Analysis
-
max time kernel
49s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
30-04-2023 23:22
Static task
static1
Behavioral task
behavioral1
Sample
2c25ab75ea6c7f3cdbb1f7c8844b4c91.exe
Resource
win7-20230220-en
General
-
Target
2c25ab75ea6c7f3cdbb1f7c8844b4c91.exe
-
Size
655KB
-
MD5
2c25ab75ea6c7f3cdbb1f7c8844b4c91
-
SHA1
7ee948ea458aff3cb6822a92020e1af0aa217ae8
-
SHA256
33b5ccf1b3b48e22ab607320e0bb143ad0ac2a9770b0e385c0365366de472ceb
-
SHA512
ee520741f8562bd595a8f468c32e38de2dbea168c0cf7b72eeb547e1ae6b2ed7d5da4653e86418190327672a4d75f2eae1e0fe15161ed3a7b9d90883029fa549
-
SSDEEP
12288:G2nqwaPv8rXaB1EqXg0BvATTY8f7dZBsmT768vr7QR++CFsRj6egQVt:G2Tiv8rX5qXgx7djb/4InFsR
Malware Config
Extracted
formbook
4.1
gtt8
thesuccessbot.com
rittercivil.com
jt1.fun
d365extension.com
quqoxeq.top
visittworiverswi.com
bfprotienda.com
greenhabitsph.com
ladmere.com
clockboutiques.com
minwart.xyz
xinyuejiancai.online
eggsl.com
fetchingcandles.com
skywatiniya.com
hinkley.news
realityonlineenterprises.com
teamcroissant.com
esfera-pv.ch
herdadedosmontesbastos.com
buddhistprayers.app
talytic-one.com
capital-top.com
pawmultiverse.com
gdrop.biz
africanswers.online
amgconstruct1on.com
review.builders
findinstinct.online
leseditionsdupangolin.site
vector-sale.com
hutesmarke.shop
spacevisualmedia.com
jeweledcrown.shop
divinedivas.store
redirr.online
callifam.com
nickelinfo.com
ginghamstudio.com
launchthepodcast.com
arlisia.com
kerryshields.com
xn--o39aj5xqvflut.com
ramsgatecarwash.com
semrushfreetrails.com
rmpaclub.ru
wtpoexpo.one
amlar.xyz
downlis.top
phrasecheck.com
uk885.top
gdtrn.com
99522v.com
liftdetox2023.online
evo-omega.cloud
iccu3v.link
amd-soft1.site
containermurah.xyz
vineagency.uk
leeprintanddesign.com
bnjyjy.com
bookra-ck.com
ilyinsurance.com
texasmicroneedling.com
osmosstore.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/808-64-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2c25ab75ea6c7f3cdbb1f7c8844b4c91.exedescription pid process target process PID 1216 set thread context of 808 1216 2c25ab75ea6c7f3cdbb1f7c8844b4c91.exe 2c25ab75ea6c7f3cdbb1f7c8844b4c91.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2c25ab75ea6c7f3cdbb1f7c8844b4c91.exepid process 808 2c25ab75ea6c7f3cdbb1f7c8844b4c91.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
2c25ab75ea6c7f3cdbb1f7c8844b4c91.exedescription pid process target process PID 1216 wrote to memory of 808 1216 2c25ab75ea6c7f3cdbb1f7c8844b4c91.exe 2c25ab75ea6c7f3cdbb1f7c8844b4c91.exe PID 1216 wrote to memory of 808 1216 2c25ab75ea6c7f3cdbb1f7c8844b4c91.exe 2c25ab75ea6c7f3cdbb1f7c8844b4c91.exe PID 1216 wrote to memory of 808 1216 2c25ab75ea6c7f3cdbb1f7c8844b4c91.exe 2c25ab75ea6c7f3cdbb1f7c8844b4c91.exe PID 1216 wrote to memory of 808 1216 2c25ab75ea6c7f3cdbb1f7c8844b4c91.exe 2c25ab75ea6c7f3cdbb1f7c8844b4c91.exe PID 1216 wrote to memory of 808 1216 2c25ab75ea6c7f3cdbb1f7c8844b4c91.exe 2c25ab75ea6c7f3cdbb1f7c8844b4c91.exe PID 1216 wrote to memory of 808 1216 2c25ab75ea6c7f3cdbb1f7c8844b4c91.exe 2c25ab75ea6c7f3cdbb1f7c8844b4c91.exe PID 1216 wrote to memory of 808 1216 2c25ab75ea6c7f3cdbb1f7c8844b4c91.exe 2c25ab75ea6c7f3cdbb1f7c8844b4c91.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c25ab75ea6c7f3cdbb1f7c8844b4c91.exe"C:\Users\Admin\AppData\Local\Temp\2c25ab75ea6c7f3cdbb1f7c8844b4c91.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2c25ab75ea6c7f3cdbb1f7c8844b4c91.exe"C:\Users\Admin\AppData\Local\Temp\2c25ab75ea6c7f3cdbb1f7c8844b4c91.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/808-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/808-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/808-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/808-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/808-65-0x0000000000BA0000-0x0000000000EA3000-memory.dmpFilesize
3.0MB
-
memory/1216-54-0x0000000000820000-0x00000000008CA000-memory.dmpFilesize
680KB
-
memory/1216-55-0x0000000004E90000-0x0000000004ED0000-memory.dmpFilesize
256KB
-
memory/1216-56-0x0000000000610000-0x0000000000626000-memory.dmpFilesize
88KB
-
memory/1216-57-0x0000000004E90000-0x0000000004ED0000-memory.dmpFilesize
256KB
-
memory/1216-58-0x0000000000700000-0x000000000070C000-memory.dmpFilesize
48KB
-
memory/1216-59-0x0000000005F80000-0x0000000005FF0000-memory.dmpFilesize
448KB
-
memory/1216-60-0x0000000002180000-0x00000000021B8000-memory.dmpFilesize
224KB