Analysis
-
max time kernel
139s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2023 08:42
Static task
static1
Behavioral task
behavioral1
Sample
f9178f4a0fd9431b4bf04be1a1f1602f.exe
Resource
win7-20230220-en
General
-
Target
f9178f4a0fd9431b4bf04be1a1f1602f.exe
-
Size
718KB
-
MD5
f9178f4a0fd9431b4bf04be1a1f1602f
-
SHA1
c65726a5d131a83e95dd6d9ebd6aeae63b34db7d
-
SHA256
cbdac32d6f43a1f03a26cc2fcc6ea13586f0d7f85764c1626cc71ce30bc0434b
-
SHA512
fe41dfa4d4fa80e468011d37d0eb51244cda7d8a1b2a50557ff65680ae39eba505b6def5afbc2f7e15d09ef686b40b596e9108d195f6b348bf26e30cfd6db6a4
-
SSDEEP
12288:fwgjjykCS3rhjmC2JIussWxToNXEYZF41OK3G8k/z/ip2PAlwNl:fwgjjykCSVMszToN1TB+lk7a8s2
Malware Config
Extracted
formbook
4.1
gtt8
thesuccessbot.com
rittercivil.com
jt1.fun
d365extension.com
quqoxeq.top
visittworiverswi.com
bfprotienda.com
greenhabitsph.com
ladmere.com
clockboutiques.com
minwart.xyz
xinyuejiancai.online
eggsl.com
fetchingcandles.com
skywatiniya.com
hinkley.news
realityonlineenterprises.com
teamcroissant.com
esfera-pv.ch
herdadedosmontesbastos.com
buddhistprayers.app
talytic-one.com
capital-top.com
pawmultiverse.com
gdrop.biz
africanswers.online
amgconstruct1on.com
review.builders
findinstinct.online
leseditionsdupangolin.site
vector-sale.com
hutesmarke.shop
spacevisualmedia.com
jeweledcrown.shop
divinedivas.store
redirr.online
callifam.com
nickelinfo.com
ginghamstudio.com
launchthepodcast.com
arlisia.com
kerryshields.com
xn--o39aj5xqvflut.com
ramsgatecarwash.com
semrushfreetrails.com
rmpaclub.ru
wtpoexpo.one
amlar.xyz
downlis.top
phrasecheck.com
uk885.top
gdtrn.com
99522v.com
liftdetox2023.online
evo-omega.cloud
iccu3v.link
amd-soft1.site
containermurah.xyz
vineagency.uk
leeprintanddesign.com
bnjyjy.com
bookra-ck.com
ilyinsurance.com
texasmicroneedling.com
osmosstore.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2076-140-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f9178f4a0fd9431b4bf04be1a1f1602f.exedescription pid process target process PID 3612 set thread context of 2076 3612 f9178f4a0fd9431b4bf04be1a1f1602f.exe f9178f4a0fd9431b4bf04be1a1f1602f.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
f9178f4a0fd9431b4bf04be1a1f1602f.exef9178f4a0fd9431b4bf04be1a1f1602f.exepid process 3612 f9178f4a0fd9431b4bf04be1a1f1602f.exe 3612 f9178f4a0fd9431b4bf04be1a1f1602f.exe 2076 f9178f4a0fd9431b4bf04be1a1f1602f.exe 2076 f9178f4a0fd9431b4bf04be1a1f1602f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
f9178f4a0fd9431b4bf04be1a1f1602f.exedescription pid process Token: SeDebugPrivilege 3612 f9178f4a0fd9431b4bf04be1a1f1602f.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
f9178f4a0fd9431b4bf04be1a1f1602f.exedescription pid process target process PID 3612 wrote to memory of 800 3612 f9178f4a0fd9431b4bf04be1a1f1602f.exe f9178f4a0fd9431b4bf04be1a1f1602f.exe PID 3612 wrote to memory of 800 3612 f9178f4a0fd9431b4bf04be1a1f1602f.exe f9178f4a0fd9431b4bf04be1a1f1602f.exe PID 3612 wrote to memory of 800 3612 f9178f4a0fd9431b4bf04be1a1f1602f.exe f9178f4a0fd9431b4bf04be1a1f1602f.exe PID 3612 wrote to memory of 2076 3612 f9178f4a0fd9431b4bf04be1a1f1602f.exe f9178f4a0fd9431b4bf04be1a1f1602f.exe PID 3612 wrote to memory of 2076 3612 f9178f4a0fd9431b4bf04be1a1f1602f.exe f9178f4a0fd9431b4bf04be1a1f1602f.exe PID 3612 wrote to memory of 2076 3612 f9178f4a0fd9431b4bf04be1a1f1602f.exe f9178f4a0fd9431b4bf04be1a1f1602f.exe PID 3612 wrote to memory of 2076 3612 f9178f4a0fd9431b4bf04be1a1f1602f.exe f9178f4a0fd9431b4bf04be1a1f1602f.exe PID 3612 wrote to memory of 2076 3612 f9178f4a0fd9431b4bf04be1a1f1602f.exe f9178f4a0fd9431b4bf04be1a1f1602f.exe PID 3612 wrote to memory of 2076 3612 f9178f4a0fd9431b4bf04be1a1f1602f.exe f9178f4a0fd9431b4bf04be1a1f1602f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9178f4a0fd9431b4bf04be1a1f1602f.exe"C:\Users\Admin\AppData\Local\Temp\f9178f4a0fd9431b4bf04be1a1f1602f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f9178f4a0fd9431b4bf04be1a1f1602f.exe"C:\Users\Admin\AppData\Local\Temp\f9178f4a0fd9431b4bf04be1a1f1602f.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\f9178f4a0fd9431b4bf04be1a1f1602f.exe"C:\Users\Admin\AppData\Local\Temp\f9178f4a0fd9431b4bf04be1a1f1602f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2076-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2076-142-0x0000000001300000-0x000000000164A000-memory.dmpFilesize
3.3MB
-
memory/3612-133-0x0000000000160000-0x000000000021A000-memory.dmpFilesize
744KB
-
memory/3612-134-0x00000000051D0000-0x0000000005774000-memory.dmpFilesize
5.6MB
-
memory/3612-135-0x0000000004C20000-0x0000000004CB2000-memory.dmpFilesize
584KB
-
memory/3612-136-0x0000000004BE0000-0x0000000004BEA000-memory.dmpFilesize
40KB
-
memory/3612-137-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/3612-138-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/3612-139-0x0000000000950000-0x00000000009EC000-memory.dmpFilesize
624KB