Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
02-09-2023 01:07
Static task
static1
Behavioral task
behavioral1
Sample
d4b306e65c16a66f2c0851d70709f117d2a93596fa9ad5905f99c99ea25aba10.exe
Resource
win7-20230831-en
General
-
Target
d4b306e65c16a66f2c0851d70709f117d2a93596fa9ad5905f99c99ea25aba10.exe
-
Size
955KB
-
MD5
15e76febd9a13cf44e211849c051a68c
-
SHA1
6d3b2d2b00e210d706e6f5746cae5e8cafae777b
-
SHA256
d4b306e65c16a66f2c0851d70709f117d2a93596fa9ad5905f99c99ea25aba10
-
SHA512
74be8b1f75065eb7991ca07c559f6a14354c65ce20ddbce6127253c4b73ce29b6ecfa786fc67d095b6bbc9939446c54c684811fde4116a318835eaa32e5a4105
-
SSDEEP
24576:reunQk8WUgZxqyp/0knO+e8KnCqTsQlSC:nUexqahnXe8KnZTsQlS
Malware Config
Extracted
formbook
4.1
v93r
labourcommunitymarket.com
nba82.com
datahabitsales.site
rosstony.link
baliorganic.farm
qefhyjngrxcbjfvgft.autos
bippttcg.click
tldrschool.com
vcdaawug.click
garage2mats.com
soulrin.store
themezodermacream.com
522fairwaylookout.com
jmhoa.cyou
sygcb.link
thanhpresident.com
biy-home.com
imtmlife.online
dijitalpasaj.app
105261.com
wyldnwestern.com
risefootwear.com
bbmusic906.com
unsold-laptops-seek.today
oixkphfm9oap.xyz
steelyholdings.com
ticket2future.site
vndlsvllns.com
rupashtgai.com
lexpy.xyz
drillingkingtool.com
lkpmekarjaya.com
luoyutao.love
notfrank.tech
calawadvice.com
wpc-rotterdam.com
pttroblox.com
coffeeforsoldiers.com
csshhinm.click
bmsexpert.com
coperworks.com
fengwowuye.com
dariobisogno.com
naturalresourcetrail.com
allupinyourbizness.com
cheapjerseysfreeshipping.store
upgoavvi.click
mynintdndonews.com
zorailabs.com
akonghoki.click
lgoicube.com
rapportus.com
lxdutzuc.click
kradbfkweqd888.com
fbjbk.com
lojaravystore.online
truthistanbul.xyz
ilda.vip
holytoastknox.com
owsspa.com
oyyltyzn.click
pesawat-tempur-3.site
wyxhoo.com
jiahao668.com
myacc.info
Signatures
-
Formbook payload 1 IoCs
resource yara_rule behavioral1/memory/2668-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2080 set thread context of 2668 2080 d4b306e65c16a66f2c0851d70709f117d2a93596fa9ad5905f99c99ea25aba10.exe 28 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2668 d4b306e65c16a66f2c0851d70709f117d2a93596fa9ad5905f99c99ea25aba10.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2080 wrote to memory of 2668 2080 d4b306e65c16a66f2c0851d70709f117d2a93596fa9ad5905f99c99ea25aba10.exe 28 PID 2080 wrote to memory of 2668 2080 d4b306e65c16a66f2c0851d70709f117d2a93596fa9ad5905f99c99ea25aba10.exe 28 PID 2080 wrote to memory of 2668 2080 d4b306e65c16a66f2c0851d70709f117d2a93596fa9ad5905f99c99ea25aba10.exe 28 PID 2080 wrote to memory of 2668 2080 d4b306e65c16a66f2c0851d70709f117d2a93596fa9ad5905f99c99ea25aba10.exe 28 PID 2080 wrote to memory of 2668 2080 d4b306e65c16a66f2c0851d70709f117d2a93596fa9ad5905f99c99ea25aba10.exe 28 PID 2080 wrote to memory of 2668 2080 d4b306e65c16a66f2c0851d70709f117d2a93596fa9ad5905f99c99ea25aba10.exe 28 PID 2080 wrote to memory of 2668 2080 d4b306e65c16a66f2c0851d70709f117d2a93596fa9ad5905f99c99ea25aba10.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4b306e65c16a66f2c0851d70709f117d2a93596fa9ad5905f99c99ea25aba10.exe"C:\Users\Admin\AppData\Local\Temp\d4b306e65c16a66f2c0851d70709f117d2a93596fa9ad5905f99c99ea25aba10.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\d4b306e65c16a66f2c0851d70709f117d2a93596fa9ad5905f99c99ea25aba10.exe"C:\Users\Admin\AppData\Local\Temp\d4b306e65c16a66f2c0851d70709f117d2a93596fa9ad5905f99c99ea25aba10.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2668
-