Analysis
-
max time kernel
119s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-02-2024 09:26
Static task
static1
Behavioral task
behavioral1
Sample
a8cdc1904d40b6c05f524e28ffd07b17.exe
Resource
win7-20240221-en
General
-
Target
a8cdc1904d40b6c05f524e28ffd07b17.exe
-
Size
929KB
-
MD5
a8cdc1904d40b6c05f524e28ffd07b17
-
SHA1
d3d25d3af86dd23455f07db403f834ced7fee739
-
SHA256
7240d57a675a066d7dcb095a520ec2b86c2460080ccfbc759a9d404dec7d3817
-
SHA512
d6c82402cdd3209687aa2fccbef7f89bb54d72ff1d796dd8ed30be054d63c7de5fde81efee33396375dcca33ce20db6c0a0e61372de4738f49b82d2a61f63026
-
SSDEEP
12288:GGoeHoGSP9Q3XR+6yXt2WKK8yp2M1z6H5d89wBuaHHK7zEzKboDxeF:hoeDSP9Q3XRmf8yp9Ad89ws2KboM
Malware Config
Extracted
formbook
4.1
mxwf
orders-cialis.info
auctionorbuy.com
meanmugsamore.com
yachtcrewmark.com
sacredkashilifestudio.net
themintyard.com
bragafoods.com
sierp.com
hausofdeme.com
anthonyjames915.com
bajardepesoencasa.com
marciaroyal.com
earringlifter.com
dsdjfhd9ddksa1as.info
bmzproekt.com
employmentbc.com
ptsdtreatment.space
vrchance.com
cnrongding.com
welovelit.com
intercourierdelivery.services
ianwhitewrite.com
afcerd.com
beneficiodemedicare.com
gatel3ess.com
salesnksportswt.top
thewellnessloft365.com
totensa.com
jessicatheisen.com
snowtographers.com
executrainpr.com
puttypaw.com
popcorntimeipad.com
heyconi.com
llanoresources.com
ibusinesshero.com
1euro1ad.com
sparkleeapp.com
zhuxiugyh.com
calvinmaphoto.com
bjmaomao.com
isaacfujiki.com
zipwhipper.com
kontrollstutzen.com
hannaheason.media
zgcbw.net
letteringdagabi.com
kitefabrics.com
andherieastoffices.com
thewellnesstravelcompany.info
ohio.works
beacharita.com
alphamillls.com
sassandvinegar.com
usauber.com
ceylonherbslk.com
richardggreenhill.com
groupdae.com
jupiterccc.com
indoovo.com
sunnytheodora.com
gxpgfz.com
shoppandaxpress.com
heiboard.com
zahnimplantatangebotede.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3088-13-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a8cdc1904d40b6c05f524e28ffd07b17.exedescription pid process target process PID 4960 set thread context of 3088 4960 a8cdc1904d40b6c05f524e28ffd07b17.exe a8cdc1904d40b6c05f524e28ffd07b17.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a8cdc1904d40b6c05f524e28ffd07b17.exepid process 3088 a8cdc1904d40b6c05f524e28ffd07b17.exe 3088 a8cdc1904d40b6c05f524e28ffd07b17.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
a8cdc1904d40b6c05f524e28ffd07b17.exedescription pid process target process PID 4960 wrote to memory of 3088 4960 a8cdc1904d40b6c05f524e28ffd07b17.exe a8cdc1904d40b6c05f524e28ffd07b17.exe PID 4960 wrote to memory of 3088 4960 a8cdc1904d40b6c05f524e28ffd07b17.exe a8cdc1904d40b6c05f524e28ffd07b17.exe PID 4960 wrote to memory of 3088 4960 a8cdc1904d40b6c05f524e28ffd07b17.exe a8cdc1904d40b6c05f524e28ffd07b17.exe PID 4960 wrote to memory of 3088 4960 a8cdc1904d40b6c05f524e28ffd07b17.exe a8cdc1904d40b6c05f524e28ffd07b17.exe PID 4960 wrote to memory of 3088 4960 a8cdc1904d40b6c05f524e28ffd07b17.exe a8cdc1904d40b6c05f524e28ffd07b17.exe PID 4960 wrote to memory of 3088 4960 a8cdc1904d40b6c05f524e28ffd07b17.exe a8cdc1904d40b6c05f524e28ffd07b17.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8cdc1904d40b6c05f524e28ffd07b17.exe"C:\Users\Admin\AppData\Local\Temp\a8cdc1904d40b6c05f524e28ffd07b17.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a8cdc1904d40b6c05f524e28ffd07b17.exe"C:\Users\Admin\AppData\Local\Temp\a8cdc1904d40b6c05f524e28ffd07b17.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3912 --field-trial-handle=3084,i,11997299123381683778,5904351605020331957,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3088-13-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3088-16-0x0000000001140000-0x000000000148A000-memory.dmpFilesize
3.3MB
-
memory/4960-8-0x00000000056F0000-0x0000000005706000-memory.dmpFilesize
88KB
-
memory/4960-9-0x0000000074580000-0x0000000074D30000-memory.dmpFilesize
7.7MB
-
memory/4960-4-0x00000000052E0000-0x0000000005372000-memory.dmpFilesize
584KB
-
memory/4960-5-0x0000000005530000-0x0000000005540000-memory.dmpFilesize
64KB
-
memory/4960-6-0x00000000052A0000-0x00000000052AA000-memory.dmpFilesize
40KB
-
memory/4960-7-0x00000000054D0000-0x0000000005526000-memory.dmpFilesize
344KB
-
memory/4960-1-0x0000000000720000-0x000000000080E000-memory.dmpFilesize
952KB
-
memory/4960-3-0x00000000057F0000-0x0000000005D94000-memory.dmpFilesize
5.6MB
-
memory/4960-10-0x0000000005530000-0x0000000005540000-memory.dmpFilesize
64KB
-
memory/4960-11-0x00000000068D0000-0x0000000006972000-memory.dmpFilesize
648KB
-
memory/4960-12-0x0000000006970000-0x00000000069A4000-memory.dmpFilesize
208KB
-
memory/4960-2-0x00000000051A0000-0x000000000523C000-memory.dmpFilesize
624KB
-
memory/4960-15-0x0000000074580000-0x0000000074D30000-memory.dmpFilesize
7.7MB
-
memory/4960-0-0x0000000074580000-0x0000000074D30000-memory.dmpFilesize
7.7MB