Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
08-12-2022 20:06
Static task
static1
Behavioral task
behavioral1
Sample
28095361.exe
Resource
win7-20220901-en
General
-
Target
28095361.exe
-
Size
445KB
-
MD5
eb177fb227c18d784c930896b96223a4
-
SHA1
9b70ef7c4fb0c47a8a81e5b479cc21ddec5874b2
-
SHA256
6df68164866d5b1b6ac0f188ccfb12bceee5c013c411cacc8212ade1807015ad
-
SHA512
857e12e274d05645c0b94db4c915321dc72699a4f7ad611d348b6117aa45409cc8df1508f9e6808f64ed4e03d9f2a4fac7ef4ef8299af12c1e5722c1e0d90472
-
SSDEEP
12288:XNF12FRDkeuvdh6vX2UoJLtZAxSoklfwBX3wVDszvBUU:XNF12PIfdh6vX2tJKSokGwu
Malware Config
Extracted
formbook
yurm
X06d1tis1GUX/R0g87Ud
BKiZ33D1P766GVXO1ZwV
lAFdjB7CSxGX8Trz
Gc7dWizTVxWX8Trz
tDkr9JAfi1OHAW1PGOageIp4
bCpMtHKU3mVp8BY5sQ==
7WKpsMWt8nsrhJClJeOZNg==
0A9KTlETQ86Cmd8k0o5NP5RwCg==
aJ61paNJztSp42c=
CrgoA8ySIOsytCbO1ZwV
i46SnHYDD9tTIHI=
XFRCRCjtFZeU3x4Rn3xfD5BnPz+RDA==
c4CZghuHvzW9A31gEz0d
QAjzz9qyRRWBNYseAI4M
Jpbmu4A1YvBvN3ruZgiRmJA5BCFd
PfoFXGNFhhuX8Trz
bqCfk0m8ApAl+Tm1Ms5Tb23IT7tS
z7INff7HNALxc5HWq2/ftrVR6A7R1zvTUQ==
m7IShV4LSFxbqxhrVsZ1Ig==
BHRp7q0gtoRuqBRnVsZ1Ig==
SnqEhE/pEKitAVYv+MtfgDwL1EuxZyihRg==
1xpDKRHJ7K/tqQzEfaJvDIeRWI5DZyihRg==
tAQpBfGi8mppxC4LbDQNI945BCFd
nk5kz8aKDecavxHOYeugeIp4
wPYvLS3zK8FvdJFbQVY=
WAATk07VS0xU9Dvx
KdwXaxSYC9G8DG2tUOBR/X3wtEM=
EPQVcwx5eXw9i/E3B9tpP5RwCg==
MN0FmlPPDZiu5zVpA58wA0Q/5F4=
797QsL+c/saMxtZeQFQ=
TISijiWfydvQFQ==
ama7D8Ntnxsr9Gg=
PcnRSFMPjGFm8BY5sQ==
npSIXvRrsj25h91pUHZGbX3wtEM=
0CAJglT6dkKyhZFbQVY=
kL69pLud0pT4Am0=
sG1JDgXWXydt/VHO1ZwV
zxVdYWYhqoHvrt5W2G7a5PL71zEyHIIx
i0Zm9MhPh/vvI3ycVsZ1Ig==
kjRJqKB3nRgihH2kM0E=
/s4LgD5dmCtOBCkprA==
I278sNm5/o/FX2dZBAKYKg==
eP/5flDtVw2X8Trz
Ik9oUEj8hFO6eeK1gJg/xkILDkwPAw==
QIS5jUjlUhtr/VHO1ZwV
RcC5QQyGv0mFC2BnT3igeIp4
NL7LMCoKT93dJWVTHJgywToxAg==
yzhyPgzSYDGthZFbQVY=
PqmV5ObKBpvKUJZYcGg05HtiCA==
/W9bsq7IsDuC
T8LMKrI2jA8BQ4yQVsZ1Ig==
eHof90VMPMXQDQ==
8TSLglnyajdx/VDO1ZwV
ZQYihA2I+rn4g7eQVsZ1Ig==
JCmxphUQ06is5Gc=
H2C6sYYiZPAxoxNnVsZ1Ig==
5NxIrpR6DM2Jd5FbQVY=
vDCXqaJj6Pw2EXA=
CBI+Gdh67Pw2EXA=
zxoDhkPEDpTET7a6Os0tj1BpDBfmYgo=
neEtD8Y0YN7fMV7O1ZwV
W+BPJ/S6QhmScpFbQVY=
iAZaRHA3ZgUpsQvRiZ5XP5RwCg==
CQtXS8LIsDuC
absbox.org
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
cmmon32.exepid process 328 cmmon32.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
28095361.exeCasPol.execmmon32.exedescription pid process target process PID 1604 set thread context of 1868 1604 28095361.exe CasPol.exe PID 1868 set thread context of 1232 1868 CasPol.exe Explorer.EXE PID 328 set thread context of 1232 328 cmmon32.exe Explorer.EXE -
Processes:
cmmon32.exedescription ioc process Key created \Registry\User\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmmon32.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
CasPol.execmmon32.exepid process 1868 CasPol.exe 1868 CasPol.exe 1868 CasPol.exe 1868 CasPol.exe 328 cmmon32.exe 328 cmmon32.exe 328 cmmon32.exe 328 cmmon32.exe 328 cmmon32.exe 328 cmmon32.exe 328 cmmon32.exe 328 cmmon32.exe 328 cmmon32.exe 328 cmmon32.exe 328 cmmon32.exe 328 cmmon32.exe 328 cmmon32.exe 328 cmmon32.exe 328 cmmon32.exe 328 cmmon32.exe 328 cmmon32.exe 328 cmmon32.exe 328 cmmon32.exe 328 cmmon32.exe 328 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1232 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
CasPol.execmmon32.exepid process 1868 CasPol.exe 1868 CasPol.exe 1868 CasPol.exe 328 cmmon32.exe 328 cmmon32.exe 328 cmmon32.exe 328 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
