Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
25-03-2024 16:26
Static task
static1
Behavioral task
behavioral1
Sample
GSO3357.exe
Resource
win7-20240215-en
General
-
Target
GSO3357.exe
-
Size
654KB
-
MD5
c77b45b902fb66b1bda25f0c9f32c152
-
SHA1
e17705713ede18731797bbfd7b5eb31a7ca52477
-
SHA256
d56e9061e7f6df6e094d1582d817c381f8ce9ac6c3925cba5da96464487a18b7
-
SHA512
61af84f112b704230a8f07ead38678e2e3052f55a86e8e7c8b480be2a0da03546801d03d328e663a6ba284ded71bba22bac3caf8365848b2e3e8abf8dfb2d348
-
SSDEEP
12288:Td4CMwtBBGV/8nu3JKhuL3RlcYgbXvApn76bUtaj6b0jZEgVzvF7B5P9ylA:FBJu3FLBlcYEXvApn76bJ3tEAzvNDP4
Malware Config
Extracted
formbook
4.1
hy07
katemclaughl.in
worthyofficial.com
digitopia.click
ledmee.com
siwaasnz.life
ba-y.com
specifiedbuild.com
abandoned-houses-pt-0.bond
yesxoit.xyz
onlinemehrgeld.com
gosysamergoods.com
speakdontell.com
brokenequipmentsolutions.online
gruppofebi.cloud
adilosk.shop
supplierpartnerportal.com
wizov.dev
fast-homeinsurance.com
j88.vote
onamaevn.com
smartbatteryshunt.com
alivo-solutions-inc.net
qdcn16qy.shop
enmawholesale.com
experiencemedia.xyz
shoeloyalty.com
wylderosehealingarts.com
m-1263bets10.com
blanks.page
postcase.site
guangxiav.com
vitlrecruiting.info
go-re.one
rutie.net
donielss.com
hitwin.world
poshplaybliss.com
used-cars-25479.bond
riadanil.com
evrenfayans.xyz
cleopatraselixirs.com
beyondcarbon.xyz
pornimmersion.site
f8serial.site
theoriginals.farm
pvindustriesbv.com
santofantasy.shop
gosignkochava.com
akabox.net
valentinesteddyshop.com
closedealsin90days.com
goodsharbor.com
cbdmarkettrends.com
theartsincarter.com
massivedgeagency.website
totthoit.com
o0qqj7jm.shop
morningcallcoffeestandnola.com
51236.loan
omniahorizon.shop
hellasicks.com
soundbiscuitmusic.net
racerace2024.com
9yywk4.site
de-cosmeticenhancement.today
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2612-19-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2612-25-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2612-35-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2692-40-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook behavioral1/memory/2692-42-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1216 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
GSO3357.exeGSO3357.exemstsc.exedescription pid process target process PID 1776 set thread context of 2612 1776 GSO3357.exe GSO3357.exe PID 2612 set thread context of 1184 2612 GSO3357.exe Explorer.EXE PID 2612 set thread context of 1184 2612 GSO3357.exe Explorer.EXE PID 2692 set thread context of 1184 2692 mstsc.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
GSO3357.exeGSO3357.exepowershell.exemstsc.exepid process 1776 GSO3357.exe 1776 GSO3357.exe 2612 GSO3357.exe 2612 GSO3357.exe 2504 powershell.exe 2612 GSO3357.exe 2692 mstsc.exe 2692 mstsc.exe 2692 mstsc.exe 2692 mstsc.exe 2692 mstsc.exe 2692 mstsc.exe 2692 mstsc.exe 2692 mstsc.exe 2692 mstsc.exe 2692 mstsc.exe 2692 mstsc.exe 2692 mstsc.exe 2692 mstsc.exe 2692 mstsc.exe 2692 mstsc.exe 2692 mstsc.exe 2692 mstsc.exe 2692 mstsc.exe 2692 mstsc.exe 2692 mstsc.exe 2692 mstsc.exe 2692 mstsc.exe 2692 mstsc.exe 2692 mstsc.exe 2692 mstsc.exe 2692 mstsc.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
GSO3357.exemstsc.exepid process 2612 GSO3357.exe 2612 GSO3357.exe 2612 GSO3357.exe 2612 GSO3357.exe 2692 mstsc.exe 2692 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
