Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2023 01:54
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230831-en
General
-
Target
tmp.exe
-
Size
710KB
-
MD5
493562fc3240d634f797be4a433d72c7
-
SHA1
92569595aa0a20d9937bd03525a756dd35059d3b
-
SHA256
6b73ab2cf730e26c8609e57d23e09260d6c74db84f29ae6f786129f7a3b6512b
-
SHA512
70eb16d06d38d80cc4513962f6fbdeda54e6ec2bc30caa9fb112d3cd355b12c088426c823d3d4a3e315209b3fc908c0339e9cdc8de99462e87eba311f4801a75
-
SSDEEP
12288:406gna2iNP1UIkvEbtOgVt3KB6bxxXRZEG/p8fD5mcjtqlg6utz5l96OXaq:XTa1F14ot1aIxxAop+mc0g6MNa
Malware Config
Extracted
formbook
4.1
ro12
start399.com
decyfincoin.com
binguozhijiaok.com
one45.vip
55dy5s.top
regmt.pro
2ahxgaafifl.com
xn--6rtp2flvfc2h.com
justinmburns.com
los3.online
fleshaaikensdivinegiven7llc.com
servicedelv.services
apexcaryhomesforsale.com
shuraop.xyz
sagetotal.com
gratitude-et-compagnie.com
riderarea.com
digitalserviceact.online
contentbyc.com
agenda-digital-planner.com
senior-living-91799.bond
navigationexperiments.com
tiktok-shop-he.com
qualityquickprints.com
ddbetting.com
navigatenuggets.com
indiannaturals.online
xzgx360.com
xlrj.asia
seagaming.net
saltcasing.info
pq-es.com
doubleapus.com
speedgallery.shop
millions-fans.com
ktrandnews.com
niaeoer.com
60plusmen.com
nala.dev
costanotaryservice.com
palokallio.net
sportsynergyemporium.fun
fathomtackle.com
computer-chronicles.com
valeriaestate.com
holzleisten24.shop
ps212naming.com
blessed-autos.com
rptiki.com
bjykswkj.com
vorbergh.info
ssongg273.cfd
thevitaminstore.store
easyeats307.com
mcied.link
ssongg1620.cfd
y-12federalcreditunion.top
jlh777.com
no5th3267.top
toolifyonline.com
hcsjwdy.com
ypwvj8.top
hja357b.com
bajie6.com
pwpholdings.com
Signatures
-
Formbook payload 4 IoCs
resource yara_rule behavioral2/memory/2868-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2868-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3372-22-0x0000000001210000-0x000000000123F000-memory.dmp formbook behavioral2/memory/3372-24-0x0000000001210000-0x000000000123F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2612 set thread context of 2868 2612 tmp.exe 101 PID 2868 set thread context of 3324 2868 tmp.exe 49 PID 3372 set thread context of 3324 3372 control.exe 49 -
Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 2612 tmp.exe 2612 tmp.exe 2612 tmp.exe 2612 tmp.exe 2612 tmp.exe 2612 tmp.exe 2612 tmp.exe 2612 tmp.exe 2612 tmp.exe 2868 tmp.exe 2868 tmp.exe 2868 tmp.exe 2868 tmp.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3324 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2868 tmp.exe 2868 tmp.exe 2868 tmp.exe 3372 control.exe 3372 control.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2612 tmp.exe Token: SeDebugPrivilege 2868 tmp.exe Token: SeDebugPrivilege 3372 control.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3324 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2612 wrote to memory of 2688 2612 tmp.exe 100 PID 2612 wrote to memory of 2688 2612 tmp.exe 100 PID 2612 wrote to memory of 2688 2612 tmp.exe 100 PID 2612 wrote to memory of 2868 2612 tmp.exe 101 PID 2612 wrote to memory of 2868 2612 tmp.exe 101 PID 2612 wrote to memory of 2868 2612 tmp.exe 101 PID 2612 wrote to memory of 2868 2612 tmp.exe 101 PID 2612 wrote to memory of 2868 2612 tmp.exe 101 PID 2612 wrote to memory of 2868 2612 tmp.exe 101 PID 3324 wrote to memory of 3372 3324 Explorer.EXE 102 PID 3324 wrote to memory of 3372 3324 Explorer.EXE 102 PID 3324 wrote to memory of 3372 3324 Explorer.EXE 102 PID 3372 wrote to memory of 3784 3372 control.exe 103 PID 3372 wrote to memory of 3784 3372 control.exe 103 PID 3372 wrote to memory of 3784 3372 control.exe 103
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵PID:2688
-
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2868
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵PID:3784
-
-