Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2023 13:25
Static task
static1
Behavioral task
behavioral1
Sample
Payment Utr Copy.exe
Resource
win7-20230220-en
General
-
Target
Payment Utr Copy.exe
-
Size
875KB
-
MD5
0a0a483d55322204ce0c960af3ed5cdc
-
SHA1
e0ee65052e3ff42cd3cfeb798dee85d25376b013
-
SHA256
a1a882d7abefdec8678649330339a2f080a777450da1be5110b88e81a8ea38cc
-
SHA512
45c28282743ac15e0e31208776c60860eebb0abc8a5d178505f84f141ca1a63aa2012d6cd50d09752e622b67195f1bfb2a0f10b6432d0950d2ac1651fddf7ca7
-
SSDEEP
12288:TNU42rcBqZfOtXyWqeufFdFu+5NUAVKlylMH9rhFrWC4l5Zm:TL2rGIqXofFdZ5FVp+KC4l5Zm
Malware Config
Extracted
formbook
4.1
gtt8
thesuccessbot.com
rittercivil.com
jt1.fun
d365extension.com
quqoxeq.top
visittworiverswi.com
bfprotienda.com
greenhabitsph.com
ladmere.com
clockboutiques.com
minwart.xyz
xinyuejiancai.online
eggsl.com
fetchingcandles.com
skywatiniya.com
hinkley.news
realityonlineenterprises.com
teamcroissant.com
esfera-pv.ch
herdadedosmontesbastos.com
buddhistprayers.app
talytic-one.com
capital-top.com
pawmultiverse.com
gdrop.biz
africanswers.online
amgconstruct1on.com
review.builders
findinstinct.online
leseditionsdupangolin.site
vector-sale.com
hutesmarke.shop
spacevisualmedia.com
jeweledcrown.shop
divinedivas.store
redirr.online
callifam.com
nickelinfo.com
ginghamstudio.com
launchthepodcast.com
arlisia.com
kerryshields.com
xn--o39aj5xqvflut.com
ramsgatecarwash.com
semrushfreetrails.com
rmpaclub.ru
wtpoexpo.one
amlar.xyz
downlis.top
phrasecheck.com
uk885.top
gdtrn.com
99522v.com
liftdetox2023.online
evo-omega.cloud
iccu3v.link
amd-soft1.site
containermurah.xyz
vineagency.uk
leeprintanddesign.com
bnjyjy.com
bookra-ck.com
ilyinsurance.com
texasmicroneedling.com
osmosstore.com
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/1800-140-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1800-144-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1800-152-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4864-154-0x0000000001070000-0x000000000109F000-memory.dmp formbook behavioral2/memory/4864-156-0x0000000001070000-0x000000000109F000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Payment Utr Copy.exePayment Utr Copy.exesvchost.exedescription pid process target process PID 3328 set thread context of 1800 3328 Payment Utr Copy.exe Payment Utr Copy.exe PID 1800 set thread context of 3140 1800 Payment Utr Copy.exe Explorer.EXE PID 1800 set thread context of 3140 1800 Payment Utr Copy.exe Explorer.EXE PID 4864 set thread context of 3140 4864 svchost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
Payment Utr Copy.exesvchost.exepid process 1800 Payment Utr Copy.exe 1800 Payment Utr Copy.exe 1800 Payment Utr Copy.exe 1800 Payment Utr Copy.exe 1800 Payment Utr Copy.exe 1800 Payment Utr Copy.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe 4864 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3140 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Payment Utr Copy.exesvchost.exepid process 1800 Payment Utr Copy.exe 1800 Payment Utr Copy.exe 1800 Payment Utr Copy.exe 1800 Payment Utr Copy.exe 4864 svchost.exe 4864 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Payment Utr Copy.exesvchost.exedescription pid process Token: SeDebugPrivilege 1800 Payment Utr Copy.exe Token: SeDebugPrivilege 4864 svchost.