\Temp\re, lista de productos qu¡micos.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\re, lista de productos qu¡micos.exe"C:\Users\Admin\AppData\Local\Temp\re, lista de productos qu¡micos.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\re, lista de productos qu¡micos.exe"5⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/428-132-0x0000000000950000-0x0000000000A04000-memory.dmpFilesize
720KB
-
memory/428-133-0x0000000005A40000-0x0000000005FE4000-memory.dmpFilesize
5.6MB
-
memory/428-134-0x0000000005390000-0x0000000005422000-memory.dmpFilesize
584KB
-
memory/428-135-0x00000000055C0000-0x00000000055CA000-memory.dmpFilesize
40KB
-
memory/428-136-0x0000000007610000-0x00000000076AC000-memory.dmpFilesize
624KB
-
memory/2380-153-0x0000000001860000-0x00000000018F4000-memory.dmpFilesize
592KB
-
memory/2380-151-0x0000000001AD0000-0x0000000001E1A000-memory.dmpFilesize
3.3MB
-
memory/2380-150-0x0000000001140000-0x000000000116F000-memory.dmpFilesize
188KB
-
memory/2380-149-0x0000000000B30000-0x0000000000B4E000-memory.dmpFilesize
120KB
-
memory/2380-148-0x0000000000000000-mapping.dmp
-
memory/2596-143-0x00000000034B0000-0x000000000359B000-memory.dmpFilesize
940KB
-
memory/2596-146-0x0000000003820000-0x000000000397C000-memory.dmpFilesize
1.4MB
-
memory/2596-154-0x00000000086D0000-0x00000000087A8000-memory.dmpFilesize
864KB
-
memory/2596-155-0x00000000086D0000-0x00000000087A8000-memory.dmpFilesize
864KB
-
memory/3348-152-0x0000000000000000-mapping.dmp
-
memory/3908-145-0x00000000019B0000-0x00000000019C5000-memory.dmpFilesize
84KB
-
memory/3908-147-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3908-142-0x00000000011E0000-0x00000000011F5000-memory.dmpFilesize
84KB
-
memory/3908-141-0x0000000001660000-0x00000000019AA000-memory.dmpFilesize
3.3MB
-
memory/3908-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3908-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3908-137-0x0000000000000000-mapping.dmp