Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
13-05-2023 22:47
Static task
static1
Behavioral task
behavioral1
Sample
atlasmysj4799.exe
Resource
win7-20230220-en
General
-
Target
atlasmysj4799.exe
-
Size
662KB
-
MD5
94cf44254f5691f058a2f6df5e8ec4c8
-
SHA1
f9a6e73b208e56007b04c7086d047874e4508713
-
SHA256
540c181beb778359eea5bd699310b2cebd8017d5286d408b1abf12e1228b7b9d
-
SHA512
0e48608940c00770117d069cc71570d778ce73b7c113e97974cc66fd3e3889852e70912d9298c4c30a4bd288e859b0c0322717b2eb9af315b1af1a210971a29a
-
SSDEEP
12288:X2iN65lBHxqd5h26MZqIv7c6+E+dTEm8+CNesDZs:X1E5lBRqd5kLp7lf+9Eqs9Zs
Malware Config
Extracted
formbook
4.1
gtt8
thesuccessbot.com
rittercivil.com
jt1.fun
d365extension.com
quqoxeq.top
visittworiverswi.com
bfprotienda.com
greenhabitsph.com
ladmere.com
clockboutiques.com
minwart.xyz
xinyuejiancai.online
eggsl.com
fetchingcandles.com
skywatiniya.com
hinkley.news
realityonlineenterprises.com
teamcroissant.com
esfera-pv.ch
herdadedosmontesbastos.com
buddhistprayers.app
talytic-one.com
capital-top.com
pawmultiverse.com
gdrop.biz
africanswers.online
amgconstruct1on.com
review.builders
findinstinct.online
leseditionsdupangolin.site
vector-sale.com
hutesmarke.shop
spacevisualmedia.com
jeweledcrown.shop
divinedivas.store
redirr.online
callifam.com
nickelinfo.com
ginghamstudio.com
launchthepodcast.com
arlisia.com
kerryshields.com
xn--o39aj5xqvflut.com
ramsgatecarwash.com
semrushfreetrails.com
rmpaclub.ru
wtpoexpo.one
amlar.xyz
downlis.top
phrasecheck.com
uk885.top
gdtrn.com
99522v.com
liftdetox2023.online
evo-omega.cloud
iccu3v.link
amd-soft1.site
containermurah.xyz
vineagency.uk
leeprintanddesign.com
bnjyjy.com
bookra-ck.com
ilyinsurance.com
texasmicroneedling.com
osmosstore.com
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/268-64-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/268-69-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/268-73-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1668-76-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/1668-78-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1744 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
atlasmysj4799.exeatlasmysj4799.execmd.exedescription pid process target process PID 2036 set thread context of 268 2036 atlasmysj4799.exe atlasmysj4799.exe PID 268 set thread context of 1352 268 atlasmysj4799.exe Explorer.EXE PID 268 set thread context of 1352 268 atlasmysj4799.exe Explorer.EXE PID 1668 set thread context of 1352 1668 cmd.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
atlasmysj4799.execmd.exepid process 268 atlasmysj4799.exe 268 atlasmysj4799.exe 268 atlasmysj4799.exe 1668 cmd.exe 1668 cmd.exe 1668 cmd.exe 1668 cmd.exe 1668 cmd.exe 1668 cmd.exe 1668 cmd.exe 1668 cmd.exe 1668 cmd.exe 1668 cmd.exe 1668 cmd.exe 1668 cmd.exe 1668 cmd.exe 1668 cmd.exe 1668 cmd.exe 1668 cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1352 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
atlasmysj4799.execmd.exepid process 268 atlasmysj4799.exe 268 atlasmysj4799.exe 268 atlasmysj4799.exe 268 atlasmysj4799.exe 1668 cmd.exe 1668 cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
atlasmysj4799.execmd.exedescription pid process Token: SeDebugPrivilege 268 atlasmysj4799.exe Token: SeDebugPrivilege 1668 cmd.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1352 Explorer.EXE 1352 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1352 Explorer.EXE 1352 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
