Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30-01-2024 01:20
Static task
static1
Behavioral task
behavioral1
Sample
815a024ce875b00b5386479d8b87f37d.exe
Resource
win7-20231215-en
General
-
Target
815a024ce875b00b5386479d8b87f37d.exe
-
Size
483KB
-
MD5
815a024ce875b00b5386479d8b87f37d
-
SHA1
651844bbacefec03cf31ae7ced538cc79ccb5f73
-
SHA256
c57f54cbf52d1476843ee5a25ec2fd67da19d3d65ef9043bda5b725c6702419d
-
SHA512
910911ad4f145027d9d63412ac82dc475508c2b3a61b2eb090f5c98c3fad8f7a62191e4b7ac4139f256eb16b78aa2f04123cf928d15a6d9107850a8f0cd4b581
-
SSDEEP
6144:OIFhuSYWFYgrKsUc3y2WnO1xzcWmZXe2rkwnbo60T21BOcCSrYDEgfje5ig1ef9b:zh8Mz+sv3y2N1xzAZprkmuN/SD5iKef5
Malware Config
Extracted
formbook
3.9
ow
piavecaffe.com
jlxkqg.men
lifesavingfoundation.net
karadasama.net
michaeltraolach-macsweeney.com
thunderwatches.com
serviciocasawhirlpool.biz
c-cap.online
itparksolution.com
clarityhearingkw.com
wpgrosiri.date
colemarshalcambell.com
webperffest.com
adjusterforirma.info
buildersqq.com
spiritualwisdominindia.com
111222333.net
traditionalarabicdishes.com
hmlifi.com
receive-our-info-heredaily.info
whitecoins.info
woodiesrattlers.com
www8458l.com
fifanie.com
xn--qrq721bqkkzt3b.net
mesquiteleaffarm.com
xn--30-yo3c105l5jn.com
imaginaryfair.com
dawnanddusted.com
youeronline.com
alyssabrandonportfolio.com
winhealthalert.info
fithappenseveryday.com
3dreplicant.net
exiaomaipu.com
billsmockupdomain.com
radicalmiddleusa.com
fatblastingsupplements.com
okvidaoapp.com
1024eees.info
gdbaisu.com
soluciones-libres.com
guansaidingzhi.com
francesca-lynagh.com
airbodycare.com
atlutes.com
learningtolaughintherain.com
zology-tek.com
bjlmzk.com
watchinglass.com
belltowerhealthcare.com
gaetvr.men
xn--j7q21wggj81l.net
photos4lyfe.net
paisaghat.com
repairextend.win
lifesciencescareers.com
bazar-199.com
timepieceluxury.com
wizeater.com
itdui.com
johnshookgp.com
lesderniers.com
goodsystemforupdates.review
cybep.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2664-23-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/2664-28-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/1052-33-0x00000000000E0000-0x000000000010A000-memory.dmp formbook behavioral1/memory/1052-39-0x00000000000E0000-0x000000000010A000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
Processes:
syscheck.exesyscheck.exepid process 2140 syscheck.exe 2664 syscheck.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exesyscheck.exepid process 2480 cmd.exe 2140 syscheck.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
syscheck.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\sysnet = "C:\\Users\\Admin\\AppData\\Local\\syscheck.exe -boot" syscheck.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
syscheck.exesyscheck.exewininit.exedescription pid process target process PID 2140 set thread context of 2664 2140 syscheck.exe syscheck.exe PID 2664 set thread context of 1208 2664 syscheck.exe Explorer.EXE PID 1052 set thread context of 1208 1052 wininit.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
syscheck.exewininit.exepid process 2664 syscheck.exe 2664 syscheck.exe 1052 wininit.exe 1052 wininit.exe 1052 wininit.exe 1052 wininit.exe 1052 wininit.exe 1052 wininit.exe 1052 wininit.exe 1052 wininit.exe 1052 wininit.exe 1052 wininit.exe 1052 wininit.exe 1052 wininit.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
syscheck.exewininit.exepid process 2664 syscheck.exe 2664 syscheck.exe 2664 syscheck.exe 1052 wininit.exe 1052 wininit.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
815a024ce875b00b5386479d8b87f37d.exesyscheck.exesyscheck.exewininit.exedescription pid process Token: SeDebugPrivilege 2280 815a024ce875b00b5386479d8b87f37d.exe Token: SeDebugPrivilege 2140 syscheck.exe Token: SeDebugPrivilege 2664 syscheck.exe Token: SeDebugPrivilege 1052 wininit.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
