Analysis
-
max time kernel
177s -
max time network
181s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
18-05-2023 13:57
Static task
static1
Behavioral task
behavioral1
Sample
BANKDETAILS.exe
Resource
win7-20230220-en
General
-
Target
BANKDETAILS.exe
-
Size
670KB
-
MD5
62de26e79eac6c290961bb1afa81ba1a
-
SHA1
77530bc0c680378aa32fb2e0270872483b9180ab
-
SHA256
0368b2ffa6991460a59b03edcd2ef71c423a27d4902b2222248bc0935776614d
-
SHA512
10ee542999f7fead4c4fedbb6e7345713a5e926d477149178ecb98dbc9231664416e14210bc5c0ea0f9c42ab10c5bae2a82629e5f1d22c17d9109f7e17800e5a
-
SSDEEP
12288:LmghfidoyW343eZQjro5O6hfteIghB6sGnf9Yprmf:LmCid5g4ugwItGsGnf9Y5s
Malware Config
Extracted
formbook
4.1
m82
jamesdevereux.com
artificialturfminneapolis.com
hongmeiyan.com
lojaderoupasbr.com
yit.africa
austinrelocationexpert.com
saiva.page
exitsategy.com
chochonux.com
klosterbraeu-unterliezheim.com
byseymanur.com
sblwarwickshire.co.uk
brazimaid.com
ciogame.com
bronzesailing.com
dwkapl.xyz
022dyd.com
compassandpathwriting.com
alphabet1x.com
selfcleaninghairbrush.co.uk
power-bank.co.uk
kickskaart.com
baumanbilliardsnv.com
bestcp.net
doghospitalnearme.com
mixano.africa
helarybaber.online
illubio.com
ciutas.com
ldpr33.ru
killtheblacks.com
cassino-portugal.com
danhaii.com
gvtowingservice.com
let-travel.africa
dental-implants-67128.com
facetaxi.xyz
ctjh9u8e.vip
kyosaiohruri.com
executivepresencetrainer.com
greatharmony.africa
feelingsarereal.com
devopsuday.club
happiestminds-udemy.com
fittingstands.com
happyhousegarment.com
24daysofheaven.com
herhustlenation.com
xn--oy2b27nt6b.net
hothotcogixem.online
hausmeisterservice-berlin.net
hjddbb.com
stoutfamilychiro.com
bookishthoughtsbychristy.com
gibellinaheartquake.com
8cf1utrb6.xyz
patrick-daggitt.com
ebcbank.net
angel909reviews.com
arcteryxsouthafricaonline.com
cutematvhy.com
art2z.com
bulkforeverstamps.com
heatbling.com
despachocontablequinsa.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/996-64-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/996-71-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1180-73-0x0000000000090000-0x00000000000BF000-memory.dmp formbook behavioral1/memory/1180-75-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
BANKDETAILS.exeRegSvcs.execmstp.exedescription pid process target process PID 2004 set thread context of 996 2004 BANKDETAILS.exe RegSvcs.exe PID 996 set thread context of 1272 996 RegSvcs.exe Explorer.EXE PID 1180 set thread context of 1272 1180 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
BANKDETAILS.exeRegSvcs.execmstp.exepid process 2004 BANKDETAILS.exe 2004 BANKDETAILS.exe 996 RegSvcs.exe 996 RegSvcs.exe 1180 cmstp.exe 1180 cmstp.exe 1180 cmstp.exe 1180 cmstp.exe 1180 cmstp.exe 1180 cmstp.exe 1180 cmstp.exe 1180 cmstp.exe 1180 cmstp.exe 1180 cmstp.exe 1180 cmstp.exe 1180 cmstp.exe 1180 cmstp.exe 1180 cmstp.exe 1180 cmstp.exe 1180 cmstp.exe 1180 cmstp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.execmstp.exepid process 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 1180 cmstp.exe 1180 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
BANKDETAILS.exeRegSvcs.execmstp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 2004 BANKDETAILS.exe Token: SeDebugPrivilege 996 RegSvcs.exe Token: SeDebugPrivilege 1180 cmstp.exe Token: SeShutdownPrivilege 1272 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