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Payment Utr Copy.exeExplorer.EXEsvchost.exedescription pid process target process PID 3328 wrote to memory of 1800 3328 Payment Utr Copy.exe Payment Utr Copy.exe PID 3328 wrote to memory of 1800 3328 Payment Utr Copy.exe Payment Utr Copy.exe PID 3328 wrote to memory of 1800 3328 Payment Utr Copy.exe Payment Utr Copy.exe PID 3328 wrote to memory of 1800 3328 Payment Utr Copy.exe Payment Utr Copy.exe PID 3328 wrote to memory of 1800 3328 Payment Utr Copy.exe Payment Utr Copy.exe PID 3328 wrote to memory of 1800 3328 Payment Utr Copy.exe Payment Utr Copy.exe PID 3140 wrote to memory of 4864 3140 Explorer.EXE svchost.exe PID 3140 wrote to memory of 4864 3140 Explorer.EXE svchost.exe PID 3140 wrote to memory of 4864 3140 Explorer.EXE svchost.exe PID 4864 wrote to memory of 3868 4864 svchost.exe cmd.exe PID 4864 wrote to memory of 3868 4864 svchost.exe cmd.exe PID 4864 wrote to memory of 3868 4864 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment Utr Copy.exe"C:\Users\Admin\AppData\Local\Temp\Payment Utr Copy.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment Utr Copy.exe"C:\Users\Admin\AppData\Local\Temp\Payment Utr Copy.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Payment Utr Copy.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1800-152-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1800-148-0x00000000011D0000-0x00000000011E5000-memory.dmpFilesize
84KB
-
memory/1800-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1800-143-0x0000000001290000-0x00000000015DA000-memory.dmpFilesize
3.3MB
-
memory/1800-145-0x0000000001160000-0x0000000001175000-memory.dmpFilesize
84KB
-
memory/1800-144-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3140-146-0x0000000008640000-0x0000000008739000-memory.dmpFilesize
996KB
-
memory/3140-162-0x0000000008BD0000-0x0000000008CA8000-memory.dmpFilesize
864KB
-
memory/3140-160-0x0000000008BD0000-0x0000000008CA8000-memory.dmpFilesize
864KB
-
memory/3140-159-0x0000000008BD0000-0x0000000008CA8000-memory.dmpFilesize
864KB
-
memory/3140-149-0x0000000008740000-0x00000000088CC000-memory.dmpFilesize
1.5MB
-
memory/3328-139-0x00000000093D0000-0x000000000946C000-memory.dmpFilesize
624KB
-
memory/3328-133-0x0000000000E40000-0x0000000000F22000-memory.dmpFilesize
904KB
-
memory/3328-138-0x0000000005930000-0x0000000005940000-memory.dmpFilesize
64KB
-
memory/3328-137-0x00000000058E0000-0x00000000058EA000-memory.dmpFilesize
40KB
-
memory/3328-136-0x0000000005930000-0x0000000005940000-memory.dmpFilesize
64KB
-
memory/3328-135-0x0000000005940000-0x00000000059D2000-memory.dmpFilesize
584KB
-
memory/3328-134-0x0000000005EF0000-0x0000000006494000-memory.dmpFilesize
5.6MB
-
memory/4864-150-0x0000000000A80000-0x0000000000A8E000-memory.dmpFilesize
56KB
-
memory/4864-153-0x0000000000A80000-0x0000000000A8E000-memory.dmpFilesize
56KB
-
memory/4864-154-0x0000000001070000-0x000000000109F000-memory.dmpFilesize
188KB
-
memory/4864-155-0x0000000001B00000-0x0000000001E4A000-memory.dmpFilesize
3.3MB
-
memory/4864-156-0x0000000001070000-0x000000000109F000-memory.dmpFilesize
188KB
-
memory/4864-158-0x0000000001A00000-0x0000000001A94000-memory.dmpFilesize
592KB