Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
23/10/2023, 17:43
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.a00ea565f9db4d7b4eeef36c77c6635a84ef610ad73890a2b0bd9852ff6d73f7exe_JC.exe
Resource
win7-20231020-en
General
-
Target
NEAS.a00ea565f9db4d7b4eeef36c77c6635a84ef610ad73890a2b0bd9852ff6d73f7exe_JC.exe
-
Size
636KB
-
MD5
00fd4d2c65c750f7b8c1d3c01ca1971d
-
SHA1
9948ab44fcf59db07b020c54af3f957c9d4a4cd6
-
SHA256
a00ea565f9db4d7b4eeef36c77c6635a84ef610ad73890a2b0bd9852ff6d73f7
-
SHA512
72e8f912ab8324057bfbcdc875eaff34d9f1dedd27d2e7d84f12d904f9a195f689bc14c6f8e50c846fbd10e69d1da4b9fa322d5618fc6f9d90c372c7b77055db
-
SSDEEP
12288:IjTB7s9DwY5hq+BqBkUkdVz4BygljeHaDKvjx/TzwXGKimdXv:KB7s9DdhvqRkXENNDKvjx/TzwXfii
Malware Config
Extracted
formbook
4.1
k0p2
theluxurytraveljournal.com
skybet10.com
mountruqal.online
onlyones.xyz
kloea.top
studio7crochet.online
dhv9gmy.top
walkereld.com
script-shore.com
bwerger02.xyz
clempi.xyz
lishapanchal.com
imagemaza.com
ludu65.com
zenith-leadership.com
undertheradar.zone
802cm.top
budeny.com
piabellacasino338.com
eclipse-demolition.com
etqevw.xyz
sr00085.live
braintreefolk.online
jack138b.bet
vseeboxsetup.info
flooring-solution.info
8js88.com
ejuridicomaurochirinos.store
diange-life.com
debutbroadcasting.com
mmerchasile.com
betaverse204.com
smart-plumbing.online
kcmanga.com
de-curated.com
rakj058.xyz
kaanpendik8.shop
burgundyrovers.com
heat-pumps-28474.bond
onboard-wallet.com
missuniversehb.com
laplumeuniverselle.com
embroideryworkshawaii.com
fsguofeng.com
gubcku.top
inform-onlineprava.online
vidadelider.com
earringhaven.com
mendbotics.com
baba-behtarina-20-best1.buzz
findmyguru.online
prediccioneconomica.com
affordabledesigns.online
bosnaga88pro.com
localyork.click
wingardabygg.com
wealthwithleah.com
mydomains99-1.com
cushytushies.com
ironhorsemetalworkoriginals.com
colipedia.com
aippod.com
ganimh.com
insideo365.club
socialclubs-saarland.online
Signatures
-
Formbook payload 1 IoCs
resource yara_rule behavioral2/memory/4984-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2276 set thread context of 4984 2276 NEAS.a00ea565f9db4d7b4eeef36c77c6635a84ef610ad73890a2b0bd9852ff6d73f7exe_JC.exe 94 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4984 NEAS.a00ea565f9db4d7b4eeef36c77c6635a84ef610ad73890a2b0bd9852ff6d73f7exe_JC.exe 4984 NEAS.a00ea565f9db4d7b4eeef36c77c6635a84ef610ad73890a2b0bd9852ff6d73f7exe_JC.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2276 wrote to memory of 4984 2276 NEAS.a00ea565f9db4d7b4eeef36c77c6635a84ef610ad73890a2b0bd9852ff6d73f7exe_JC.exe 94 PID 2276 wrote to memory of 4984 2276 NEAS.a00ea565f9db4d7b4eeef36c77c6635a84ef610ad73890a2b0bd9852ff6d73f7exe_JC.exe 94 PID 2276 wrote to memory of 4984 2276 NEAS.a00ea565f9db4d7b4eeef36c77c6635a84ef610ad73890a2b0bd9852ff6d73f7exe_JC.exe 94 PID 2276 wrote to memory of 4984 2276 NEAS.a00ea565f9db4d7b4eeef36c77c6635a84ef610ad73890a2b0bd9852ff6d73f7exe_JC.exe 94 PID 2276 wrote to memory of 4984 2276 NEAS.a00ea565f9db4d7b4eeef36c77c6635a84ef610ad73890a2b0bd9852ff6d73f7exe_JC.exe 94 PID 2276 wrote to memory of 4984 2276 NEAS.a00ea565f9db4d7b4eeef36c77c6635a84ef610ad73890a2b0bd9852ff6d73f7exe_JC.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.a00ea565f9db4d7b4eeef36c77c6635a84ef610ad73890a2b0bd9852ff6d73f7exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.a00ea565f9db4d7b4eeef36c77c6635a84ef610ad73890a2b0bd9852ff6d73f7exe_JC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\NEAS.a00ea565f9db4d7b4eeef36c77c6635a84ef610ad73890a2b0bd9852ff6d73f7exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.a00ea565f9db4d7b4eeef36c77c6635a84ef610ad73890a2b0bd9852ff6d73f7exe_JC.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4984
-