Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2023 09:21
Static task
static1
Behavioral task
behavioral1
Sample
TNTEXPRESS.exe
Resource
win7-20230220-en
General
-
Target
TNTEXPRESS.exe
-
Size
683KB
-
MD5
64ba7b4484114967c48bea5cff6ac9bb
-
SHA1
65eba06d17dd6b75ae74c5cf09ae5e25e81ea0e2
-
SHA256
757371fd80dda17d1844c472bead62365e29e5f902e32afad9bc0120346220d5
-
SHA512
6727c4345e373355a6bc39e900a890a6116ad051c60112089cf4cea1aed57f749cd3bf1904039ceec8ee522039a93ed48e4e0b47b5ee5e05922ac7d72ae31360
-
SSDEEP
12288:49oe+bBWrllPje9oSTSIEdlP9sDIZD/6K3ZZ5saOkdjB28lA5Y8:49oe+Ill0o3IyPq8NrpS0lWY
Malware Config
Extracted
formbook
4.1
gtt8
thesuccessbot.com
rittercivil.com
jt1.fun
d365extension.com
quqoxeq.top
visittworiverswi.com
bfprotienda.com
greenhabitsph.com
ladmere.com
clockboutiques.com
minwart.xyz
xinyuejiancai.online
eggsl.com
fetchingcandles.com
skywatiniya.com
hinkley.news
realityonlineenterprises.com
teamcroissant.com
esfera-pv.ch
herdadedosmontesbastos.com
buddhistprayers.app
talytic-one.com
capital-top.com
pawmultiverse.com
gdrop.biz
africanswers.online
amgconstruct1on.com
review.builders
findinstinct.online
leseditionsdupangolin.site
vector-sale.com
hutesmarke.shop
spacevisualmedia.com
jeweledcrown.shop
divinedivas.store
redirr.online
callifam.com
nickelinfo.com
ginghamstudio.com
launchthepodcast.com
arlisia.com
kerryshields.com
xn--o39aj5xqvflut.com
ramsgatecarwash.com
semrushfreetrails.com
rmpaclub.ru
wtpoexpo.one
amlar.xyz
downlis.top
phrasecheck.com
uk885.top
gdtrn.com
99522v.com
liftdetox2023.online
evo-omega.cloud
iccu3v.link
amd-soft1.site
containermurah.xyz
vineagency.uk
leeprintanddesign.com
bnjyjy.com
bookra-ck.com
ilyinsurance.com
texasmicroneedling.com
osmosstore.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3916-140-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3916-147-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4420-150-0x0000000000D60000-0x0000000000D8F000-memory.dmp formbook behavioral2/memory/4420-152-0x0000000000D60000-0x0000000000D8F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
TNTEXPRESS.exeTNTEXPRESS.exesvchost.exedescription pid process target process PID 1716 set thread context of 3916 1716 TNTEXPRESS.exe TNTEXPRESS.exe PID 3916 set thread context of 3172 3916 TNTEXPRESS.exe Explorer.EXE PID 4420 set thread context of 3172 4420 svchost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
TNTEXPRESS.exeTNTEXPRESS.exesvchost.exepid process 1716 TNTEXPRESS.exe 1716 TNTEXPRESS.exe 1716 TNTEXPRESS.exe 1716 TNTEXPRESS.exe 1716 TNTEXPRESS.exe 1716 TNTEXPRESS.exe 3916 TNTEXPRESS.exe 3916 TNTEXPRESS.exe 3916 TNTEXPRESS.exe 3916 TNTEXPRESS.exe 4420 svchost.exe 4420 svchost.exe 4420 svchost.exe 4420 svchost.exe 4420 svchost.exe 4420 svchost.exe 4420 svchost.exe 4420 svchost.exe 4420 svchost.exe 4420 svchost.exe 4420 svchost.exe 4420 svchost.exe 4420 svchost.exe 4420 svchost.exe 4420 svchost.exe 4420 svchost.exe 4420 svchost.exe 4420 svchost.exe 4420 svchost.exe 4420 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3172 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
TNTEXPRESS.exesvchost.exepid process 3916 TNTEXPRESS.exe 3916 TNTEXPRESS.exe 3916 TNTEXPRESS.exe 4420 svchost.exe 4420 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
TNTEXPRESS.exeTNTEXPRESS.exesvchost.exedescription pid process Token: SeDebugPrivilege 1716 TNTEXPRESS.exe Token: SeDebugPrivilege 3916 TNTEXPRESS.exe Token: SeDebugPrivilege 4420 svchost.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
