Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2023 01:58
Static task
static1
Behavioral task
behavioral1
Sample
Inward Remittance 0023412.exe
Resource
win7-20230220-en
General
-
Target
Inward Remittance 0023412.exe
-
Size
622KB
-
MD5
adf9f1eb207088d94953bba4f1b973b7
-
SHA1
cd4bfc0b22618beb13ac9bf9d7c16d6039ff89fb
-
SHA256
13714cb6b152e5d8ef04df8c5cf8f59cc8a1414de5be33b52d784e928a67ab0f
-
SHA512
f7bf0732c656e0ae8df3d33224acd1abdc3578a41b04d52a86fc2492cf5f97e0eedd348624438aa65858b823fb69515329e006082b32ef97b685ff9f8e9fd71d
-
SSDEEP
12288:CBjvvebB+KAbrqwnnngkaG/mBUx5ltEe:Kv+IbrqwngkasmBe5lt
Malware Config
Extracted
formbook
4.1
gtt8
thesuccessbot.com
rittercivil.com
jt1.fun
d365extension.com
quqoxeq.top
visittworiverswi.com
bfprotienda.com
greenhabitsph.com
ladmere.com
clockboutiques.com
minwart.xyz
xinyuejiancai.online
eggsl.com
fetchingcandles.com
skywatiniya.com
hinkley.news
realityonlineenterprises.com
teamcroissant.com
esfera-pv.ch
herdadedosmontesbastos.com
buddhistprayers.app
talytic-one.com
capital-top.com
pawmultiverse.com
gdrop.biz
africanswers.online
amgconstruct1on.com
review.builders
findinstinct.online
leseditionsdupangolin.site
vector-sale.com
hutesmarke.shop
spacevisualmedia.com
jeweledcrown.shop
divinedivas.store
redirr.online
callifam.com
nickelinfo.com
ginghamstudio.com
launchthepodcast.com
arlisia.com
kerryshields.com
xn--o39aj5xqvflut.com
ramsgatecarwash.com
semrushfreetrails.com
rmpaclub.ru
wtpoexpo.one
amlar.xyz
downlis.top
phrasecheck.com
uk885.top
gdtrn.com
99522v.com
liftdetox2023.online
evo-omega.cloud
iccu3v.link
amd-soft1.site
containermurah.xyz
vineagency.uk
leeprintanddesign.com
bnjyjy.com
bookra-ck.com
ilyinsurance.com
texasmicroneedling.com
osmosstore.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3528-140-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3528-144-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2572-150-0x0000000000B50000-0x0000000000B7F000-memory.dmp formbook behavioral2/memory/2572-152-0x0000000000B50000-0x0000000000B7F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Inward Remittance 0023412.exeInward Remittance 0023412.exenetsh.exedescription pid process target process PID 1256 set thread context of 3528 1256 Inward Remittance 0023412.exe Inward Remittance 0023412.exe PID 3528 set thread context of 1292 3528 Inward Remittance 0023412.exe Explorer.EXE PID 2572 set thread context of 1292 2572 netsh.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
Inward Remittance 0023412.exenetsh.exepid process 3528 Inward Remittance 0023412.exe 3528 Inward Remittance 0023412.exe 3528 Inward Remittance 0023412.exe 3528 Inward Remittance 0023412.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe 2572 netsh.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1292 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Inward Remittance 0023412.exenetsh.exepid process 3528 Inward Remittance 0023412.exe 3528 Inward Remittance 0023412.exe 3528 Inward Remittance 0023412.exe 2572 netsh.exe 2572 netsh.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
Inward Remittance 0023412.exenetsh.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3528 Inward Remittance 0023412.exe Token: SeDebugPrivilege 2572 netsh.exe Token: SeShutdownPrivilege 1292 Explorer.EXE Token: SeCreatePagefilePrivilege 1292 Explorer.EXE Token: SeShutdownPrivilege 1292 Explorer.EXE Token: SeCreatePagefilePrivilege 1292 Explorer.EXE Token: SeShutdownPrivilege 1292 Explorer.EXE Token: SeCreatePagefilePrivilege 1292 Explorer.EXE Token: SeShutdownPrivilege 1292 Explorer.EXE Token: SeCreatePagefilePrivilege 1292 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Inward Remittance 0023412.exeExplorer.EXEnetsh.exedescription pid process target process PID 1256 wrote to memory of 3528 1256 Inward Remittance 0023412.exe Inward Remittance 0023412.exe PID 1256 wrote to memory of 3528 1256 Inward Remittance 0023412.exe Inward Remittance 0023412.exe PID 1256 wrote to memory of 3528 1256 Inward Remittance 0023412.exe Inward Remittance 0023412.exe PID 1256 wrote to memory of 3528 1256 Inward Remittance 0023412.exe Inward Remittance 0023412.exe PID 1256 wrote to memory of 3528 1256 Inward Remittance 0023412.exe Inward Remittance 0023412.exe PID 1256 wrote to memory of 3528 1256 Inward Remittance 0023412.exe Inward Remittance 0023412.exe PID 1292 wrote to memory of 2572 1292 Explorer.EXE netsh.exe PID 1292 wrote to memory of 2572 1292 Explorer.EXE netsh.exe PID 1292 wrote to memory of 2572 1292 Explorer.EXE netsh.exe PID 2572 wrote to memory of 636 2572 netsh.exe cmd.exe PID 2572 wrote to memory of 636 2572 netsh.exe cmd.exe PID 2572 wrote to memory of 636 2572 netsh.