CasPol.execmmon32.exedescription pid process Token: SeDebugPrivilege 1868 CasPol.exe Token: SeDebugPrivilege 328 cmmon32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1232 Explorer.EXE 1232 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1232 Explorer.EXE 1232 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
28095361.exeExplorer.EXEcmmon32.exedescription pid process target process PID 1604 wrote to memory of 1868 1604 28095361.exe CasPol.exe PID 1604 wrote to memory of 1868 1604 28095361.exe CasPol.exe PID 1604 wrote to memory of 1868 1604 28095361.exe CasPol.exe PID 1604 wrote to memory of 1868 1604 28095361.exe CasPol.exe PID 1604 wrote to memory of 1868 1604 28095361.exe CasPol.exe PID 1604 wrote to memory of 1868 1604 28095361.exe CasPol.exe PID 1604 wrote to memory of 1868 1604 28095361.exe CasPol.exe PID 1232 wrote to memory of 328 1232 Explorer.EXE cmmon32.exe PID 1232 wrote to memory of 328 1232 Explorer.EXE cmmon32.exe PID 1232 wrote to memory of 328 1232 Explorer.EXE cmmon32.exe PID 1232 wrote to memory of 328 1232 Explorer.EXE cmmon32.exe PID 328 wrote to memory of 1380 328 cmmon32.exe Firefox.exe PID 328 wrote to memory of 1380 328 cmmon32.exe Firefox.exe PID 328 wrote to memory of 1380 328 cmmon32.exe Firefox.exe PID 328 wrote to memory of 1380 328 cmmon32.exe Firefox.exe PID 328 wrote to memory of 1380 328 cmmon32.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\28095361.exe"C:\Users\Admin\AppData\Local\Temp\28095361.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1868 -
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1380
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
837KB
MD5e1b58e0aa1b377a1d0e940660ad1ace1
SHA15afc7291b26855b1252b26381ebc85ed3cca218f
SHA2561b98c006231d38524e2278a474c49274fe42e0bb1a31bcfda02e6e32f559b777
SHA5129ce778bcb586638662b090910c4ceab3b64e16dfaf905a7581c1d349fecdf186995b3cc0dc8c6fc6e9761ea2831d7b14ac1619c2bd5ebc6d18015842e5d94aa2
-
memory/328-74-0x0000000076461000-0x0000000076463000-memory.dmpFilesize
8KB
-
memory/328-65-0x0000000000000000-mapping.dmp
-
memory/328-68-0x0000000000D40000-0x0000000000D4D000-memory.dmpFilesize
52KB
-
memory/328-73-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/328-69-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/328-70-0x0000000002150000-0x0000000002453000-memory.dmpFilesize
3.0MB
-
memory/328-71-0x0000000000970000-0x00000000009FF000-memory.dmpFilesize
572KB
-
memory/1232-64-0x0000000004E80000-0x0000000004FCE000-memory.dmpFilesize
1.3MB
-
memory/1232-79-0x000007FEF68E0000-0x000007FEF6A23000-memory.dmpFilesize
1.3MB
-
memory/1232-80-0x000007FF09AF0000-0x000007FF09AFA000-memory.dmpFilesize
40KB
-
memory/1232-77-0x0000000006A70000-0x0000000006BD1000-memory.dmpFilesize
1.4MB
-
memory/1232-76-0x000007FF09AF0000-0x000007FF09AFA000-memory.dmpFilesize
40KB
-
memory/1232-75-0x000007FEF68E0000-0x000007FEF6A23000-memory.dmpFilesize
1.3MB
-
memory/1232-72-0x0000000006A70000-0x0000000006BD1000-memory.dmpFilesize
1.4MB
-
memory/1604-54-0x00000000008E0000-0x0000000000954000-memory.dmpFilesize
464KB
-
memory/1604-55-0x00000000004F0000-0x0000000000562000-memory.dmpFilesize
456KB
-
memory/1868-56-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1868-59-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1868-60-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1868-63-0x00000000001B0000-0x00000000001C0000-memory.dmpFilesize
64KB
-
memory/1868-62-0x0000000000B70000-0x0000000000E73000-memory.dmpFilesize
3.0MB
-
memory/1868-57-0x00000000004012B0-mapping.dmp
-
memory/1868-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1868-67-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB