Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30-12-2023 16:56
Static task
static1
Behavioral task
behavioral1
Sample
02a6ec40adc5114071950b305a7dad31.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
02a6ec40adc5114071950b305a7dad31.exe
Resource
win10v2004-20231215-en
General
-
Target
02a6ec40adc5114071950b305a7dad31.exe
-
Size
483KB
-
MD5
02a6ec40adc5114071950b305a7dad31
-
SHA1
2d4704843149608a649b19bb6d0ddcd25a8ffe45
-
SHA256
3c63f0da1a6f07ac40a85a614caef3d4b5edb022869d30385e59282576db579c
-
SHA512
d30d11be7a6362603957f1d05ef11c97185b61b87e947028729bb4f28e673a777fb777eb9704039b0c1b1a333c61278a0f70492aebd524a9aa9e6c2646eb1fcb
-
SSDEEP
6144:AIFhuSYWFYgrKsUc3y2WnO1xzcWmZXe2rkwnbo60T21BOcCSrYDEgfje5ig1ef9B:th8Mz+sv3y2N1xzAZprkmuN/SD5iKefz
Malware Config
Extracted
formbook
3.9
ow
piavecaffe.com
jlxkqg.men
lifesavingfoundation.net
karadasama.net
michaeltraolach-macsweeney.com
thunderwatches.com
serviciocasawhirlpool.biz
c-cap.online
itparksolution.com
clarityhearingkw.com
wpgrosiri.date
colemarshalcambell.com
webperffest.com
adjusterforirma.info
buildersqq.com
spiritualwisdominindia.com
111222333.net
traditionalarabicdishes.com
hmlifi.com
receive-our-info-heredaily.info
whitecoins.info
woodiesrattlers.com
www8458l.com
fifanie.com
xn--qrq721bqkkzt3b.net
mesquiteleaffarm.com
xn--30-yo3c105l5jn.com
imaginaryfair.com
dawnanddusted.com
youeronline.com
alyssabrandonportfolio.com
winhealthalert.info
fithappenseveryday.com
3dreplicant.net
exiaomaipu.com
billsmockupdomain.com
radicalmiddleusa.com
fatblastingsupplements.com
okvidaoapp.com
1024eees.info
gdbaisu.com
soluciones-libres.com
guansaidingzhi.com
francesca-lynagh.com
airbodycare.com
atlutes.com
learningtolaughintherain.com
zology-tek.com
bjlmzk.com
watchinglass.com
belltowerhealthcare.com
gaetvr.men
xn--j7q21wggj81l.net
photos4lyfe.net
paisaghat.com
repairextend.win
lifesciencescareers.com
bazar-199.com
timepieceluxury.com
wizeater.com
itdui.com
johnshookgp.com
lesderniers.com
goodsystemforupdates.review
cybep.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2072-26-0x0000000000080000-0x00000000000AA000-memory.dmp formbook behavioral1/memory/2072-30-0x0000000000080000-0x00000000000AA000-memory.dmp formbook behavioral1/memory/2072-35-0x0000000000080000-0x00000000000AA000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
Processes:
syscheck.exesyscheck.exepid process 2480 syscheck.exe 2072 syscheck.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exesyscheck.exepid process 1052 cmd.exe 2480 syscheck.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
syscheck.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\sysnet = "C:\\Users\\Admin\\AppData\\Local\\syscheck.exe -boot" syscheck.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
syscheck.exesyscheck.exedescription pid process target process PID 2480 set thread context of 2072 2480 syscheck.exe syscheck.exe PID 2072 set thread context of 1212 2072 syscheck.exe Explorer.EXE PID 2072 set thread context of 1212 2072 syscheck.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
syscheck.exepid process 2072 syscheck.exe 2072 syscheck.exe 2072 syscheck.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
syscheck.exepid process 2072 syscheck.exe 2072 syscheck.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
02a6ec40adc5114071950b305a7dad31.exesyscheck.exesyscheck.exedescription pid process Token: SeDebugPrivilege 1208 02a6ec40adc5114071950b305a7dad31.exe Token: SeDebugPrivilege 2480 syscheck.exe Token: SeDebugPrivilege 2072 syscheck.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
02a6ec40adc5114071950b305a7dad31.execmd.exesyscheck.exedescription pid process target process PID 1208 wrote to memory of 2928 1208 02a6ec40adc5114071950b305a7dad31.exe cmd.exe PID 1208 wrote to memory of 2928 1208 02a6ec40adc5114071950b305a7dad31.exe cmd.exe PID 1208 wrote to memory of 2928 1208 02a6ec40adc5114071950b305a7dad31.exe cmd.exe PID 1208 wrote to memory of 2928 1208 02a6ec40adc5114071950b305a7dad31.exe cmd.exe PID 1208 wrote to memory of 1052 1208 02a6ec40adc5114071950b305a7dad31.exe cmd.exe PID 1208 wrote to memory of 1052 1208 02a6ec40adc5114071950b305a7dad31.exe cmd.exe PID 1208 wrote to memory of 1052 1208 02a6ec40adc5114071950b305a7dad31.exe cmd.exe PID 1208 wrote to memory of 1052 1208 02a6ec40adc5114071950b305a7dad31.exe cmd.exe PID 1052 wrote to memory of 2480 1052 cmd.exe syscheck.exe PID 1052 wrote to memory of 2480 1052 cmd.exe syscheck.exe PID 1052 wrote to memory of 2480 1052 cmd.exe syscheck.exe PID 1052 wrote to memory of 2480 1052 cmd.exe syscheck.exe PID 2480 wrote to memory of 2072 2480 syscheck.exe syscheck.exe PID 2480 wrote to memory of 2072 2480 syscheck.exe syscheck.exe PID 2480 wrote to memory of 2072 2480 syscheck.exe syscheck.exe PID 2480 wrote to memory of 2072 2480 syscheck.exe syscheck.exe PID 2480 wrote to memory of 2072 2480 syscheck.exe syscheck.exe PID 2480 wrote to memory of 2072 2480 syscheck.exe syscheck.exe PID 2480 wrote to memory of 2072 2480 syscheck.exe syscheck.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\02a6ec40adc5114071950b305a7dad31.exe"C:\Users\Admin\AppData\Local\Temp\02a6ec40adc5114071950b305a7dad31.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\02a6ec40adc5114071950b305a7dad31.exe" "C:\Users\Admin\AppData\Local\syscheck.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\syscheck.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\syscheck.exe"C:\Users\Admin\AppData\Local\syscheck.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\syscheck.exe"C:\Users\Admin\AppData\Local\syscheck.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\syscheck.exeFilesize
483KB
MD502a6ec40adc5114071950b305a7dad31
SHA12d4704843149608a649b19bb6d0ddcd25a8ffe45
SHA2563c63f0da1a6f07ac40a85a614caef3d4b5edb022869d30385e59282576db579c
SHA512d30d11be7a6362603957f1d05ef11c97185b61b87e947028729bb4f28e673a777fb777eb9704039b0c1b1a333c61278a0f70492aebd524a9aa9e6c2646eb1fcb
-
memory/1208-3-0x0000000004960000-0x00000000049A0000-memory.dmpFilesize
256KB
-
memory/1208-2-0x0000000000510000-0x000000000052C000-memory.dmpFilesize
112KB
-
memory/1208-6-0x0000000074B90000-0x000000007527E000-memory.dmpFilesize
6.9MB
-
memory/1208-7-0x0000000004960000-0x00000000049A0000-memory.dmpFilesize
256KB
-
memory/1208-1-0x0000000074B90000-0x000000007527E000-memory.dmpFilesize
6.9MB
-
memory/1208-12-0x0000000074B90000-0x000000007527E000-memory.dmpFilesize
6.9MB
-
memory/1208-0-0x00000000009C0000-0x0000000000A3E000-memory.dmpFilesize
504KB
-
memory/1212-32-0x0000000002D60000-0x0000000002E60000-memory.dmpFilesize
1024KB
-
memory/1212-39-0x0000000007650000-0x00000000077B8000-memory.dmpFilesize
1.4MB
-
memory/1212-38-0x0000000007650000-0x00000000077B8000-memory.dmpFilesize
1.4MB
-
memory/1212-37-0x0000000004D80000-0x0000000004EC3000-memory.dmpFilesize
1.3MB
-
memory/1212-33-0x0000000004D80000-0x0000000004EC3000-memory.dmpFilesize
1.3MB
-
memory/2072-31-0x00000000002C0000-0x00000000002D4000-memory.dmpFilesize
80KB
-
memory/2072-35-0x0000000000080000-0x00000000000AA000-memory.dmpFilesize
168KB
-
memory/2072-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2072-26-0x0000000000080000-0x00000000000AA000-memory.dmpFilesize
168KB
-
memory/2072-36-0x0000000000340000-0x0000000000354000-memory.dmpFilesize
80KB
-
memory/2072-29-0x00000000008F0000-0x0000000000BF3000-memory.dmpFilesize
3.0MB
-
memory/2072-30-0x0000000000080000-0x00000000000AA000-memory.dmpFilesize
168KB
-
memory/2072-18-0x0000000000080000-0x00000000000AA000-memory.dmpFilesize
168KB
-
memory/2072-20-0x0000000000080000-0x00000000000AA000-memory.dmpFilesize
168KB
-
memory/2480-15-0x0000000074B90000-0x000000007527E000-memory.dmpFilesize
6.9MB
-
memory/2480-17-0x0000000004A60000-0x0000000004AA0000-memory.dmpFilesize
256KB
-
memory/2480-13-0x0000000074B90000-0x000000007527E000-memory.dmpFilesize
6.9MB
-
memory/2480-28-0x0000000074B90000-0x000000007527E000-memory.dmpFilesize
6.9MB
-
memory/2480-14-0x0000000004A60000-0x0000000004AA0000-memory.dmpFilesize
256KB
-
memory/2480-11-0x0000000000390000-0x000000000040E000-memory.dmpFilesize
504KB