Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-12-2022 00:08
Static task
static1
General
-
Target
5100952549.exe
-
Size
876KB
-
MD5
c32da4c9874da9bcb408f97dc8dc1e64
-
SHA1
798dbd26fd9f4073e1130ad84f065e22b3bdb3c5
-
SHA256
e55222db4cd5a2a35266b2dfc36cd36f69abdb566d9f8863136ba618415e9940
-
SHA512
3433551af28ad6e37b8573370c9ccf926e7ff782b382bff6705d0b7aa936c81b9e5c038391afcc77032eeb55531fc05736a35e70682de6792d3671ae89f0b5ca
-
SSDEEP
12288:/JoQgKZ/nXt7virmWhlGLaQYI2ke/NBur3OCpt/ehINBuy05AUN/O57f+fNOQa5w:/6TNcrXvaIN7Hb57f+F1aMt
Malware Config
Extracted
formbook
n2hm
XCeG4IxNKbAl
YzJWbnC+El84nA==
KAJcdmP8yEcO5LXPCFF42Wfb
I+J+xYO95GJQWVU=
GtgxPPv3FmQmhw==
Og9NYF4xEl+j7vGTR93xvg==
506Cg07bsT0G6yK+A96H0h35V+JLkwI=
wAYXFN+pSFIXgQ==
ijzLI/f+FmQmhw==
UfT2PweNm+w8
GQWVw5aZnfF/kS5e
30BKYjua9zcA7gAwsPUngLnjyrBNEgo=
AM65OrmyFmQmhw==
VSlTVxISZ4J/kS5e
GGKj6K33SRh6e0/YzT5nQGlK5CXRqw==
B9H98cUUfX+AWOqiTA==
MxVffWOIoVnM37zrd2sTaOY=
z6bxCgG/mGhR7oDzQA==
pQgSLSRi6AK3M/PdArpX
6rRRsYuSnXx/kS5e
tJRNn0ias3Yw
7c4NEQLSp/R/kS5e
TJmwu5Aa/IuRHtoXXQ==
TLoRUygkiJQE5GoRji0aff0=
Y83qB/DsQFYeZzahj6pYqw==
Bup2q3PHFmQmhw==
cDTa78WEWaYMdoDdArpX
28Rw4MRMnjT52raaTR5KhtMJYa8=
WydpZS7v/4XubCZuhkdxP2OAKdyK68u6
B+osKudaL8yAV/K/VAH3T+Q=
qVz9Y0QD3TGeM/PdArpX
+r49VzlFXLpFegdyc4q5ow==
gsXk990afa1hl6ATTA==
XkblOQWRaet/kS5e
4TNPSf2OcfNk9cfPCFF42Wfb
NaIIUEoRdKYr
ITSqBfn5FmQmhw==
KPRUmWnqxVE0hERFtyo=
VLzd1qk6E5wNcQ49KnmhAoT3Ok5roMK4kQ==
65jM2pKJ8EIST04=
I3+JoYVgYgDiv3O15Ntvw0On/sJroMK4kQ==
C+YhNzH20aCpy8MqVw==
yBZRl4HdPn+RHtoXXQ==
pGQATg0mMfntSBR9c4q5ow==
YUKFixIRdKYr
Hv+C4cZTOMAKV+/dArpX
MVW+PJpyCVA=
FX2AJYBFYbgk
/cX1CsjSpvU+
fWoThWagDVhBHt4yMjWQifM=
/vCd69xrS8QwuCt/yD8=
GvAsSzbCRxplG582TKzVug==
S6zlGfJ6DFc4TBNUvig=
k0z/QwnTpfR/kS5e
KPofKfkPcoRqxowFuWWNhvM=
Xrj+JvENc3yBln4OUw==
ScTatpYj/IKRHtoXXQ==
vLRdwbLyTpzFn+dAR93xvg==
mLTJe/eFp2kxl69W
Cbr5/dRQbio2P/e8ay0aff0=
xooviWn51V7DI7mMOwWT4lCIJUlf
l0t7fTmLqSCAuIYIVA==
06xFejwYMSkbfETTiNT21O0=
bWzTF+1nS4kxlydW
madamkikkiey.net
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5100952549.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\Geo\Nation 5100952549.exe -
Loads dropped DLL 1 IoCs
Processes:
help.exepid process 1356 help.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
5100952549.exe5100952549.exehelp.exedescription pid process target process PID 1576 set thread context of 960 1576 5100952549.exe 5100952549.exe PID 960 set thread context of 1276 960 5100952549.exe Explorer.EXE PID 1356 set thread context of 1276 1356 help.exe Explorer.EXE -
Processes:
help.exedescription ioc process Key created \Registry\User\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 help.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
5100952549.exehelp.exepid process 960 5100952549.exe 960 5100952549.exe 960 5100952549.exe 960 5100952549.exe 1356 help.exe 1356 help.exe 1356 help.exe 1356 help.exe 1356 help.exe 1356 help.exe 1356 help.exe 1356 help.exe 1356 help.exe 1356 help.exe 1356 help.exe 1356 help.exe 1356 help.exe 1356 help.exe 1356 help.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
5100952549.exehelp.exepid process 960 5100952549.exe 960 5100952549.exe 960 5100952549.exe 1356 help.exe 1356 help.exe 1356 help.exe 1356 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5100952549.exehelp.exedescription pid process Token: SeDebugPrivilege 960 5100952549.exe Token: SeDebugPrivilege 1356 help.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1276 Explorer.EXE 1276 Explorer.EXE -
Suspicious use of SendNotifyMessage 15 IoCs
Processes:
Explorer.EXEpid process 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
5100952549.exeExplorer.EXEhelp.exedescription pid process target process PID 1576 wrote to memory of 960 1576 5100952549.exe 5100952549.exe PID 1576 wrote to memory of 960 1576 5100952549.exe 5100952549.exe PID 1576 wrote to memory of 960 1576 5100952549.exe 5100952549.exe PID 1576 wrote to memory of 960 1576 5100952549.exe 5100952549.exe PID 1576 wrote to memory of 960 1576 5100952549.exe 5100952549.exe PID 1576 wrote to memory of 960 1576 5100952549.exe 5100952549.exe PID 1576 wrote to memory of 960 1576 5100952549.exe 5100952549.exe PID 1276 wrote to memory of 1356 1276 Explorer.EXE help.exe PID 1276 wrote to memory of 1356 1276 Explorer.EXE help.exe PID 1276 wrote to memory of 1356 1276 Explorer.EXE help.exe PID 1276 wrote to memory of 1356 1276 Explorer.EXE help.exe PID 1356 wrote to memory of 1900 1356 help.exe Firefox.exe PID 1356 wrote to memory of 1900 1356 help.exe Firefox.exe PID 1356 wrote to memory of 1900 1356 help.exe Firefox.exe PID 1356 wrote to memory of 1900 1356 help.exe Firefox.exe PID 1356 wrote to memory of 1900 1356 help.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5100952549.exe"C:\Users\Admin\AppData\Local\Temp\5100952549.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5100952549.exe"C:\Users\Admin\AppData\Local\Temp\5100952549.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
949KB
MD538a3e021eb32c9976adaf0b3372080fc
SHA168e02803c646be21007d90bec841c176b82211fd
SHA2568cde0275d60da0d11954f73c7c8862cfc4b306f61bb8b1ce14abe4a193af2652
SHA512b886cc112f2750e7300b66f7242850659fa49fdc97f75aed376cb9f5440875f303a143bf8b51068ec42674f1ebe1dfcc40534f3a7aed3cc4d20f9274b9a66d18
-
memory/960-69-0x0000000000970000-0x0000000000C73000-memory.dmpFilesize
3.0MB
-
memory/960-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/960-70-0x0000000000070000-0x0000000000080000-memory.dmpFilesize
64KB
-
memory/960-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/960-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/960-73-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/960-64-0x00000000004012B0-mapping.dmp
-
memory/960-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/960-67-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/960-74-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1276-82-0x00000000063F0000-0x00000000064F8000-memory.dmpFilesize
1.0MB
-
memory/1276-71-0x0000000006720000-0x000000000684A000-memory.dmpFilesize
1.2MB
-
memory/1276-79-0x00000000063F0000-0x00000000064F8000-memory.dmpFilesize
1.0MB
-
memory/1356-77-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1356-72-0x0000000000000000-mapping.dmp
-
memory/1356-75-0x0000000000AE0000-0x0000000000AE6000-memory.dmpFilesize
24KB
-
memory/1356-76-0x00000000007D0000-0x0000000000AD3000-memory.dmpFilesize
3.0MB
-
memory/1356-78-0x0000000000640000-0x00000000006CF000-memory.dmpFilesize
572KB
-
memory/1356-80-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1576-59-0x0000000005980000-0x00000000059DA000-memory.dmpFilesize
360KB
-
memory/1576-57-0x0000000000800000-0x000000000080E000-memory.dmpFilesize
56KB
-
memory/1576-56-0x0000000000620000-0x0000000000636000-memory.dmpFilesize
88KB
-
memory/1576-54-0x0000000000EF0000-0x0000000000FD2000-memory.dmpFilesize
904KB
-
memory/1576-58-0x0000000007C60000-0x0000000007CF4000-memory.dmpFilesize
592KB
-
memory/1576-55-0x0000000075B11000-0x0000000075B13000-memory.dmpFilesize
8KB