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inward Remittance 0023412.exe"C:\Users\Admin\AppData\Local\Temp\Inward Remittance 0023412.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inward Remittance 0023412.exe"C:\Users\Admin\AppData\Local\Temp\Inward Remittance 0023412.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Inward Remittance 0023412.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1256-133-0x0000000000100000-0x00000000001A2000-memory.dmpFilesize
648KB
-
memory/1256-134-0x0000000005040000-0x00000000055E4000-memory.dmpFilesize
5.6MB
-
memory/1256-135-0x0000000004B50000-0x0000000004BE2000-memory.dmpFilesize
584KB
-
memory/1256-136-0x0000000004C00000-0x0000000004C0A000-memory.dmpFilesize
40KB
-
memory/1256-137-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/1256-138-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/1256-139-0x0000000007B10000-0x0000000007BAC000-memory.dmpFilesize
624KB
-
memory/1292-184-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-169-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-199-0x0000000002790000-0x0000000002792000-memory.dmpFilesize
8KB
-
memory/1292-197-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-146-0x0000000008710000-0x000000000882F000-memory.dmpFilesize
1.1MB
-
memory/1292-196-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-195-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-194-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-193-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-192-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-191-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-155-0x0000000002D60000-0x0000000002E3B000-memory.dmpFilesize
876KB
-
memory/1292-156-0x0000000002D60000-0x0000000002E3B000-memory.dmpFilesize
876KB
-
memory/1292-159-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-160-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-161-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-162-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-163-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-164-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-165-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-166-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-167-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-168-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-190-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-170-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-171-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-172-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-173-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-174-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-175-0x0000000002E40000-0x0000000002E42000-memory.dmpFilesize
8KB
-
memory/1292-182-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-183-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-189-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-185-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-186-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-187-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/1292-188-0x0000000002A00000-0x0000000002A10000-memory.dmpFilesize
64KB
-
memory/2572-154-0x0000000001300000-0x0000000001394000-memory.dmpFilesize
592KB
-
memory/2572-152-0x0000000000B50000-0x0000000000B7F000-memory.dmpFilesize
188KB
-
memory/2572-151-0x0000000001460000-0x00000000017AA000-memory.dmpFilesize
3.3MB
-
memory/2572-150-0x0000000000B50000-0x0000000000B7F000-memory.dmpFilesize
188KB
-
memory/2572-149-0x0000000000A30000-0x0000000000A4E000-memory.dmpFilesize
120KB
-
memory/2572-147-0x0000000000A30000-0x0000000000A4E000-memory.dmpFilesize
120KB
-
memory/3528-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3528-143-0x00000000011E0000-0x000000000152A000-memory.dmpFilesize
3.3MB
-
memory/3528-144-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3528-145-0x0000000001660000-0x0000000001675000-memory.dmpFilesize
84KB