Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
12-12-2022 10:40
Static task
static1
Behavioral task
behavioral1
Sample
ET3B30WFvUox72P.exe
Resource
win7-20220812-en
General
-
Target
ET3B30WFvUox72P.exe
-
Size
853KB
-
MD5
9c08d86c88ca7a12737a5a78f3a8ad22
-
SHA1
135bc56ea54a1133055e102a0febef4b796d06cf
-
SHA256
e121e41abc24cd4a27ec0537679a24a0c8ab76bacbb4e7d636fff4b775a89cbd
-
SHA512
cd309209ee2577bce854784a1a0bbbf07a81ed22c768f8973d84e4e744e5e623d29d1b34580ec840313cd2713d8fb862fe460ff1953b96b4210a60cd56d8376c
-
SSDEEP
12288:70wOZQA6qectxWsQvktczPlDxheXw9lE2kSBcLUNfkg586aWHff:74ectxPyztDxheATPkwB5O8f
Malware Config
Extracted
formbook
bmr1
q05YNsJC4MpYLGAf4A==
6KUzKCvwX0fwzrFQXvlucw==
KA4ZibW1w+hWN5Q=
TfgNq18tIWtsM7h+DexncQ==
zspNqjUKBdJVHTkiMMXJYeF7G53bVvMPoA==
hopQr+b8KzPIbMWvw0Yxir6cyw==
2thmt+17FR/MVsakbM/+w3xGOhopJw==
5gO5gfA6jwna/4FNSPqrvvHyr2A=
kqtr0wr9KaOXVMyDDexncQ==
PNldyz0Boa5cLGAf4A==
Gysor7fqabd0UzTwWp3Zir6cyw==
pMRgV18gtLorB21prX4=
ukpf+vu2u+hWN5Q=
pcS/rO+KmPMj69G9cMHnoSEm59cbIQ==
4fWGzv347bFNDYJeeIHKG5co
WXlRyM2Yn+4Ab1EgRAFHWdGDCzf1
ZPoM+2U1cwMzteOBsHY=
o8jQoNron4sT3A/KomE=
7QX8tTpv/A+YKw==
wFvmV8SY/A+YKw==
95ZJuruBovPziXkgyca4
DMhVqQXTdWLZcWM3IVNtZg==
Fya6G31VF/eHQ+OBsHY=
Q1AMfbPC2yU1IZV9q4C8vvHyr2A=
fRtdZZssSsG3s6Z7
bxBFLS8FnGv/bdOdDdjmfHz9ww==
0YG+jc1b/A+YKw==
lRliT3IEEDJ4ZoZ8a+7meQ==
dI7SuWbu40M=
Z4oXeMBk6sdDMow=
h5BX2BodM4ChJyEJXWhZEIlmBBTw
cYNHnMHSDHNoFn5XDexncQ==
U4uXeMXGel/Yo5F7JWy7ir6cyw==
w30JX9IHAfmEUkjMfJSh
nyYeAHdAO4ibDfK6+QoHkxDjQ0L/
kRNHMSv9qT1YAOi+/YTEubWayQ==
K84SAQbaiIE2JhEBwkI87fHyr2A=
/TfyyBrkRXG3s6Z7
Xm4DxD9z/A+YKw==
Iiod8GDRqTNm
UQavJOBL1PauNg==
5gHqohpY/A+YKw==
p9NjrOfd7y00suOBsHY=
+QwD0hEcmOH9FrqKOoip
t1ynrb95ITDbVcCcYLbyyYAhz/aC86DP
nsJ4j550C9tdGUvpa9jieQ==
2UyPicBXYsG3s6Z7
JcXRsh7oFKPHNx7+VFi2w/Hyr2A=
3AT+4Rqw0TI3s+OBsHY=
0m73TYSQvcdyP7Khu0w87fHyr2A=
0tyaI3KOu9UtnY5MWuNVKWo=
SXV//PAYkeL6tJB6LnC7ir6cyw==
BZ3ZnFfRqTNm
DIiVdbFCcAQd/3FWhBPOSNDjQ0L/
PzqDVoWG2r6rM5N9histir6cyw==
QFxDG5iTNsm3s6Z7
K07iK1LZc1POTrmDDexncQ==
1WJ3D0tnnQICtizlgdNO55Ii
Y3YBWZCixOhWN5Q=
N1AaNH32m3YaLGAf4A==
2wYTDEnS7XWxVTvMfJSh
Um9jMnNrA+BtRUDMfJSh
8eqyDgzQxuhWN5Q=
JbnNV71HXsW3s6Z7
escortsforme.com
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ET3B30WFvUox72P.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\Geo\Nation ET3B30WFvUox72P.exe -
Loads dropped DLL 1 IoCs
Processes:
mstsc.exepid process 1900 mstsc.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
ET3B30WFvUox72P.exeET3B30WFvUox72P.exemstsc.exedescription pid process target process PID 1972 set thread context of 1148 1972 ET3B30WFvUox72P.exe ET3B30WFvUox72P.exe PID 1148 set thread context of 1288 1148 ET3B30WFvUox72P.exe Explorer.EXE PID 1900 set thread context of 1288 1900 mstsc.exe Explorer.EXE -
Processes:
mstsc.exedescription ioc process Key created \Registry\User\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 mstsc.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
ET3B30WFvUox72P.exemstsc.exepid process 1148 ET3B30WFvUox72P.exe 1148 ET3B30WFvUox72P.exe 1148 ET3B30WFvUox72P.exe 1148 ET3B30WFvUox72P.exe 1900 mstsc.exe 1900 mstsc.exe 1900 mstsc.exe 1900 mstsc.exe 1900 mstsc.exe 1900 mstsc.exe 1900 mstsc.exe 1900 mstsc.exe 1900 mstsc.exe 1900 mstsc.exe 1900 mstsc.exe 1900 mstsc.exe 1900 mstsc.exe 1900 mstsc.exe 1900 mstsc.exe 1900 mstsc.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
ET3B30WFvUox72P.exemstsc.exepid process 1148 ET3B30WFvUox72P.exe 1148 ET3B30WFvUox72P.exe 1148 ET3B30WFvUox72P.exe 1900 mstsc.exe 1900 mstsc.exe 1900 mstsc.exe 1900 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ET3B30WFvUox72P.exemstsc.exedescription pid process Token: SeDebugPrivilege 1148 ET3B30WFvUox72P.exe Token: SeDebugPrivilege 1900 mstsc.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1288 Explorer.EXE 1288 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1288 Explorer.EXE 1288 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
