Overview
overview
10Static
static
101.exe
windows7-x64
31221.exe
windows7-x64
106b282d34fv2.exe
windows7-x64
1B000CEF.exe
windows7-x64
10Builder.exe
windows7-x64
1POVOFJYqCo...Iu.exe
windows7-x64
1Terracotta.exe
windows7-x64
1TerracottaGUI.exe
windows7-x64
1Zver.exe
windows7-x64
3a.exe
windows7-x64
10amdcontroller.exe
windows7-x64
10bg.exe
windows7-x64
1bin.exe
windows7-x64
10bin2.exe
windows7-x64
7ej.exe
windows7-x64
10fban4.exe
windows7-x64
7glash.exe
windows7-x64
1johngotovo (2).exe
windows7-x64
10johngotovo...al.exe
windows7-x64
10ktg.exe
windows7-x64
1otIXAOPqOV...LX.exe
windows7-x64
3scvsots.exe
windows7-x64
10setup.exe
windows7-x64
1shit.exe
windows7-x64
10ss.exe
windows7-x64
10stealedd517v2.exe
windows7-x64
1steel.exe
windows7-x64
1ted.exe
windows7-x64
1update_b.exe
windows7-x64
1update_z.exe
windows7-x64
1uyo.exe
windows7-x64
1v72d8z2.exe
windows7-x64
1Analysis
-
max time kernel
30s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
13-08-2023 18:33
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
1221.exe
Resource
win7-20230712-en
Behavioral task
behavioral3
Sample
6b282d34fv2.exe
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
B000CEF.exe
Resource
win7-20230712-en
Behavioral task
behavioral5
Sample
Builder.exe
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
POVOFJYqCoZfOoPkWOsSBcVYWIu.exe
Resource
win7-20230712-en
Behavioral task
behavioral7
Sample
Terracotta.exe
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
TerracottaGUI.exe
Resource
win7-20230712-en
Behavioral task
behavioral9
Sample
Zver.exe
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
a.exe
Resource
win7-20230712-en
Behavioral task
behavioral11
Sample
amdcontroller.exe
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
bg.exe
Resource
win7-20230712-en
Behavioral task
behavioral13
Sample
bin.exe
Resource
win7-20230712-en
Behavioral task
behavioral14
Sample
bin2.exe
Resource
win7-20230712-en
Behavioral task
behavioral15
Sample
ej.exe
Resource
win7-20230712-en
Behavioral task
behavioral16
Sample
fban4.exe
Resource
win7-20230712-en
Behavioral task
behavioral17
Sample
glash.exe
Resource
win7-20230712-en
Behavioral task
behavioral18
Sample
johngotovo (2).exe
Resource
win7-20230712-en
Behavioral task
behavioral19
Sample
johngotovo (2)_original_original.exe
Resource
win7-20230712-en
Behavioral task
behavioral20
Sample
ktg.exe
Resource
win7-20230712-en
Behavioral task
behavioral21
Sample
otIXAOPqOVgvIKePlwFQLX.exe
Resource
win7-20230712-en
Behavioral task
behavioral22
Sample
scvsots.exe
Resource
win7-20230712-en
Behavioral task
behavioral23
Sample
setup.exe
Resource
win7-20230712-en
Behavioral task
behavioral24
Sample
shit.exe
Resource
win7-20230712-en
Behavioral task
behavioral25
Sample
ss.exe
Resource
win7-20230712-en
Behavioral task
behavioral26
Sample
stealedd517v2.exe
Resource
win7-20230712-en
Behavioral task
behavioral27
Sample
steel.exe
Resource
win7-20230712-en
Behavioral task
behavioral28
Sample
ted.exe
Resource
win7-20230712-en
Behavioral task
behavioral29
Sample
update_b.exe
Resource
win7-20230712-en
Behavioral task
behavioral30
Sample
update_z.exe
Resource
win7-20230712-en
Behavioral task
behavioral31
Sample
uyo.exe
Resource
win7-20230712-en
Behavioral task
behavioral32
Sample
v72d8z2.exe
Resource
win7-20230712-en
General
-
Target
ej.exe
-
Size
472KB
-
MD5
0948d25e80d3fe36133ea70394d16c93
-
SHA1
b1d9c2f690fb5820055439d9f4a0a2e858621b03
-
SHA256
9c2c89920c9d9d94674149fb789e2cf78cb9e20c451658d63b95cfd77c58a1d5
-
SHA512
538a25805e24f39d122d06a9f877b0116941bc668f21f5c0306a7c8f96e112b98b2ecaa1d8dc8f9ad39fbffe49c4b909407152ac21e78dfd926f00ae9460b772
-
SSDEEP
6144:GCmB8MwX6rWu5dIybQNcpYB1UukBvWxNMfuGe3wRpZSvANzC+3A0RvdtDsAyFRqo:c6X6rId+uEKNOk3EWvczC+Lv9UR4
Malware Config
Extracted
formbook
3.8
el
fundayinc.com
91shiping.red
piccgz.com
greylockiceandheating.com
6-15hothamstreetstkildaeast.com
bladspiegel.com
xn--ruq41buok09a6r0azmh.com
reallifeandlipstick.com
wwwjinsha594.com
wpnull.info
dtaubman.net
eldhw.win
caringhouseholds.com
texasisrael.com
confiservice.com
unihome.store
xn--doqs90b84tkjg.com
xuanweiping.com
edictiosapiens.com
kalkulatorkredytow.online
christopherkawell.com
onve2.info
manwipes.company
abtotomotivvenakliyat.com
irma-indemnisation.com
nicewayx.com
hrsstaging.com
caucasiancatchphrase.com
shufsd.net
hxa.design
www8458r.com
retocon.com
naturesoonsoo.com
ineffablelife.com
51btcaifu.com
xn--i20bz3evvky1i0xe.com
sihaimsc.com
digitetc.com
julian-salz.com
latinopensource.net
1998baby.com
lemqgqzine.online
yourschoolpic.com
newsale.top
bowenhuanqiu.com
