Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-05-2023 06:14
Static task
static1
Behavioral task
behavioral1
Sample
bankdetails.exe
Resource
win7-20230220-en
General
-
Target
bankdetails.exe
-
Size
670KB
-
MD5
c5bfc79069cf743f50c82449ff7b597c
-
SHA1
b7ce8cce3995ff60ca0be6ff2fad05f30cca57a7
-
SHA256
120694aadf1eb3c014ff05aea81661da85e34080d23ee2570b98d88b504b1819
-
SHA512
bfd19942dc549d78c26f7b3bdcc6d1b897d39bd2a34ac0b7f982f5e139e8a84c5d017d18976d1cedf37016f9d5d1d77389b8fe949730e8db94691166c904b7bd
-
SSDEEP
12288:+Ff2iN+LwRQe3EVNyFoSfoy6zaYbtUkHTDeDXCvLMpLSt:I18Lw6jVNyFofy0btUkHPeDSja
Malware Config
Extracted
formbook
4.1
gtt8
thesuccessbot.com
rittercivil.com
jt1.fun
d365extension.com
quqoxeq.top
visittworiverswi.com
bfprotienda.com
greenhabitsph.com
ladmere.com
clockboutiques.com
minwart.xyz
xinyuejiancai.online
eggsl.com
fetchingcandles.com
skywatiniya.com
hinkley.news
realityonlineenterprises.com
teamcroissant.com
esfera-pv.ch
herdadedosmontesbastos.com
buddhistprayers.app
talytic-one.com
capital-top.com
pawmultiverse.com
gdrop.biz
africanswers.online
amgconstruct1on.com
review.builders
findinstinct.online
leseditionsdupangolin.site
vector-sale.com
hutesmarke.shop
spacevisualmedia.com
jeweledcrown.shop
divinedivas.store
redirr.online
callifam.com
nickelinfo.com
ginghamstudio.com
launchthepodcast.com
arlisia.com
kerryshields.com
xn--o39aj5xqvflut.com
ramsgatecarwash.com
semrushfreetrails.com
rmpaclub.ru
wtpoexpo.one
amlar.xyz
downlis.top
phrasecheck.com
uk885.top
gdtrn.com
99522v.com
liftdetox2023.online
evo-omega.cloud
iccu3v.link
amd-soft1.site
containermurah.xyz
vineagency.uk
leeprintanddesign.com
bnjyjy.com
bookra-ck.com
ilyinsurance.com
texasmicroneedling.com
osmosstore.com
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1520-64-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1520-68-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1520-76-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1692-80-0x0000000000090000-0x00000000000BF000-memory.dmp formbook behavioral1/memory/1692-82-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1696 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
bankdetails.exebankdetails.exerundll32.exedescription pid process target process PID 1124 set thread context of 1520 1124 bankdetails.exe bankdetails.exe PID 1520 set thread context of 1192 1520 bankdetails.exe Explorer.EXE PID 1520 set thread context of 1192 1520 bankdetails.exe Explorer.EXE PID 1692 set thread context of 1192 1692 rundll32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
bankdetails.exerundll32.exepid process 1520 bankdetails.exe 1520 bankdetails.exe 1520 bankdetails.exe 1692 rundll32.exe 1692 rundll32.exe 1692 rundll32.exe 1692 rundll32.exe 1692 rundll32.exe 1692 rundll32.exe 1692 rundll32.exe 1692 rundll32.exe 1692 rundll32.exe 1692 rundll32.exe 1692 rundll32.exe 1692 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1192 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
bankdetails.exerundll32.exepid process 1520 bankdetails.exe 1520 bankdetails.exe 1520 bankdetails.exe 1520 bankdetails.exe 1692 rundll32.exe 1692 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
bankdetails.exerundll32.exedescription pid process Token: SeDebugPrivilege 1520 bankdetails.exe Token: SeDebugPrivilege 1692 rundll32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1192 Explorer.EXE 1192 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1192 Explorer.EXE 1192 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
