Analysis
-
max time kernel
156s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2022 12:05
Static task
static1
Behavioral task
behavioral1
Sample
bd811d9e445bb6882d2864faaf80f668.exe
Resource
win7-20220901-en
General
-
Target
bd811d9e445bb6882d2864faaf80f668.exe
-
Size
897KB
-
MD5
bd811d9e445bb6882d2864faaf80f668
-
SHA1
1ee49be423203c7034a6189b0364abfab6e02036
-
SHA256
268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63
-
SHA512
7f1421afb65de1d60dfe5515a497b9d3c1b4c94f827d85604fa8106c0b69162f4a95463d4dd9c34b1eeb69a55ecdedce175bc938985d5a4b141e6a5b89c202df
-
SSDEEP
12288:x7oQgKZ/nXt7virmWhlGLaQYI1N6kowFheAjRjWf2yS/nhkehKuk5p/kAJF4JzrM:xLvFhecWf2bky0/P45rAQfWeQkNs
Malware Config
Extracted
formbook
w086
F6jSz+l9QmYXguG/xUipf/6ixrik
cQZre8twfBVOOJgLenGTGA==
pG5kW2/wqwEOCVxZ
KORXeYwt7wF8J3BR
HL0ZdBMjeHet
TR57b4Yi6wJ8J3BR
fRyK2yaqeDRGHiQTTw==
RwhsqfRxABNZS59wenGTGA==
GuZaY4H4ahcWKjUdVg==
I5C4/Wyz3fglj+o=
Te5QPEu3NjZ0P58LenGTGA==
M9YJLwifZIi9pfnj2Nj/kA6+ZlU=
c/JFdRndG8f/HiQTTw==
nMmcD1UjeHet
QWR7+9Rh8/l8J3BR
9MD+BzOyI6mXtM4w6LMyEA==
WABgaYPqdJzl2TviGbdH
02OexRebqj3+U2kXhQ0=
j17M2R3/fQwFHiQTTw==
dQpReYss5/l8J3BR
tiaHq71bHDzrXWkXhQ0=
pks7Z4EmPunm2e0ZDK5F
EKYCS50qID/AL4HlVNUIg0XJdFQ=
iCibxeJa5ARNSauNiDOMmBT/
yZHHww7dJM8EHiQTTw==
HbLe2y3prvglj+o=
dVJttQWbovglj+o=
PNU9jC3aosZHn/dewVKhOvPC8tWu
flK4vRfTDsWS7U/JQQoNoDI=
SG097d7jZ8zPlv0=
jildmuNaT3ndPI4LenGTGA==
M8cbIW9BjgwJHiQTTw==
nz6k8Ydf0cxaq/c=
tnrjNokIeQz39UHiGbdH
GJD0UP/vY3uw
yE6h6o1UGTvtXWkXhQ0=
LtxFZHfxbgn95SwTWAE2Sml55w==
rJ2BASXOQZ/Hnw==
7IXl+gV8iRTfWq7mqBU=
fRpdr0gmrlN8J3BR
Pe1BOFsjeHet
VhhdBl9AL2ez
agpovx6sPPHsyhwQDvlqRWRq4A==
2HDY8QKAKT24N46HenGTGA==
KdZAoDfxvDAtDWtZ
6sJYfcmQ43FZM4Z1q3PJcaiOi0CeDw==
khBpyO0KjDxJHiQTTw==
GPZiV8d80sX++1k7R9cn58qr6A==
+sdAldR8R5jdtM4w6LMyEA==
kjRknj/6LMB070Q9NlSVDw==
7oz0SZRADjdrUaqax7S2ozCm8k+qEg==
u4LngJ/1QZ/Hnw==
rSJUnvl4giPmirwliAM7vzo=
0kSk9EsjeHet
zl6gy9h22Hx+b9TVwlbTnM6YviaYRp/FYg==
/qn8dVEjeHet
BpH1R+W9RkuBYriychlArMmp6g==
HOdOcL1wtVIbfN5E8woNoDI=
41rBwtJN2Nt4/V3DNgoNoDI=
5HGl16E9+wV8J3BR
IMUfc0PAT1eIa8e1ojuMmBT/
JM4jYwHVU/0C3y8ZDvlqRWRq4A==
1WfCyxTOQZ/Hnw==
gRRmp/tz4nFcN4BwenGTGA==
re-curve.tech
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
bd811d9e445bb6882d2864faaf80f668.exedescription pid process target process PID 2176 set thread context of 1308 2176 bd811d9e445bb6882d2864faaf80f668.exe bd811d9e445bb6882d2864faaf80f668.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
bd811d9e445bb6882d2864faaf80f668.exebd811d9e445bb6882d2864faaf80f668.exepid process 2176 bd811d9e445bb6882d2864faaf80f668.exe 2176 bd811d9e445bb6882d2864faaf80f668.exe 2176 bd811d9e445bb6882d2864faaf80f668.exe 2176 bd811d9e445bb6882d2864faaf80f668.exe 1308 bd811d9e445bb6882d2864faaf80f668.exe 1308 bd811d9e445bb6882d2864faaf80f668.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
bd811d9e445bb6882d2864faaf80f668.exedescription pid process Token: SeDebugPrivilege 2176 bd811d9e445bb6882d2864faaf80f668.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
bd811d9e445bb6882d2864faaf80f668.exedescription pid process target process PID 2176 wrote to memory of 392 2176 bd811d9e445bb6882d2864faaf80f668.exe bd811d9e445bb6882d2864faaf80f668.exe PID 2176 wrote to memory of 392 2176 bd811d9e445bb6882d2864faaf80f668.exe bd811d9e445bb6882d2864faaf80f668.exe PID 2176 wrote to memory of 392 2176 bd811d9e445bb6882d2864faaf80f668.exe bd811d9e445bb6882d2864faaf80f668.exe PID 2176 wrote to memory of 1948 2176 bd811d9e445bb6882d2864faaf80f668.exe bd811d9e445bb6882d2864faaf80f668.exe PID 2176 wrote to memory of 1948 2176 bd811d9e445bb6882d2864faaf80f668.exe bd811d9e445bb6882d2864faaf80f668.exe PID 2176 wrote to memory of 1948 2176 bd811d9e445bb6882d2864faaf80f668.exe bd811d9e445bb6882d2864faaf80f668.exe PID 2176 wrote to memory of 1308 2176 bd811d9e445bb6882d2864faaf80f668.exe bd811d9e445bb6882d2864faaf80f668.exe PID 2176 wrote to memory of 1308 2176 bd811d9e445bb6882d2864faaf80f668.exe bd811d9e445bb6882d2864faaf80f668.exe PID 2176 wrote to memory of 1308 2176 bd811d9e445bb6882d2864faaf80f668.exe bd811d9e445bb6882d2864faaf80f668.exe PID 2176 wrote to memory of 1308 2176 bd811d9e445bb6882d2864faaf80f668.exe bd811d9e445bb6882d2864faaf80f668.exe PID 2176 wrote to memory of 1308 2176 bd811d9e445bb6882d2864faaf80f668.exe bd811d9e445bb6882d2864faaf80f668.exe PID 2176 wrote to memory of 1308 2176 bd811d9e445bb6882d2864faaf80f668.exe bd811d9e445bb6882d2864faaf80f668.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd811d9e445bb6882d2864faaf80f668.exe"C:\Users\Admin\AppData\Local\Temp\bd811d9e445bb6882d2864faaf80f668.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bd811d9e445bb6882d2864faaf80f668.exe"C:\Users\Admin\AppData\Local\Temp\bd811d9e445bb6882d2864faaf80f668.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\bd811d9e445bb6882d2864faaf80f668.exe"C:\Users\Admin\AppData\Local\Temp\bd811d9e445bb6882d2864faaf80f668.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\bd811d9e445bb6882d2864faaf80f668.exe"C:\Users\Admin\AppData\Local\Temp\bd811d9e445bb6882d2864faaf80f668.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/392-137-0x0000000000000000-mapping.dmp
-
memory/1308-139-0x0000000000000000-mapping.dmp
-
memory/1308-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1308-142-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1308-143-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1308-144-0x0000000001810000-0x0000000001B5A000-memory.dmpFilesize
3.3MB
-
memory/1948-138-0x0000000000000000-mapping.dmp
-
memory/2176-132-0x0000000000870000-0x0000000000956000-memory.dmpFilesize
920KB
-
memory/2176-133-0x0000000005A20000-0x0000000005FC4000-memory.dmpFilesize
5.6MB
-
memory/2176-134-0x0000000005310000-0x00000000053A2000-memory.dmpFilesize
584KB
-
memory/2176-135-0x00000000052F0000-0x00000000052FA000-memory.dmpFilesize
40KB
-
memory/2176-136-0x0000000005470000-0x000000000550C000-memory.dmpFilesize
624KB