Analysis
-
max time kernel
99s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2023 19:47
Static task
static1
Behavioral task
behavioral1
Sample
e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe
Resource
win7-20230220-en
General
-
Target
e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe
-
Size
744KB
-
MD5
d24b6d72e85c9b51bd5b39b9fe6d1ab5
-
SHA1
b2c1c8c1988924942a231cf30dfc5222b031090e
-
SHA256
e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5
-
SHA512
d37ff374ab0f381051e8e1c27d4b181a57e62fa3f8775616739421261b7032f94ec229b84c0f0a686bbbce95f69e7a2b2a0269239773c7dc76ff0f01ce8c9b6e
-
SSDEEP
12288:iQu6zWFuIRiPLFuJVygB1VrQ6GSItioHVnwlb1:iSIuIwZwAgrVr6NHFwlb
Malware Config
Extracted
formbook
4.1
n13e
cowiemarketing.com
uniqueliquidz.co.uk
755259.com
7bw95.com
luxbarstools.co.uk
baccaratda.com
berkayakpinar.xyz
gistus.africa
hjd387.com
leave-fly.com
golfclubdaddy.com
engineeringea.buzz
countryrevisited.com
decoracioneskalite.com
imaginationlirbary.com
moneytransfer.africa
brainwaveproject.com
3039sjbqf2022.com
184hotels.com
aromamiaro.com
bigching.com
armkette.com
energytechnicalsystems.com
bodw2022.com
keptpasha.online
fossillandstone.com
guioueui.link
cleanupbycmw.com
inyeculinary.com
papercrochet.net
jaderoadfarm.com
bril-leadinginvention.com
dtgwarehouse.com
successrn.net
660web.com
lovedhug.com
juicecomedy.co.uk
enigmaxk.com
romunro.net
cassiekayreads.com
ibuycomputers.com
blossomblushbelltents.co.uk
hjce06.com
applyingdreams.com
h2ghb3.site
glown.africa
533671.com
charlottechoicelimos.com
bossinfra.com
anrovlp.xyz
1wqzsb.top
ertfsdf.xyz
exotico-store.com
betterportions.com
corfix.app
888sq.club
takeselfies.net
getyourtitleback.com
clickadega.com
midwestflowsproductions.net
duraveritaswines.com
dublintwist.com
apollobenfitservices.com
kp-aodeli.com
davidmchughroofing.co.uk
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4576-143-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exedescription pid process target process PID 4088 set thread context of 4576 4088 e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exepid process 4576 e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe 4576 e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exedescription pid process target process PID 4088 wrote to memory of 4504 4088 e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe schtasks.exe PID 4088 wrote to memory of 4504 4088 e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe schtasks.exe PID 4088 wrote to memory of 4504 4088 e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe schtasks.exe PID 4088 wrote to memory of 4576 4088 e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe PID 4088 wrote to memory of 4576 4088 e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe PID 4088 wrote to memory of 4576 4088 e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe PID 4088 wrote to memory of 4576 4088 e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe PID 4088 wrote to memory of 4576 4088 e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe PID 4088 wrote to memory of 4576 4088 e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe"C:\Users\Admin\AppData\Local\Temp\e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\urCbmGUnZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8230.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp8230.tmpFilesize
1KB
MD58f3b0b0d27c463832b8fa1f907037e12
SHA1334222ee8e2452badca3cc7947b02099afed45bb
SHA256620399eb5f97d5e8aefe50014de114054067022b41c90d936e5945a105ba7ee0
SHA5120f801f8492ce4fbd3cb8c3cc7325d8a3d868207571e591273ca3ef38075b4a70fce4d97697a4bf3f3cf39b617e0e2b3b21132bc10b53ab72dd63b3b8a0c91db6
-
memory/4088-133-0x00000000003D0000-0x0000000000490000-memory.dmpFilesize
768KB
-
memory/4088-134-0x0000000005200000-0x00000000057A4000-memory.dmpFilesize
5.6MB
-
memory/4088-135-0x0000000004D30000-0x0000000004DC2000-memory.dmpFilesize
584KB
-
memory/4088-136-0x0000000004DD0000-0x0000000004E6C000-memory.dmpFilesize
624KB
-
memory/4088-137-0x0000000004FB0000-0x0000000004FC0000-memory.dmpFilesize
64KB
-
memory/4088-138-0x0000000004D10000-0x0000000004D1A000-memory.dmpFilesize
40KB
-
memory/4088-139-0x0000000004FB0000-0x0000000004FC0000-memory.dmpFilesize
64KB
-
memory/4576-143-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4576-145-0x0000000000ED0000-0x000000000121A000-memory.dmpFilesize
3.3MB