Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
07-12-2022 11:32
Static task
static1
General
-
Target
50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe
-
Size
677KB
-
MD5
20b5c588a10cb18af8a01581a4dfd64c
-
SHA1
781bdcdc597b2c46b6e53e91546040adffcbfa77
-
SHA256
50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336
-
SHA512
6a637e977e2253ebf4011116947e8517e1f158c0ec8565cdd13d2c392fc44e50209c2fa528515d2f2bffdf0fae727adf7ebd1622f4b9b473833490653b946f22
-
SSDEEP
12288:/B29wVDnMcnLvcB/BtOVaRwJHLM7rmZS2P7m0uNxoQuKR8ZBlpQbrnQ:+cnWfKtHY7EPzm0AnuIIl
Malware Config
Extracted
formbook
qsqm
5QdWDmbTAyS4+MnbfdbRSCLJWc4/Fgs8SQ==
qzhoBFyaAmZO0A==
7xpp+AhS/D5LkTV9BQ==
cRUvWkg/NjyQ
scq67CuquOC6QJ9NiKUbWA==
jaSu0MXt6xOPHWmWSqOjMBuAm5hyMA==
RWihP4kGnsjyKPjSkf67c7U=
SG6OpKTt8zsEVJnLiKUbWA==
CLHYcMsKdtzFOCs=
ihMAMX/e+ijZQI+/iI0GUg==
2S6c/JKDgJIpJwUpFDiJr6o=
IDNilZQOJ1ZKkTV9BQ==
BKaOq8EiogXuLiRe
Vfo/6DWwte7re7TDiKUbWA==
+YrJZ8oQQnLrhgVS3RCwsPYz
Xe0AUNO43AdJhKaPRXglXg==
KNJA1wZILlJTaI2Yf+lNVpYEGicS
UF7SfvBgEk7GxJKlGA==
pUVIZHCwLZVSzg==
sdTb9+BnuiM7yw==
HyYZGwtujcaH0MYEi4yr9r0=
qsW++XiHvWGjIHWrIWg=
gCBpmJsYPFoY4AeljscVTA==
lZbwpP6Embhiqtx1ZJzLXQ==
nzaLRa3b5BKXKZE8MIV8RvDzQkQ2XQyG
LkBF1DJUXbjfaNSFgPNReLYC6E4GpEo=
AoR1n6nXGn1l1Q==
O+QdwA5E6EfyhAJFse5bo6k=
aPE3ygKSUH62+GceDQ==
MMzhEVmVvd9icHCybcpH
YgYEJUi6OU6Dwq20q+tP
A5bljs30Gljica3Rg+6Okesm
jypb6BiCj7c8vkg182k=
LcTJ4vU80+eN0iKxWZyD1W0sGDo=
jBg32ClYDD4GQhpTEoBx+pX4UNg8Fgs8SQ==
8RT0L3y560UwdrxR
VWFQf7AwMFI9vxSjmL+a778=
GTZGeMHrl8zAF8+Gdt+6UA==
pLTmjOBo+Cd12nDSjdJH
FydxEVB85kHtNCo=
n7kGSGfiXX3BGnotJHlbo6jf8Cc=
EI6IobIw0PQXT0WhgMGzFFAF5loQqVM=
MkpLbYsDK0/ITI8M+2iS1g87
X/5F70d+HUU7Uzh9KGWS1g87
cP414DNeFzfnN4jFiKUbWA==
zfc2aWiaoQk7WDM=
LWDyYvcL+WVkjuOQm6mf5SZdkQ==
CrThftRYM7j6GIK/L28=
rlZmgHi6RWR7LJ9RiKUbWA==
BBn7Hkd2GktPkTV9BQ==
teQoXFOLsd1icHCybcpH
8pLIa7c0NWw0cmS0m/d5eRUrhg==
U2rGeelLweRJ0g8ozeLtqepdMS8=
kS50r5/Rf6o5ukg182k=
tV+KElKALFD+Sq9nK3xHlqjf8Cc=
nEeEH3exU4deo+WGWYyr9r0=
GrDL5+xW4vZifMVX
6pLxUxwkVvh5uV7Ymd0pWg==
6n2RrJzkkLSOyHnBOY3OPRUs
8oiNr8U1qQkdbaigHQ==
tKvqN1Sd6kAyyA==
oEdwq7fAoej0ebXCiKUbWA==
gwD4MmuNqc1ifMVX
HiyDyuIpt9DW9F4XCg==
gold-digger.club
Signatures
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exeCaspol.exeraserver.exedescription pid process target process PID 2584 set thread context of 2276 2584 50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe Caspol.exe PID 2276 set thread context of 3064 2276 Caspol.exe Explorer.EXE PID 4504 set thread context of 3064 4504 raserver.exe Explorer.EXE -
Processes:
raserver.exedescription ioc process Key created \Registry\User\S-1-5-21-2482096546-1136599444-1359412500-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 raserver.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exeCaspol.exeraserver.exepid process 2584 50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe 2584 50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe 2584 50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe 2584 50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe 2584 50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe 2584 50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe 2276 Caspol.exe 2276 Caspol.exe 2276 Caspol.exe 2276 Caspol.exe 2276 Caspol.exe 2276 Caspol.exe 2276 Caspol.exe 2276 Caspol.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3064 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Caspol.exeraserver.exepid process 2276 Caspol.exe 2276 Caspol.exe 2276 Caspol.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe 4504 raserver.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exeCaspol.exeraserver.exedescription pid process Token: SeDebugPrivilege 2584 50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe Token: SeDebugPrivilege 2276 Caspol.exe Token: SeDebugPrivilege 4504 raserver.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exeExplorer.EXEraserver.exedescription pid process target process PID 2584 wrote to memory of 2740 2584 50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe Caspol.exe PID 2584 wrote to memory of 2740 2584 50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe Caspol.exe PID 2584 wrote to memory of 2740 2584 50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe Caspol.exe PID 2584 wrote to memory of 4092 2584 50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe Caspol.exe PID 2584 wrote to memory of 4092 2584 50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe Caspol.exe PID 2584 wrote to memory of 4092 2584 50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe Caspol.exe PID 2584 wrote to memory of 2944 2584 50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe Caspol.exe PID 2584 wrote to memory of 2944 2584 50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe Caspol.exe PID 2584 wrote to memory of 2944 2584 50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe Caspol.exe PID 2584 wrote to memory of 2276 2584 50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe Caspol.exe PID 2584 wrote to memory of 2276 2584 50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe Caspol.exe PID 2584 wrote to memory of 2276 2584 50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe Caspol.exe PID 2584 wrote to memory of 2276 2584 50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe Caspol.exe PID 2584 wrote to memory of 2276 2584 50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe Caspol.exe PID 2584 wrote to memory of 2276 2584 50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe Caspol.exe PID 3064 wrote to memory of 4504 3064 Explorer.EXE raserver.exe PID 3064 wrote to memory of 4504 3064 Explorer.EXE raserver.exe PID 3064 wrote to memory of 4504 3064 Explorer.EXE raserver.exe PID 4504 wrote to memory of 2876 4504 raserver.exe Firefox.exe PID 4504 wrote to memory of 2876 4504 raserver.exe Firefox.exe PID 4504 wrote to memory of 2876 4504 raserver.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe"C:\Users\Admin\AppData\Local\Temp\50e8d5699c036091cd4866bd3892bc89c655999e3fc96194f686587c638d6336.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2276-137-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2276-143-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2276-121-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2276-122-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2276-123-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2276-124-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2276-152-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/2276-126-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2276-128-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2276-129-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2276-130-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2276-131-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2276-132-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2276-133-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2276-120-0x00000000004012B0-mapping.dmp
-
memory/2276-134-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2276-127-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/2276-139-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2276-138-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2276-140-0x0000000000AD0000-0x0000000000AE0000-memory.dmpFilesize
64KB
-
memory/2276-141-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2276-142-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2276-119-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2276-145-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2276-146-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2276-151-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2276-135-0x0000000000F70000-0x0000000001290000-memory.dmpFilesize
3.1MB
-
memory/2584-118-0x000002B829220000-0x000002B82922A000-memory.dmpFilesize
40KB
-
memory/2584-117-0x000002B828E80000-0x000002B828F30000-memory.dmpFilesize
704KB
-
memory/3064-144-0x0000000003350000-0x000000000341D000-memory.dmpFilesize
820KB
-
memory/3064-189-0x0000000006B50000-0x0000000006C37000-memory.dmpFilesize
924KB
-
memory/3064-192-0x0000000006B50000-0x0000000006C37000-memory.dmpFilesize
924KB
-
memory/4504-159-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-176-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-154-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-153-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-155-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-156-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-157-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-158-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-149-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-160-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-161-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-162-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-163-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-164-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-165-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-166-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-167-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-168-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-169-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-170-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-171-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-172-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-173-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-175-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-174-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-150-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-177-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-178-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-179-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-181-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-180-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-182-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-183-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-185-0x00000000004D0000-0x00000000004FD000-memory.dmpFilesize
180KB
-
memory/4504-184-0x0000000001180000-0x000000000119F000-memory.dmpFilesize
124KB
-
memory/4504-186-0x00000000045A0000-0x00000000048C0000-memory.dmpFilesize
3.1MB
-
memory/4504-187-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-188-0x0000000000D50000-0x0000000000EEA000-memory.dmpFilesize
1.6MB
-
memory/4504-147-0x0000000000000000-mapping.dmp
-
memory/4504-190-0x00000000004D0000-0x00000000004FD000-memory.dmpFilesize
180KB
-
memory/4504-191-0x0000000000D50000-0x0000000000EEA000-memory.dmpFilesize
1.6MB
-
memory/4504-148-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-193-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-194-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-195-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-196-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-197-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-198-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4504-199-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB