Analysis
-
max time kernel
148s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2023 09:50
Static task
static1
Behavioral task
behavioral1
Sample
DSX_AIR_.exe
Resource
win7-20220812-en
General
-
Target
DSX_AIR_.exe
-
Size
764KB
-
MD5
2a7e5440b5fb19ba09cfcce1afe85e0f
-
SHA1
122b7e5c3496c9e7ff528ae800526876c090050d
-
SHA256
dc0f8440e9ae92761e5e833b22c2448fb0f2900f9a184e823b299c74db5c1085
-
SHA512
2d313577170221cbf9bb6dd0439f76506c3a4d0d88370af8b350363748953d01847906c0e04c1c09d3e7f2500cb648ee7a21167bcafd0fbe278e2bf700a92ac2
-
SSDEEP
12288:Ut4gOMtEwcU3gZ+GQzjkATGdszyZtHZlCmWhrjKYQDJxuv64GEabMhwHJ7GPzlfK:uRO6AAgZbQzlGIyZFggDJKES2J7GPzly
Malware Config
Extracted
formbook
4.1
gg62
growfast.africa
lerema.com
38945.se
wheelfermotors.africa
giftshareforyou.online
burrismktg.com
keepgrowing.uk
efefhomeless.buzz
bryanokoh.com
fashion-clothing-40094.com
andreasunshine.com
naijahood.africa
aditrirealty.com
kinnoitodatsumou.com
cryptoqzclimax.com
hairly.biz
comeuphither4.com
integrity360.ltd
flushywhole.com
8869365.com
fabvance-demos.online
motherpearl.africa
dnsmctmu.com
25779.football
crimson-sunset.ru
haamyounghoon.com
0563news.com
battleb0t.site
transnetfreight.africa
djdaxroadshow.co.uk
bwrps.live
abuin.vip
impressionsbyb.store
findguyscolorado.com
jordanflowerauction.net
fdm50off.com
31seaaa.com
centuryofviolence.co.uk
againstszhanweek.com
injurylawyersconsultants.com
kuotabike.com
cruisejoy.uk
clotaire.ru
hurloic.xyz
anvair.com
ivapeonthis.com
hotsesso.xyz
khramvyazovki.store
mentalistas.dev
cahayasunnah.com
bypro1.online
flavoredkreations.info
inuwallet.com
livingemployebenefits.com
enlighthings.com
focobreathwork.com
emaskhalipahbertam.com
jswl.store
chamaera.com
abbeyspear.com
downwind.one
lovelive.buzz
essentialhealth101.com
irakit.com
cbsht.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/388-140-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/388-142-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1012-148-0x0000000000E10000-0x0000000000E3F000-memory.dmp formbook behavioral2/memory/1012-152-0x0000000000E10000-0x0000000000E3F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
DSX_AIR_.exeDSX_AIR_.exeWWAHost.exedescription pid process target process PID 4664 set thread context of 388 4664 DSX_AIR_.exe DSX_AIR_.exe PID 388 set thread context of 684 388 DSX_AIR_.exe Explorer.EXE PID 1012 set thread context of 684 1012 WWAHost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
DSX_AIR_.exeDSX_AIR_.exeWWAHost.exepid process 4664 DSX_AIR_.exe 4664 DSX_AIR_.exe 4664 DSX_AIR_.exe 4664 DSX_AIR_.exe 388 DSX_AIR_.exe 388 DSX_AIR_.exe 388 DSX_AIR_.exe 388 DSX_AIR_.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe 1012 WWAHost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 684 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
DSX_AIR_.exeWWAHost.exepid process 388 DSX_AIR_.exe 388 DSX_AIR_.exe 388 DSX_AIR_.exe 1012 WWAHost.exe 1012 WWAHost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
DSX_AIR_.exeDSX_AIR_.exeWWAHost.exedescription pid process Token: SeDebugPrivilege 4664 DSX_AIR_.exe Token: SeDebugPrivilege 388 DSX_AIR_.exe Token: SeDebugPrivilege 1012 WWAHost.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