atlasmysj4799.exeatlasmysj4799.execmd.exedescription pid process target process PID 2036 wrote to memory of 268 2036 atlasmysj4799.exe atlasmysj4799.exe PID 2036 wrote to memory of 268 2036 atlasmysj4799.exe atlasmysj4799.exe PID 2036 wrote to memory of 268 2036 atlasmysj4799.exe atlasmysj4799.exe PID 2036 wrote to memory of 268 2036 atlasmysj4799.exe atlasmysj4799.exe PID 2036 wrote to memory of 268 2036 atlasmysj4799.exe atlasmysj4799.exe PID 2036 wrote to memory of 268 2036 atlasmysj4799.exe atlasmysj4799.exe PID 2036 wrote to memory of 268 2036 atlasmysj4799.exe atlasmysj4799.exe PID 268 wrote to memory of 1668 268 atlasmysj4799.exe cmd.exe PID 268 wrote to memory of 1668 268 atlasmysj4799.exe cmd.exe PID 268 wrote to memory of 1668 268 atlasmysj4799.exe cmd.exe PID 268 wrote to memory of 1668 268 atlasmysj4799.exe cmd.exe PID 1668 wrote to memory of 1744 1668 cmd.exe cmd.exe PID 1668 wrote to memory of 1744 1668 cmd.exe cmd.exe PID 1668 wrote to memory of 1744 1668 cmd.exe cmd.exe PID 1668 wrote to memory of 1744 1668 cmd.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\atlasmysj4799.exe"C:\Users\Admin\AppData\Local\Temp\atlasmysj4799.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\atlasmysj4799.exe"C:\Users\Admin\AppData\Local\Temp\atlasmysj4799.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\atlasmysj4799.exe"5⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/268-69-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/268-73-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/268-67-0x0000000000190000-0x00000000001A5000-memory.dmpFilesize
84KB
-
memory/268-71-0x0000000000600000-0x0000000000615000-memory.dmpFilesize
84KB
-
memory/268-66-0x0000000000770000-0x0000000000A73000-memory.dmpFilesize
3.0MB
-
memory/268-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/268-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/268-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/268-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1352-68-0x0000000006980000-0x0000000006ABD000-memory.dmpFilesize
1.2MB
-
memory/1352-82-0x0000000007090000-0x0000000007151000-memory.dmpFilesize
772KB
-
memory/1352-72-0x0000000006FC0000-0x0000000007082000-memory.dmpFilesize
776KB
-
memory/1352-84-0x0000000007090000-0x0000000007151000-memory.dmpFilesize
772KB
-
memory/1352-80-0x0000000007090000-0x0000000007151000-memory.dmpFilesize
772KB
-
memory/1352-70-0x0000000003920000-0x0000000003A20000-memory.dmpFilesize
1024KB
-
memory/1668-76-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1668-74-0x0000000049D90000-0x0000000049DDC000-memory.dmpFilesize
304KB
-
memory/1668-75-0x0000000049D90000-0x0000000049DDC000-memory.dmpFilesize
304KB
-
memory/1668-77-0x0000000002190000-0x0000000002493000-memory.dmpFilesize
3.0MB
-
memory/1668-78-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1668-79-0x0000000001FE0000-0x0000000002074000-memory.dmpFilesize
592KB
-
memory/2036-54-0x0000000000FD0000-0x000000000107C000-memory.dmpFilesize
688KB
-
memory/2036-56-0x00000000050E0000-0x0000000005120000-memory.dmpFilesize
256KB
-
memory/2036-55-0x00000000004B0000-0x00000000004C4000-memory.dmpFilesize
80KB
-
memory/2036-60-0x0000000000C10000-0x0000000000C48000-memory.dmpFilesize
224KB
-
memory/2036-58-0x00000000004E0000-0x00000000004EC000-memory.dmpFilesize
48KB
-
memory/2036-59-0x0000000004BB0000-0x0000000004C20000-memory.dmpFilesize
448KB
-
memory/2036-57-0x00000000050E0000-0x0000000005120000-memory.dmpFilesize
256KB