Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
23/10/2023, 13:32
Static task
static1
Behavioral task
behavioral1
Sample
PO8687.exe
Resource
win7-20231020-en
General
-
Target
PO8687.exe
-
Size
761KB
-
MD5
9daa7adc7435c5e080c99f2239017e27
-
SHA1
70b63b6a205b277367be62cfbfc9e528c5b1903a
-
SHA256
1d18b8139377bf5246b24fd11e4386312cc4ab3e652ab9df534068ac96755394
-
SHA512
78e36c18660004fdaf3b8b07fa0b47ece8323b170c2fdd66e75efe88e4dfa46c7dc06fbcf9f08eccdf455e5fe7aeb083fc8191b2511588ee851811999a3fefd7
-
SSDEEP
12288:hhNh6sxTA6qNhtnaRi+glMjYTabQ0IFpRxwkn+RuB3SJ:hDDxs6g7aRi+/YTabQ0ktwk+cB
Malware Config
Extracted
formbook
4.1
ro12
start399.com
decyfincoin.com
binguozhijiaok.com
one45.vip
55dy5s.top
regmt.pro
2ahxgaafifl.com
xn--6rtp2flvfc2h.com
justinmburns.com
los3.online
fleshaaikensdivinegiven7llc.com
servicedelv.services
apexcaryhomesforsale.com
shuraop.xyz
sagetotal.com
gratitude-et-compagnie.com
riderarea.com
digitalserviceact.online
contentbyc.com
agenda-digital-planner.com
senior-living-91799.bond
navigationexperiments.com
tiktok-shop-he.com
qualityquickprints.com
ddbetting.com
navigatenuggets.com
indiannaturals.online
xzgx360.com
xlrj.asia
seagaming.net
saltcasing.info
pq-es.com
doubleapus.com
speedgallery.shop
millions-fans.com
ktrandnews.com
niaeoer.com
60plusmen.com
nala.dev
costanotaryservice.com
palokallio.net
sportsynergyemporium.fun
fathomtackle.com
computer-chronicles.com
valeriaestate.com
holzleisten24.shop
ps212naming.com
blessed-autos.com
rptiki.com
bjykswkj.com
vorbergh.info
ssongg273.cfd
thevitaminstore.store
easyeats307.com
mcied.link
ssongg1620.cfd
y-12federalcreditunion.top
jlh777.com
no5th3267.top
toolifyonline.com
hcsjwdy.com
ypwvj8.top
hja357b.com
bajie6.com
pwpholdings.com
Signatures
-
Formbook payload 1 IoCs
resource yara_rule behavioral1/memory/2812-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2916 set thread context of 2812 2916 PO8687.exe 30 -
Program crash 1 IoCs
pid pid_target Process procid_target 1044 2812 WerFault.exe 30 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2916 PO8687.exe 2916 PO8687.exe 2916 PO8687.exe 2916 PO8687.exe 2916 PO8687.exe 2916 PO8687.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2916 PO8687.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2812 2916 PO8687.exe 30 PID 2916 wrote to memory of 2812 2916 PO8687.exe 30 PID 2916 wrote to memory of 2812 2916 PO8687.exe 30 PID 2916 wrote to memory of 2812 2916 PO8687.exe 30 PID 2916 wrote to memory of 2812 2916 PO8687.exe 30 PID 2916 wrote to memory of 2812 2916 PO8687.exe 30 PID 2916 wrote to memory of 2812 2916 PO8687.exe 30 PID 2812 wrote to memory of 1044 2812 PO8687.exe 31 PID 2812 wrote to memory of 1044 2812 PO8687.exe 31 PID 2812 wrote to memory of 1044 2812 PO8687.exe 31 PID 2812 wrote to memory of 1044 2812 PO8687.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO8687.exe"C:\Users\Admin\AppData\Local\Temp\PO8687.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\PO8687.exe"C:\Users\Admin\AppData\Local\Temp\PO8687.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 363⤵
- Program crash
PID:1044
-
-