815a024ce875b00b5386479d8b87f37d.execmd.exesyscheck.exeExplorer.EXEwininit.exedescription pid process target process PID 2280 wrote to memory of 2764 2280 815a024ce875b00b5386479d8b87f37d.exe cmd.exe PID 2280 wrote to memory of 2764 2280 815a024ce875b00b5386479d8b87f37d.exe cmd.exe PID 2280 wrote to memory of 2764 2280 815a024ce875b00b5386479d8b87f37d.exe cmd.exe PID 2280 wrote to memory of 2764 2280 815a024ce875b00b5386479d8b87f37d.exe cmd.exe PID 2280 wrote to memory of 2480 2280 815a024ce875b00b5386479d8b87f37d.exe cmd.exe PID 2280 wrote to memory of 2480 2280 815a024ce875b00b5386479d8b87f37d.exe cmd.exe PID 2280 wrote to memory of 2480 2280 815a024ce875b00b5386479d8b87f37d.exe cmd.exe PID 2280 wrote to memory of 2480 2280 815a024ce875b00b5386479d8b87f37d.exe cmd.exe PID 2480 wrote to memory of 2140 2480 cmd.exe syscheck.exe PID 2480 wrote to memory of 2140 2480 cmd.exe syscheck.exe PID 2480 wrote to memory of 2140 2480 cmd.exe syscheck.exe PID 2480 wrote to memory of 2140 2480 cmd.exe syscheck.exe PID 2140 wrote to memory of 2664 2140 syscheck.exe syscheck.exe PID 2140 wrote to memory of 2664 2140 syscheck.exe syscheck.exe PID 2140 wrote to memory of 2664 2140 syscheck.exe syscheck.exe PID 2140 wrote to memory of 2664 2140 syscheck.exe syscheck.exe PID 2140 wrote to memory of 2664 2140 syscheck.exe syscheck.exe PID 2140 wrote to memory of 2664 2140 syscheck.exe syscheck.exe PID 2140 wrote to memory of 2664 2140 syscheck.exe syscheck.exe PID 1208 wrote to memory of 1052 1208 Explorer.EXE wininit.exe PID 1208 wrote to memory of 1052 1208 Explorer.EXE wininit.exe PID 1208 wrote to memory of 1052 1208 Explorer.EXE wininit.exe PID 1208 wrote to memory of 1052 1208 Explorer.EXE wininit.exe PID 1052 wrote to memory of 1320 1052 wininit.exe cmd.exe PID 1052 wrote to memory of 1320 1052 wininit.exe cmd.exe PID 1052 wrote to memory of 1320 1052 wininit.exe cmd.exe PID 1052 wrote to memory of 1320 1052 wininit.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\815a024ce875b00b5386479d8b87f37d.exe"C:\Users\Admin\AppData\Local\Temp\815a024ce875b00b5386479d8b87f37d.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\815a024ce875b00b5386479d8b87f37d.exe" "C:\Users\Admin\AppData\Local\syscheck.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\syscheck.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\syscheck.exe"C:\Users\Admin\AppData\Local\syscheck.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\syscheck.exe"C:\Users\Admin\AppData\Local\syscheck.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\syscheck.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\syscheck.exeFilesize
483KB
MD5815a024ce875b00b5386479d8b87f37d
SHA1651844bbacefec03cf31ae7ced538cc79ccb5f73
SHA256c57f54cbf52d1476843ee5a25ec2fd67da19d3d65ef9043bda5b725c6702419d
SHA512910911ad4f145027d9d63412ac82dc475508c2b3a61b2eb090f5c98c3fad8f7a62191e4b7ac4139f256eb16b78aa2f04123cf928d15a6d9107850a8f0cd4b581
-
memory/1052-31-0x0000000000030000-0x000000000004A000-memory.dmpFilesize
104KB
-
memory/1052-32-0x0000000000030000-0x000000000004A000-memory.dmpFilesize
104KB
-
memory/1052-33-0x00000000000E0000-0x000000000010A000-memory.dmpFilesize
168KB
-
memory/1052-34-0x0000000001E20000-0x0000000002123000-memory.dmpFilesize
3.0MB
-
memory/1052-36-0x0000000001C40000-0x0000000001CD3000-memory.dmpFilesize
588KB
-
memory/1052-39-0x00000000000E0000-0x000000000010A000-memory.dmpFilesize
168KB
-
memory/1208-30-0x0000000004B70000-0x0000000004C54000-memory.dmpFilesize
912KB
-
memory/1208-37-0x0000000004B70000-0x0000000004C54000-memory.dmpFilesize
912KB
-
memory/2140-13-0x0000000074220000-0x000000007490E000-memory.dmpFilesize
6.9MB
-
memory/2140-14-0x00000000048C0000-0x0000000004900000-memory.dmpFilesize
256KB
-
memory/2140-15-0x0000000074220000-0x000000007490E000-memory.dmpFilesize
6.9MB
-
memory/2140-16-0x00000000048C0000-0x0000000004900000-memory.dmpFilesize
256KB
-
memory/2140-18-0x00000000048C0000-0x0000000004900000-memory.dmpFilesize
256KB
-
memory/2140-25-0x0000000074220000-0x000000007490E000-memory.dmpFilesize
6.9MB
-
memory/2140-12-0x0000000000E50000-0x0000000000ECE000-memory.dmpFilesize
504KB
-
memory/2280-11-0x0000000074220000-0x000000007490E000-memory.dmpFilesize
6.9MB
-
memory/2280-7-0x0000000004C00000-0x0000000004C40000-memory.dmpFilesize
256KB
-
memory/2280-0-0x0000000001080000-0x00000000010FE000-memory.dmpFilesize
504KB
-
memory/2280-6-0x0000000074220000-0x000000007490E000-memory.dmpFilesize
6.9MB
-
memory/2280-3-0x0000000004C00000-0x0000000004C40000-memory.dmpFilesize
256KB
-
memory/2280-2-0x0000000000330000-0x000000000034C000-memory.dmpFilesize
112KB
-
memory/2280-1-0x0000000074220000-0x000000007490E000-memory.dmpFilesize
6.9MB
-
memory/2664-19-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2664-29-0x0000000000140000-0x0000000000154000-memory.dmpFilesize
80KB
-
memory/2664-28-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2664-26-0x0000000000950000-0x0000000000C53000-memory.dmpFilesize
3.0MB
-
memory/2664-23-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2664-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2664-20-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB