Analysis
-
max time kernel
91s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
09-12-2022 02:10
Static task
static1
Behavioral task
behavioral1
Sample
8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exe
Resource
win7-20221111-en
General
-
Target
8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exe
-
Size
926KB
-
MD5
fbcb87e65d3a23b4fe229aeace34621f
-
SHA1
8139f123069e7e7632331779de8ed6d5031efcd1
-
SHA256
8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876
-
SHA512
1585b0c6b35bf4cb2c00b82079755e1c536d0a912c307fbbb2028e28b9f88d0cfd9272d459836b064a9893983dd25c1fba2aeeff25ab4ba50c9fd664ff25bd36
-
SSDEEP
12288:8UUq1vQWztAJchTCRjN1McME0s2BJOwxmGr5t:V17W2hTMN1tZ0s2BJOwxV
Malware Config
Extracted
formbook
4.1
awqu
soltwin24horas.com
kaiget.com
majalahlangitan.com
preventable.top
caronandtom.com
2222k06.com
hdrezkart54ff.net
supermessage.xyz
dezeenb.com
bestatakes.xyz
californiasportsbar.com
hxg66.xyz
localxgirl.online
educ-ability.com
b2breferralshop.online
miamicollisioncenter.com
bjcxqcdb.com
barrineauparkbees.com
robotics6.com
web-bastler.com
jupiterchb.com
fuzzcloud.space
fin-clean.com
tudodebeleza.com
7msnpredazzite.sbs
zuvesite.site
apipain.com
w388-winnn.online
ibedes.com
dating4lonely.com
tomsshoesonsale.com
burakugan.com
camilalopez.online
mabghsjkshop.com
paulinemoroneyevents.com
medicalsurgeryprocedures-d.site
clintonfabian.com
chesapeakehi.com
tabgrabber.com
luckersgoldsurvey.top
fasciasupplements.com
wanzhoukaoyu520.com
3919m.com
froehlichbuilder.net
kendallsescorts.com
holywingz.online
richardvenner.com
yx5589.com
sodephoangnam.com
lucasdogrupo.store
cgambill.com
lehrent.com
vtc-capital.ltd
skyxproductions.com
manuelgutierrez.online
ashlyanddustin.com
hg59090.com
notsite.site
ainuer.com
convivialonlineconsulting.site
allcrickad.xyz
bp5cw.beauty
ladiosa.store
ovzdutsxshop.com
wolacannabis.net
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1732-139-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exedescription pid process target process PID 4656 set thread context of 1732 4656 8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exe 8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exepid process 1732 8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exe 1732 8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exedescription pid process target process PID 4656 wrote to memory of 1732 4656 8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exe 8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exe PID 4656 wrote to memory of 1732 4656 8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exe 8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exe PID 4656 wrote to memory of 1732 4656 8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exe 8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exe PID 4656 wrote to memory of 1732 4656 8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exe 8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exe PID 4656 wrote to memory of 1732 4656 8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exe 8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exe PID 4656 wrote to memory of 1732 4656 8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exe 8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exe"C:\Users\Admin\AppData\Local\Temp\8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exe"C:\Users\Admin\AppData\Local\Temp\8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1732
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1732-138-0x0000000000000000-mapping.dmp
-
memory/1732-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1732-140-0x0000000001A50000-0x0000000001D9A000-memory.dmpFilesize
3.3MB
-
memory/4656-132-0x00000000006E0000-0x00000000007CE000-memory.dmpFilesize
952KB
-
memory/4656-133-0x0000000005740000-0x0000000005CE4000-memory.dmpFilesize
5.6MB
-
memory/4656-134-0x0000000005190000-0x0000000005222000-memory.dmpFilesize
584KB
-
memory/4656-135-0x0000000005160000-0x000000000516A000-memory.dmpFilesize
40KB
-
memory/4656-136-0x0000000008B80000-0x0000000008C1C000-memory.dmpFilesize
624KB
-
memory/4656-137-0x0000000008CA0000-0x0000000008D06000-memory.dmpFilesize
408KB