Analysis
-
max time kernel
135s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2023 20:57
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.RATXgen.20743.26598.exe
Resource
win7-20230220-en
General
-
Target
SecuriteInfo.com.Win32.RATXgen.20743.26598.exe
-
Size
859KB
-
MD5
a1beddb06d1826829f7ff5f86e3fd9c0
-
SHA1
9f2562a5e1f702b11183df715e71ff77e0284d41
-
SHA256
44a297e5ccf344c0422f4f80b2c490f2650bf44c142f131378b2eb6a6507bc9b
-
SHA512
3bafe9bde27096fe04ea1b8a4e4e543c51f20902505988d4c68476c192109362ccc86b59bac82c179fcb8d6f4c2f3d561706a5441378997d1968d5ab286c22cb
-
SSDEEP
12288:899/9WflU/9XxworMzl5mWhm+DvuL4lZQbcRiv1Gnt2vJa+4pgexi:8/ylUFMmW/Dv5DQ714YaFpxi
Malware Config
Extracted
formbook
4.1
gtt8
thesuccessbot.com
rittercivil.com
jt1.fun
d365extension.com
quqoxeq.top
visittworiverswi.com
bfprotienda.com
greenhabitsph.com
ladmere.com
clockboutiques.com
minwart.xyz
xinyuejiancai.online
eggsl.com
fetchingcandles.com
skywatiniya.com
hinkley.news
realityonlineenterprises.com
teamcroissant.com
esfera-pv.ch
herdadedosmontesbastos.com
buddhistprayers.app
talytic-one.com
capital-top.com
pawmultiverse.com
gdrop.biz
africanswers.online
amgconstruct1on.com
review.builders
findinstinct.online
leseditionsdupangolin.site
vector-sale.com
hutesmarke.shop
spacevisualmedia.com
jeweledcrown.shop
divinedivas.store
redirr.online
callifam.com
nickelinfo.com
ginghamstudio.com
launchthepodcast.com
arlisia.com
kerryshields.com
xn--o39aj5xqvflut.com
ramsgatecarwash.com
semrushfreetrails.com
rmpaclub.ru
wtpoexpo.one
amlar.xyz
downlis.top
phrasecheck.com
uk885.top
gdtrn.com
99522v.com
liftdetox2023.online
evo-omega.cloud
iccu3v.link
amd-soft1.site
containermurah.xyz
vineagency.uk
leeprintanddesign.com
bnjyjy.com
bookra-ck.com
ilyinsurance.com
texasmicroneedling.com
osmosstore.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4652-140-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Win32.RATXgen.20743.26598.exedescription pid process target process PID 4284 set thread context of 4652 4284 SecuriteInfo.com.Win32.RATXgen.20743.26598.exe SecuriteInfo.com.Win32.RATXgen.20743.26598.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SecuriteInfo.com.Win32.RATXgen.20743.26598.exepid process 4652 SecuriteInfo.com.Win32.RATXgen.20743.26598.exe 4652 SecuriteInfo.com.Win32.RATXgen.20743.26598.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
SecuriteInfo.com.Win32.RATXgen.20743.26598.exedescription pid process target process PID 4284 wrote to memory of 4652 4284 SecuriteInfo.com.Win32.RATXgen.20743.26598.exe SecuriteInfo.com.Win32.RATXgen.20743.26598.exe PID 4284 wrote to memory of 4652 4284 SecuriteInfo.com.Win32.RATXgen.20743.26598.exe SecuriteInfo.com.Win32.RATXgen.20743.26598.exe PID 4284 wrote to memory of 4652 4284 SecuriteInfo.com.Win32.RATXgen.20743.26598.exe SecuriteInfo.com.Win32.RATXgen.20743.26598.exe PID 4284 wrote to memory of 4652 4284 SecuriteInfo.com.Win32.RATXgen.20743.26598.exe SecuriteInfo.com.Win32.RATXgen.20743.26598.exe PID 4284 wrote to memory of 4652 4284 SecuriteInfo.com.Win32.RATXgen.20743.26598.exe SecuriteInfo.com.Win32.RATXgen.20743.26598.exe PID 4284 wrote to memory of 4652 4284 SecuriteInfo.com.Win32.RATXgen.20743.26598.exe SecuriteInfo.com.Win32.RATXgen.20743.26598.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATXgen.20743.26598.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATXgen.20743.26598.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATXgen.20743.26598.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATXgen.20743.26598.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4652
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4284-133-0x00000000006E0000-0x00000000007BE000-memory.dmpFilesize
888KB
-
memory/4284-134-0x00000000056C0000-0x0000000005C64000-memory.dmpFilesize
5.6MB
-
memory/4284-135-0x00000000051B0000-0x0000000005242000-memory.dmpFilesize
584KB
-
memory/4284-136-0x0000000005360000-0x0000000005370000-memory.dmpFilesize
64KB
-
memory/4284-137-0x00000000052F0000-0x00000000052FA000-memory.dmpFilesize
40KB
-
memory/4284-138-0x0000000005360000-0x0000000005370000-memory.dmpFilesize
64KB
-
memory/4284-139-0x0000000006F70000-0x000000000700C000-memory.dmpFilesize
624KB
-
memory/4652-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4652-142-0x00000000014E0000-0x000000000182A000-memory.dmpFilesize
3.3MB