Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
23/10/2023, 07:53
Static task
static1
Behavioral task
behavioral1
Sample
PAGO 72094.exe
Resource
win7-20231020-en
General
-
Target
PAGO 72094.exe
-
Size
867KB
-
MD5
d0589c025fcb96a689d4c8e7a689ac83
-
SHA1
1f227a6bdc3099ab7b5a1cdcb11191668dd48f43
-
SHA256
0372bd9c40187e5b4df86dae74c475d5f7b01de4424281dda221a579be971fb8
-
SHA512
a7c2b2de5a9fe1a683e1892a77a18ed9558d5b748007f09ab4198d63013dc675204f33d2826b1cc954efa77b6fc1af9e647211acf20505b2f4972e5b09ac9925
-
SSDEEP
12288:dFbaDjLnmxh+5xDJhW1JxLa4qy1MCRjZCUzOQzkYVR9Q:a/Ln045xDJQRLa4jXDm
Malware Config
Extracted
formbook
4.1
eg02
erc20.gold
elainevannmorgan.photography
melbet-el4.top
guvenilir.bet
sesamecsre.com
kevinjaydenwivano.tech
condohotelguru.com
shjcdz.com
innocarta.store
collinstradingpost.com
6om3j4.top
nagtco.xyz
fasist.fit
arkansaspremiertournaments.com
mrscsnowschool.com
ma-group.online
lillyjriley.icu
electric-cars-87253.bond
lila.tools
hollamia.com
snartonlinecheck.work
zaymnokni.online
rapidreviewmd.online
p8m.xyz
crowdhailer.online
needwaterpump.online
vi-apk.com
anenza.com
smarters-iptv.live
yachtfuellife.com
gbconsulting.online
limasise.com
bankir-ru.com
alexanderbonnet.com
bevontrade.com
inovarevending.com
aamrut.com
asalgacor.info
qqdwua.icu
ownableai.com
karoobaar.com
8lode88.vip
eblata.com
foxhouston26.com
www653f8918344e.com
pg290.fun
blacktowhitecuckold.com
lindsaybea.com
tripitour.com
senhormarceneiro.com
blacktowhitecuckold.com
zephyra.bet
seleneexport.com
nfertilityinwomen.com
godestas.com
pickuptruk.com
broadwayscg.com
jordanwatts.link
escuelawakana.com
compreiganhei.site
wolfandthecrow.com
nagoya-naisou-kaitai.com
wiseleadership.net
midowallwet.com
mygeneralmotorsretirement.com
Signatures
-
Formbook payload 4 IoCs
resource yara_rule behavioral1/memory/2948-13-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2948-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2724-22-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/2724-24-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
pid Process 2760 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1412 set thread context of 2948 1412 PAGO 72094.exe 32 PID 2948 set thread context of 1276 2948 PAGO 72094.exe 15 PID 2724 set thread context of 1276 2724 raserver.exe 15 -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 1412 PAGO 72094.exe 1412 PAGO 72094.exe 1412 PAGO 72094.exe 1412 PAGO 72094.exe 2948 PAGO 72094.exe 2948 PAGO 72094.exe 2724 raserver.exe 2724 raserver.exe 2724 raserver.exe 2724 raserver.exe 2724 raserver.exe 2724 raserver.exe 2724 raserver.exe 2724 raserver.exe 2724 raserver.exe 2724 raserver.exe 2724 raserver.exe 2724 raserver.exe 2724 raserver.exe 2724 raserver.exe 2724 raserver.exe 2724 raserver.exe 2724 raserver.exe 2724 raserver.exe 2724 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1276 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2948 PAGO 72094.exe 2948 PAGO 72094.exe 2948 PAGO 72094.exe 2724 raserver.exe 2724 raserver.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1412 PAGO 72094.exe Token: SeDebugPrivilege 2948 PAGO 72094.exe Token: SeDebugPrivilege 2724 raserver.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1276 Explorer.EXE 1276 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1276 Explorer.EXE 1276 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1412 wrote to memory of 2088 1412 PAGO 72094.exe 30 PID 1412 wrote to memory of 2088 1412 PAGO 72094.exe 30 PID 1412 wrote to memory of 2088 1412 PAGO 72094.exe 30 PID 1412 wrote to memory of 2088 1412 PAGO 72094.exe 30 PID 1412 wrote to memory of 2708 1412 PAGO 72094.exe 31 PID 1412 wrote to memory of 2708 1412 PAGO 72094.exe 31 PID 1412 wrote to memory of 2708 1412 PAGO 72094.exe 31 PID 1412 wrote to memory of 2708 1412 PAGO 72094.exe 31 PID 1412 wrote to memory of 2948 1412 PAGO 72094.exe 32 PID 1412 wrote to memory of 2948 1412 PAGO 72094.exe 32 PID 1412 wrote to memory of 2948 1412 PAGO 72094.exe 32 PID 1412 wrote to memory of 2948 1412 PAGO 72094.exe 32 PID 1412 wrote to memory of 2948 1412 PAGO 72094.exe 32 PID 1412 wrote to memory of 2948 1412 PAGO 72094.exe 32 PID 1412 wrote to memory of 2948 1412 PAGO 72094.exe 32 PID 1276 wrote to memory of 2724 1276 Explorer.EXE 33 PID 1276 wrote to memory of 2724 1276 Explorer.EXE 33 PID 1276 wrote to memory of 2724 1276 Explorer.EXE 33 PID 1276 wrote to memory of 2724 1276 Explorer.EXE 33 PID 2724 wrote to memory of 2760 2724 raserver.exe 34 PID 2724 wrote to memory of 2760 2724 raserver.exe 34 PID 2724 wrote to memory of 2760 2724 raserver.exe 34 PID 2724 wrote to memory of 2760 2724 raserver.exe 34
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\PAGO 72094.exe"C:\Users\Admin\AppData\Local\Temp\PAGO 72094.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\PAGO 72094.exe"C:\Users\Admin\AppData\Local\Temp\PAGO 72094.exe"3⤵PID:2088
-
-
C:\Users\Admin\AppData\Local\Temp\PAGO 72094.exe"C:\Users\Admin\AppData\Local\Temp\PAGO 72094.exe"3⤵PID:2708
-
-
C:\Users\Admin\AppData\Local\Temp\PAGO 72094.exe"C:\Users\Admin\AppData\Local\Temp\PAGO 72094.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2948
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PAGO 72094.exe"3⤵
- Deletes itself
PID:2760
-
-