ET3B30WFvUox72P.exeExplorer.EXEmstsc.exedescription pid process target process PID 1972 wrote to memory of 1148 1972 ET3B30WFvUox72P.exe ET3B30WFvUox72P.exe PID 1972 wrote to memory of 1148 1972 ET3B30WFvUox72P.exe ET3B30WFvUox72P.exe PID 1972 wrote to memory of 1148 1972 ET3B30WFvUox72P.exe ET3B30WFvUox72P.exe PID 1972 wrote to memory of 1148 1972 ET3B30WFvUox72P.exe ET3B30WFvUox72P.exe PID 1972 wrote to memory of 1148 1972 ET3B30WFvUox72P.exe ET3B30WFvUox72P.exe PID 1972 wrote to memory of 1148 1972 ET3B30WFvUox72P.exe ET3B30WFvUox72P.exe PID 1972 wrote to memory of 1148 1972 ET3B30WFvUox72P.exe ET3B30WFvUox72P.exe PID 1288 wrote to memory of 1900 1288 Explorer.EXE mstsc.exe PID 1288 wrote to memory of 1900 1288 Explorer.EXE mstsc.exe PID 1288 wrote to memory of 1900 1288 Explorer.EXE mstsc.exe PID 1288 wrote to memory of 1900 1288 Explorer.EXE mstsc.exe PID 1900 wrote to memory of 1492 1900 mstsc.exe Firefox.exe PID 1900 wrote to memory of 1492 1900 mstsc.exe Firefox.exe PID 1900 wrote to memory of 1492 1900 mstsc.exe Firefox.exe PID 1900 wrote to memory of 1492 1900 mstsc.exe Firefox.exe PID 1900 wrote to memory of 1492 1900 mstsc.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ET3B30WFvUox72P.exe"C:\Users\Admin\AppData\Local\Temp\ET3B30WFvUox72P.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ET3B30WFvUox72P.exe"C:\Users\Admin\AppData\Local\Temp\ET3B30WFvUox72P.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
922KB
MD5dda1b03a5cd2ca37c96b7daf5e3a8ed7
SHA1c70e5f58e61980d39608f0795879bf012dbbbca2
SHA25679f86c1edbbc69652a03a0f5667b3985bcf1e19f16fa3b8c7934e5b97ab8586d
SHA512bf83648c9b5d6d65b2c8409d262a1b7421d2cb13d6c759ec5f352c2d1c5adff3ee2395250fbdfe3590f25fe96bf6b40c2d82a8e7eecaab03be2e6a398e83981f
-
memory/1148-69-0x0000000000870000-0x0000000000B73000-memory.dmpFilesize
3.0MB
-
memory/1148-64-0x00000000004012B0-mapping.dmp
-
memory/1148-70-0x00000000000F0000-0x0000000000100000-memory.dmpFilesize
64KB
-
memory/1148-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1148-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1148-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1148-67-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1148-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1148-75-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1148-73-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1288-82-0x0000000006E80000-0x0000000007004000-memory.dmpFilesize
1.5MB
-
memory/1288-71-0x00000000064D0000-0x00000000065A0000-memory.dmpFilesize
832KB
-
memory/1288-80-0x0000000006E80000-0x0000000007004000-memory.dmpFilesize
1.5MB
-
memory/1900-78-0x0000000002180000-0x0000000002483000-memory.dmpFilesize
3.0MB
-
memory/1900-76-0x0000000000540000-0x0000000000644000-memory.dmpFilesize
1.0MB
-
memory/1900-77-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1900-79-0x0000000002010000-0x000000000209F000-memory.dmpFilesize
572KB
-
memory/1900-72-0x0000000000000000-mapping.dmp
-
memory/1900-81-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1972-59-0x0000000000AC0000-0x0000000000B06000-memory.dmpFilesize
280KB
-
memory/1972-57-0x00000000003F0000-0x00000000003FE000-memory.dmpFilesize
56KB
-
memory/1972-54-0x0000000001230000-0x000000000130C000-memory.dmpFilesize
880KB
-
memory/1972-56-0x00000000003D0000-0x00000000003E6000-memory.dmpFilesize
88KB
-
memory/1972-58-0x00000000051D0000-0x0000000005250000-memory.dmpFilesize
512KB
-
memory/1972-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmpFilesize
8KB