DSX_AIR_.exeExplorer.EXEWWAHost.exedescription pid process target process PID 4664 wrote to memory of 1084 4664 DSX_AIR_.exe DSX_AIR_.exe PID 4664 wrote to memory of 1084 4664 DSX_AIR_.exe DSX_AIR_.exe PID 4664 wrote to memory of 1084 4664 DSX_AIR_.exe DSX_AIR_.exe PID 4664 wrote to memory of 3420 4664 DSX_AIR_.exe DSX_AIR_.exe PID 4664 wrote to memory of 3420 4664 DSX_AIR_.exe DSX_AIR_.exe PID 4664 wrote to memory of 3420 4664 DSX_AIR_.exe DSX_AIR_.exe PID 4664 wrote to memory of 388 4664 DSX_AIR_.exe DSX_AIR_.exe PID 4664 wrote to memory of 388 4664 DSX_AIR_.exe DSX_AIR_.exe PID 4664 wrote to memory of 388 4664 DSX_AIR_.exe DSX_AIR_.exe PID 4664 wrote to memory of 388 4664 DSX_AIR_.exe DSX_AIR_.exe PID 4664 wrote to memory of 388 4664 DSX_AIR_.exe DSX_AIR_.exe PID 4664 wrote to memory of 388 4664 DSX_AIR_.exe DSX_AIR_.exe PID 684 wrote to memory of 1012 684 Explorer.EXE WWAHost.exe PID 684 wrote to memory of 1012 684 Explorer.EXE WWAHost.exe PID 684 wrote to memory of 1012 684 Explorer.EXE WWAHost.exe PID 1012 wrote to memory of 2316 1012 WWAHost.exe cmd.exe PID 1012 wrote to memory of 2316 1012 WWAHost.exe cmd.exe PID 1012 wrote to memory of 2316 1012 WWAHost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DSX_AIR_.exe"C:\Users\Admin\AppData\Local\Temp\DSX_AIR_.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DSX_AIR_.exe"C:\Users\Admin\AppData\Local\Temp\DSX_AIR_.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\DSX_AIR_.exe"C:\Users\Admin\AppData\Local\Temp\DSX_AIR_.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\DSX_AIR_.exe"C:\Users\Admin\AppData\Local\Temp\DSX_AIR_.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DSX_AIR_.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/388-142-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/388-144-0x0000000000EA0000-0x0000000000EB4000-memory.dmpFilesize
80KB
-
memory/388-143-0x0000000000EC0000-0x000000000120A000-memory.dmpFilesize
3.3MB
-
memory/388-139-0x0000000000000000-mapping.dmp
-
memory/388-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/684-155-0x00000000081F0000-0x00000000082AE000-memory.dmpFilesize
760KB
-
memory/684-154-0x00000000081F0000-0x00000000082AE000-memory.dmpFilesize
760KB
-
memory/684-151-0x0000000003010000-0x00000000030D7000-memory.dmpFilesize
796KB
-
memory/684-145-0x0000000003010000-0x00000000030D7000-memory.dmpFilesize
796KB
-
memory/1012-148-0x0000000000E10000-0x0000000000E3F000-memory.dmpFilesize
188KB
-
memory/1012-152-0x0000000000E10000-0x0000000000E3F000-memory.dmpFilesize
188KB
-
memory/1012-153-0x0000000001F40000-0x0000000001FD3000-memory.dmpFilesize
588KB
-
memory/1012-150-0x0000000002040000-0x000000000238A000-memory.dmpFilesize
3.3MB
-
memory/1012-146-0x0000000000000000-mapping.dmp
-
memory/1012-147-0x0000000000F60000-0x000000000103C000-memory.dmpFilesize
880KB
-
memory/1084-137-0x0000000000000000-mapping.dmp
-
memory/2316-149-0x0000000000000000-mapping.dmp
-
memory/3420-138-0x0000000000000000-mapping.dmp
-
memory/4664-132-0x00000000007E0000-0x00000000008A6000-memory.dmpFilesize
792KB
-
memory/4664-136-0x0000000008F70000-0x000000000900C000-memory.dmpFilesize
624KB
-
memory/4664-135-0x00000000050F0000-0x00000000050FA000-memory.dmpFilesize
40KB
-
memory/4664-134-0x0000000005160000-0x00000000051F2000-memory.dmpFilesize
584KB
-
memory/4664-133-0x00000000057E0000-0x0000000005D84000-memory.dmpFilesize
5.6MB