BANKDETAILS.exeExplorer.EXEcmstp.exedescription pid process target process PID 2004 wrote to memory of 996 2004 BANKDETAILS.exe RegSvcs.exe PID 2004 wrote to memory of 996 2004 BANKDETAILS.exe RegSvcs.exe PID 2004 wrote to memory of 996 2004 BANKDETAILS.exe RegSvcs.exe PID 2004 wrote to memory of 996 2004 BANKDETAILS.exe RegSvcs.exe PID 2004 wrote to memory of 996 2004 BANKDETAILS.exe RegSvcs.exe PID 2004 wrote to memory of 996 2004 BANKDETAILS.exe RegSvcs.exe PID 2004 wrote to memory of 996 2004 BANKDETAILS.exe RegSvcs.exe PID 2004 wrote to memory of 996 2004 BANKDETAILS.exe RegSvcs.exe PID 2004 wrote to memory of 996 2004 BANKDETAILS.exe RegSvcs.exe PID 2004 wrote to memory of 996 2004 BANKDETAILS.exe RegSvcs.exe PID 1272 wrote to memory of 1180 1272 Explorer.EXE cmstp.exe PID 1272 wrote to memory of 1180 1272 Explorer.EXE cmstp.exe PID 1272 wrote to memory of 1180 1272 Explorer.EXE cmstp.exe PID 1272 wrote to memory of 1180 1272 Explorer.EXE cmstp.exe PID 1272 wrote to memory of 1180 1272 Explorer.EXE cmstp.exe PID 1272 wrote to memory of 1180 1272 Explorer.EXE cmstp.exe PID 1272 wrote to memory of 1180 1272 Explorer.EXE cmstp.exe PID 1180 wrote to memory of 1328 1180 cmstp.exe cmd.exe PID 1180 wrote to memory of 1328 1180 cmstp.exe cmd.exe PID 1180 wrote to memory of 1328 1180 cmstp.exe cmd.exe PID 1180 wrote to memory of 1328 1180 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BANKDETAILS.exe"C:\Users\Admin\AppData\Local\Temp\BANKDETAILS.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/996-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/996-71-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/996-68-0x0000000000190000-0x00000000001A5000-memory.dmpFilesize
84KB
-
memory/996-67-0x00000000008F0000-0x0000000000BF3000-memory.dmpFilesize
3.0MB
-
memory/996-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/996-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/996-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1180-74-0x0000000001FA0000-0x00000000022A3000-memory.dmpFilesize
3.0MB
-
memory/1180-77-0x00000000007A0000-0x0000000000834000-memory.dmpFilesize
592KB
-
memory/1180-75-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/1180-73-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/1180-72-0x0000000000860000-0x0000000000878000-memory.dmpFilesize
96KB
-
memory/1180-70-0x0000000000860000-0x0000000000878000-memory.dmpFilesize
96KB
-
memory/1272-69-0x0000000004F30000-0x000000000501D000-memory.dmpFilesize
948KB
-
memory/1272-78-0x0000000006B30000-0x0000000006BFC000-memory.dmpFilesize
816KB
-
memory/1272-79-0x0000000006B30000-0x0000000006BFC000-memory.dmpFilesize
816KB
-
memory/1272-82-0x0000000006B30000-0x0000000006BFC000-memory.dmpFilesize
816KB
-
memory/2004-55-0x0000000004D00000-0x0000000004D40000-memory.dmpFilesize
256KB
-
memory/2004-56-0x0000000000600000-0x000000000060E000-memory.dmpFilesize
56KB
-
memory/2004-57-0x0000000004D00000-0x0000000004D40000-memory.dmpFilesize
256KB
-
memory/2004-58-0x0000000000610000-0x000000000061A000-memory.dmpFilesize
40KB
-
memory/2004-54-0x0000000000950000-0x00000000009FC000-memory.dmpFilesize
688KB
-
memory/2004-59-0x0000000004C80000-0x0000000004CF0000-memory.dmpFilesize
448KB
-
memory/2004-60-0x0000000004260000-0x0000000004298000-memory.dmpFilesize
224KB