bankdetails.exeExplorer.EXErundll32.exedescription pid process target process PID 1124 wrote to memory of 1520 1124 bankdetails.exe bankdetails.exe PID 1124 wrote to memory of 1520 1124 bankdetails.exe bankdetails.exe PID 1124 wrote to memory of 1520 1124 bankdetails.exe bankdetails.exe PID 1124 wrote to memory of 1520 1124 bankdetails.exe bankdetails.exe PID 1124 wrote to memory of 1520 1124 bankdetails.exe bankdetails.exe PID 1124 wrote to memory of 1520 1124 bankdetails.exe bankdetails.exe PID 1124 wrote to memory of 1520 1124 bankdetails.exe bankdetails.exe PID 1192 wrote to memory of 1692 1192 Explorer.EXE rundll32.exe PID 1192 wrote to memory of 1692 1192 Explorer.EXE rundll32.exe PID 1192 wrote to memory of 1692 1192 Explorer.EXE rundll32.exe PID 1192 wrote to memory of 1692 1192 Explorer.EXE rundll32.exe PID 1192 wrote to memory of 1692 1192 Explorer.EXE rundll32.exe PID 1192 wrote to memory of 1692 1192 Explorer.EXE rundll32.exe PID 1192 wrote to memory of 1692 1192 Explorer.EXE rundll32.exe PID 1692 wrote to memory of 1696 1692 rundll32.exe cmd.exe PID 1692 wrote to memory of 1696 1692 rundll32.exe cmd.exe PID 1692 wrote to memory of 1696 1692 rundll32.exe cmd.exe PID 1692 wrote to memory of 1696 1692 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bankdetails.exe"C:\Users\Admin\AppData\Local\Temp\bankdetails.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bankdetails.exe"C:\Users\Admin\AppData\Local\Temp\bankdetails.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\bankdetails.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1124-54-0x0000000000DE0000-0x0000000000E8E000-memory.dmpFilesize
696KB
-
memory/1124-55-0x0000000004BA0000-0x0000000004BE0000-memory.dmpFilesize
256KB
-
memory/1124-56-0x0000000004BA0000-0x0000000004BE0000-memory.dmpFilesize
256KB
-
memory/1124-57-0x0000000000360000-0x0000000000374000-memory.dmpFilesize
80KB
-
memory/1124-58-0x0000000000390000-0x000000000039C000-memory.dmpFilesize
48KB
-
memory/1124-59-0x0000000005160000-0x00000000051D0000-memory.dmpFilesize
448KB
-
memory/1124-60-0x0000000004290000-0x00000000042C8000-memory.dmpFilesize
224KB
-
memory/1192-89-0x0000000004090000-0x000000000413F000-memory.dmpFilesize
700KB
-
memory/1192-87-0x0000000006210000-0x0000000006352000-memory.dmpFilesize
1.3MB
-
memory/1192-86-0x0000000004090000-0x000000000413F000-memory.dmpFilesize
700KB
-
memory/1192-85-0x0000000004090000-0x000000000413F000-memory.dmpFilesize
700KB
-
memory/1192-66-0x0000000000240000-0x0000000000340000-memory.dmpFilesize
1024KB
-
memory/1192-74-0x0000000006210000-0x0000000006352000-memory.dmpFilesize
1.3MB
-
memory/1192-70-0x00000000060F0000-0x0000000006203000-memory.dmpFilesize
1.1MB
-
memory/1520-69-0x00000000002E0000-0x00000000002F5000-memory.dmpFilesize
84KB
-
memory/1520-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1520-73-0x0000000000320000-0x0000000000335000-memory.dmpFilesize
84KB
-
memory/1520-67-0x0000000000890000-0x0000000000B93000-memory.dmpFilesize
3.0MB
-
memory/1520-76-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1520-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1520-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1520-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1520-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1692-79-0x0000000000540000-0x000000000054E000-memory.dmpFilesize
56KB
-
memory/1692-82-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/1692-84-0x0000000001EC0000-0x0000000001F54000-memory.dmpFilesize
592KB
-
memory/1692-81-0x0000000002190000-0x0000000002493000-memory.dmpFilesize
3.0MB
-
memory/1692-80-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/1692-77-0x0000000000540000-0x000000000054E000-memory.dmpFilesize
56KB
-
memory/1692-75-0x0000000000540000-0x000000000054E000-memory.dmpFilesize
56KB