Analysis
-
max time kernel
46s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07-12-2022 13:03
Static task
static1
Behavioral task
behavioral1
Sample
651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exe
Resource
win7-20220901-en
General
-
Target
651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exe
-
Size
697KB
-
MD5
5e14c731e0b4f67493b838262b7364cb
-
SHA1
47437d61e5e025ae8e6f7d4a6172edeead8e29c1
-
SHA256
651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0
-
SHA512
65a8ee82d4f4ec9a9f3574ab5a603ffd08ee028865fa67b09c62e36b4c83f500ae1c376b43a55265760879a8b057f7f47e75651c8076523f85e315af1de078ee
-
SSDEEP
12288:+4Vgh/PsZ1DX/VDJI6J8TOmb0PIL1gHH4WfgLO5zsJr:BVgh/PU8/QPhHY5O5QJr
Malware Config
Extracted
formbook
4.1
g28p
whhmgs.asia
wellmedcaredirect.net
beggarded.com
wtpjiv.site
todo-celulares.com
parkitny.net
43345.top
pro-genie.com
cwdxz.com
cbc-inc.xyz
healthspots.net
rulil.top
pyramidaudit.solutions
k8sb15.live
hempaware.report
usclink.life
stayefs.net
05262.top
shop-izakaya-jin.com
iccworldcupnews.com
lulamail.xyz
dubaistocks.club
royaleyeandearhospital.com
cash-date.biz
hbfcjgj.com
zcx625.fun
compra-venta-autos.online
waltherchen.xyz
asyimpo.xyz
gayxxxporn.info
xn--igvy44d.xn--55qx5d
teaktime.net
aydesign.xyz
hfamq.site
tunayreklam.net
rxof.rest
naturebody.love
elijahelijah.com
lojasiadis.com
amazrsxrszwna.com
realtranzex.com
elelfo3d.fun
fse.community
28369.xyz
minigolfauthority.net
venturebestdeals.click
robeholidayrentals.store
edarva.skin
xikixvtj.work
ecolabspeyua.store
infidelitytoolkit.com
crawfordbayoysterroast.net
adenongel.dentist
appliancegrey.site
ky7769.com
kshd.xyz
ausbonusbets.com
aks.capital
rv8288.xyz
retetelebunicii.com
younginheart.net
ps4controller.net
todotutoriales10.com
boletosdeavionbaratos.com
spartanburgwebdesign.com
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1148-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1148-64-0x000000000041F100-mapping.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exedescription pid process target process PID 1740 set thread context of 1148 1740 651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exe 651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exepid process 1148 651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exedescription pid process target process PID 1740 wrote to memory of 1148 1740 651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exe 651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exe PID 1740 wrote to memory of 1148 1740 651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exe 651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exe PID 1740 wrote to memory of 1148 1740 651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exe 651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exe PID 1740 wrote to memory of 1148 1740 651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exe 651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exe PID 1740 wrote to memory of 1148 1740 651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exe 651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exe PID 1740 wrote to memory of 1148 1740 651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exe 651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exe PID 1740 wrote to memory of 1148 1740 651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exe 651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exe"C:\Users\Admin\AppData\Local\Temp\651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exe"C:\Users\Admin\AppData\Local\Temp\651404e566b5d65563d62eeca4c89c4b1ae3ed40fb440819b233f576c91d1cc0.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1148
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1148-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1148-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1148-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1148-64-0x000000000041F100-mapping.dmp
-
memory/1148-65-0x0000000000A50000-0x0000000000D53000-memory.dmpFilesize
3.0MB
-
memory/1740-54-0x0000000000990000-0x0000000000A44000-memory.dmpFilesize
720KB
-
memory/1740-55-0x0000000075931000-0x0000000075933000-memory.dmpFilesize
8KB
-
memory/1740-56-0x00000000004F0000-0x0000000000508000-memory.dmpFilesize
96KB
-
memory/1740-57-0x0000000000210000-0x000000000021C000-memory.dmpFilesize
48KB
-
memory/1740-58-0x00000000055B0000-0x0000000005620000-memory.dmpFilesize
448KB
-
memory/1740-59-0x0000000004280000-0x00000000042B4000-memory.dmpFilesize
208KB