assysro.com
textradeuk.com
baiku777.com
mail-oppai-sex.info
hnyh-zzsy.com
kcp-laos.com
dushi.ink
az0cbjj9rj.biz
kjontn.info
7ianle.info
feesto.com
raterank.review
simplyhomemadedesserts.com
kayciezhang.com
rliliedahl.com
hypnoses-bordeaux.com
xuanwu176.com
hutnw.loan
decentralizedsystems.net
weltho.com
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral15/memory/2240-58-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral15/memory/2240-61-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral15/memory/2240-65-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral15/memory/2824-72-0x0000000000080000-0x00000000000AA000-memory.dmp formbook behavioral15/memory/2824-79-0x0000000000080000-0x00000000000AA000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2856 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
ej.exeej.execontrol.exedescription pid process target process PID 3000 set thread context of 2240 3000 ej.exe ej.exe PID 2240 set thread context of 1284 2240 ej.exe Explorer.EXE PID 2240 set thread context of 1284 2240 ej.exe Explorer.EXE PID 2824 set thread context of 1284 2824 control.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
ej.execontrol.exepid process 2240 ej.exe 2240 ej.exe 2240 ej.exe 2824 control.exe 2824 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
ej.execontrol.exepid process 2240 ej.exe 2240 ej.exe 2240 ej.exe 2240 ej.exe 2824 control.exe 2824 control.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ej.execontrol.exedescription pid process Token: SeDebugPrivilege 2240 ej.exe Token: SeDebugPrivilege 2824 control.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ej.exepid process 3000 ej.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
ej.exepid process 2240 ej.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ej.exeExplorer.EXEcontrol.exedescription pid process target process PID 3000 wrote to memory of 2240 3000 ej.exe ej.exe PID 3000 wrote to memory of 2240 3000 ej.exe ej.exe PID 3000 wrote to memory of 2240 3000 ej.exe ej.exe PID 3000 wrote to memory of 2240 3000 ej.exe ej.exe PID 1284 wrote to memory of 2824 1284 Explorer.EXE control.exe PID 1284 wrote to memory of 2824 1284 Explorer.EXE control.exe PID 1284 wrote to memory of 2824 1284 Explorer.EXE control.exe PID 1284 wrote to memory of 2824 1284 Explorer.EXE control.exe PID 2824 wrote to memory of 2856 2824 control.exe cmd.exe PID 2824 wrote to memory of 2856 2824 control.exe cmd.exe PID 2824 wrote to memory of 2856 2824 control.exe cmd.exe PID 2824 wrote to memory of 2856 2824 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ej.exe"C:\Users\Admin\AppData\Local\Temp\ej.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ej.exeC:\Users\Admin\AppData\Local\Temp\ej.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ej.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1284-68-0x00000000070B0000-0x00000000071F7000-memory.dmpFilesize
1.3MB
-
memory/1284-84-0x0000000007200000-0x000000000730A000-memory.dmpFilesize
1.0MB
-
memory/1284-83-0x0000000007200000-0x000000000730A000-memory.dmpFilesize
1.0MB
-
memory/1284-81-0x0000000000010000-0x0000000000020000-memory.dmpFilesize
64KB
-
memory/1284-78-0x00000000070B0000-0x00000000071F7000-memory.dmpFilesize
1.3MB
-
memory/1284-77-0x000007FE7BB70000-0x000007FE7BB7A000-memory.dmpFilesize
40KB
-
memory/1284-63-0x00000000040C0000-0x0000000004193000-memory.dmpFilesize
844KB
-
memory/1284-76-0x000007FEF5C00000-0x000007FEF5D43000-memory.dmpFilesize
1.3MB
-
memory/2240-62-0x0000000001C10000-0x0000000001C24000-memory.dmpFilesize
80KB
-
memory/2240-65-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2240-58-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2240-66-0x0000000001C50000-0x0000000001C64000-memory.dmpFilesize
80KB
-
memory/2240-60-0x00000000066D0000-0x00000000069D3000-memory.dmpFilesize
3.0MB
-
memory/2240-61-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2824-80-0x0000000000430000-0x00000000004C3000-memory.dmpFilesize
588KB
-
memory/2824-73-0x0000000002110000-0x0000000002413000-memory.dmpFilesize
3.0MB
-
memory/2824-72-0x0000000000080000-0x00000000000AA000-memory.dmpFilesize
168KB
-
memory/2824-70-0x0000000000CF0000-0x0000000000D0F000-memory.dmpFilesize
124KB
-
memory/2824-79-0x0000000000080000-0x00000000000AA000-memory.dmpFilesize
168KB
-
memory/2824-71-0x0000000000CF0000-0x0000000000D0F000-memory.dmpFilesize
124KB
-
memory/3000-56-0x0000000000350000-0x0000000000356000-memory.dmpFilesize
24KB
-
memory/3000-57-0x0000000077500000-0x00000000775D6000-memory.dmpFilesize
856KB