TNTEXPRESS.exeExplorer.EXEsvchost.exedescription pid process target process PID 1716 wrote to memory of 648 1716 TNTEXPRESS.exe TNTEXPRESS.exe PID 1716 wrote to memory of 648 1716 TNTEXPRESS.exe TNTEXPRESS.exe PID 1716 wrote to memory of 648 1716 TNTEXPRESS.exe TNTEXPRESS.exe PID 1716 wrote to memory of 3988 1716 TNTEXPRESS.exe TNTEXPRESS.exe PID 1716 wrote to memory of 3988 1716 TNTEXPRESS.exe TNTEXPRESS.exe PID 1716 wrote to memory of 3988 1716 TNTEXPRESS.exe TNTEXPRESS.exe PID 1716 wrote to memory of 3164 1716 TNTEXPRESS.exe TNTEXPRESS.exe PID 1716 wrote to memory of 3164 1716 TNTEXPRESS.exe TNTEXPRESS.exe PID 1716 wrote to memory of 3164 1716 TNTEXPRESS.exe TNTEXPRESS.exe PID 1716 wrote to memory of 3916 1716 TNTEXPRESS.exe TNTEXPRESS.exe PID 1716 wrote to memory of 3916 1716 TNTEXPRESS.exe TNTEXPRESS.exe PID 1716 wrote to memory of 3916 1716 TNTEXPRESS.exe TNTEXPRESS.exe PID 1716 wrote to memory of 3916 1716 TNTEXPRESS.exe TNTEXPRESS.exe PID 1716 wrote to memory of 3916 1716 TNTEXPRESS.exe TNTEXPRESS.exe PID 1716 wrote to memory of 3916 1716 TNTEXPRESS.exe TNTEXPRESS.exe PID 3172 wrote to memory of 4420 3172 Explorer.EXE svchost.exe PID 3172 wrote to memory of 4420 3172 Explorer.EXE svchost.exe PID 3172 wrote to memory of 4420 3172 Explorer.EXE svchost.exe PID 4420 wrote to memory of 1448 4420 svchost.exe cmd.exe PID 4420 wrote to memory of 1448 4420 svchost.exe cmd.exe PID 4420 wrote to memory of 1448 4420 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TNTEXPRESS.exe"C:\Users\Admin\AppData\Local\Temp\TNTEXPRESS.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TNTEXPRESS.exe"C:\Users\Admin\AppData\Local\Temp\TNTEXPRESS.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\TNTEXPRESS.exe"C:\Users\Admin\AppData\Local\Temp\TNTEXPRESS.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\TNTEXPRESS.exe"C:\Users\Admin\AppData\Local\Temp\TNTEXPRESS.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\TNTEXPRESS.exe"C:\Users\Admin\AppData\Local\Temp\TNTEXPRESS.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\TNTEXPRESS.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1716-133-0x0000000000830000-0x00000000008E2000-memory.dmpFilesize
712KB
-
memory/1716-134-0x0000000005810000-0x0000000005DB4000-memory.dmpFilesize
5.6MB
-
memory/1716-135-0x0000000005300000-0x0000000005392000-memory.dmpFilesize
584KB
-
memory/1716-136-0x00000000054A0000-0x00000000054B0000-memory.dmpFilesize
64KB
-
memory/1716-137-0x00000000052B0000-0x00000000052BA000-memory.dmpFilesize
40KB
-
memory/1716-138-0x00000000054A0000-0x00000000054B0000-memory.dmpFilesize
64KB
-
memory/1716-139-0x0000000001100000-0x000000000119C000-memory.dmpFilesize
624KB
-
memory/3172-145-0x0000000002C00000-0x0000000002D37000-memory.dmpFilesize
1.2MB
-
memory/3172-155-0x0000000008820000-0x0000000008934000-memory.dmpFilesize
1.1MB
-
memory/3172-158-0x0000000008820000-0x0000000008934000-memory.dmpFilesize
1.1MB
-
memory/3172-156-0x0000000008820000-0x0000000008934000-memory.dmpFilesize
1.1MB
-
memory/3916-144-0x00000000018E0000-0x0000000001C2A000-memory.dmpFilesize
3.3MB
-
memory/3916-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3916-147-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3916-143-0x0000000001880000-0x0000000001895000-memory.dmpFilesize
84KB
-
memory/4420-150-0x0000000000D60000-0x0000000000D8F000-memory.dmpFilesize
188KB
-
memory/4420-152-0x0000000000D60000-0x0000000000D8F000-memory.dmpFilesize
188KB
-
memory/4420-154-0x00000000018A0000-0x0000000001934000-memory.dmpFilesize
592KB
-
memory/4420-151-0x0000000001A00000-0x0000000001D4A000-memory.dmpFilesize
3.3MB
-
memory/4420-146-0x0000000000110000-0x000000000011E000-memory.dmpFilesize
56KB
-
memory/4420-149-0x0000000000110000-0x000000000011E000-memory.dmpFilesize
56KB