GSO3357.exeGSO3357.exepowershell.exemstsc.exedescription pid process Token: SeDebugPrivilege 1776 GSO3357.exe Token: SeDebugPrivilege 2612 GSO3357.exe Token: SeDebugPrivilege 2504 powershell.exe Token: SeDebugPrivilege 2692 mstsc.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
GSO3357.exeExplorer.EXEmstsc.exedescription pid process target process PID 1776 wrote to memory of 2504 1776 GSO3357.exe powershell.exe PID 1776 wrote to memory of 2504 1776 GSO3357.exe powershell.exe PID 1776 wrote to memory of 2504 1776 GSO3357.exe powershell.exe PID 1776 wrote to memory of 2504 1776 GSO3357.exe powershell.exe PID 1776 wrote to memory of 2596 1776 GSO3357.exe schtasks.exe PID 1776 wrote to memory of 2596 1776 GSO3357.exe schtasks.exe PID 1776 wrote to memory of 2596 1776 GSO3357.exe schtasks.exe PID 1776 wrote to memory of 2596 1776 GSO3357.exe schtasks.exe PID 1776 wrote to memory of 2712 1776 GSO3357.exe GSO3357.exe PID 1776 wrote to memory of 2712 1776 GSO3357.exe GSO3357.exe PID 1776 wrote to memory of 2712 1776 GSO3357.exe GSO3357.exe PID 1776 wrote to memory of 2712 1776 GSO3357.exe GSO3357.exe PID 1776 wrote to memory of 2612 1776 GSO3357.exe GSO3357.exe PID 1776 wrote to memory of 2612 1776 GSO3357.exe GSO3357.exe PID 1776 wrote to memory of 2612 1776 GSO3357.exe GSO3357.exe PID 1776 wrote to memory of 2612 1776 GSO3357.exe GSO3357.exe PID 1776 wrote to memory of 2612 1776 GSO3357.exe GSO3357.exe PID 1776 wrote to memory of 2612 1776 GSO3357.exe GSO3357.exe PID 1776 wrote to memory of 2612 1776 GSO3357.exe GSO3357.exe PID 1184 wrote to memory of 2692 1184 Explorer.EXE mstsc.exe PID 1184 wrote to memory of 2692 1184 Explorer.EXE mstsc.exe PID 1184 wrote to memory of 2692 1184 Explorer.EXE mstsc.exe PID 1184 wrote to memory of 2692 1184 Explorer.EXE mstsc.exe PID 2692 wrote to memory of 1216 2692 mstsc.exe cmd.exe PID 2692 wrote to memory of 1216 2692 mstsc.exe cmd.exe PID 2692 wrote to memory of 1216 2692 mstsc.exe cmd.exe PID 2692 wrote to memory of 1216 2692 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GSO3357.exe"C:\Users\Admin\AppData\Local\Temp\GSO3357.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ozCkrZdsJL.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ozCkrZdsJL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3C84.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\GSO3357.exe"C:\Users\Admin\AppData\Local\Temp\GSO3357.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\GSO3357.exe"C:\Users\Admin\AppData\Local\Temp\GSO3357.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\GSO3357.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3C84.tmpFilesize
1KB
MD563c1d3d78487e9235b4aec6432b7f11b
SHA1b0ad03e09798f1fbfb97aeba2c47980832632c34
SHA256b787a326de8356fe638c99323ce3a94ece90650e3e44641f4943ec66f4439f50
SHA51220c24ea2ad8a8b5a3725b3ff6cdc6b908744c9bc56b35e4d033845bc46996f6091f66c4d96cedb8c805f7f415d167af2b548e0b252514b87b494aa79767d1f94
-
memory/1184-28-0x0000000006730000-0x0000000006894000-memory.dmpFilesize
1.4MB
-
memory/1184-22-0x0000000003C20000-0x0000000003D20000-memory.dmpFilesize
1024KB
-
memory/1184-37-0x0000000004CE0000-0x0000000004E4F000-memory.dmpFilesize
1.4MB
-
memory/1184-46-0x0000000004CE0000-0x0000000004E4F000-memory.dmpFilesize
1.4MB
-
memory/1776-4-0x00000000005B0000-0x00000000005BC000-memory.dmpFilesize
48KB
-
memory/1776-5-0x0000000004610000-0x0000000004686000-memory.dmpFilesize
472KB
-
memory/1776-0-0x0000000000A50000-0x0000000000AF8000-memory.dmpFilesize
672KB
-
memory/1776-3-0x0000000000490000-0x00000000004A2000-memory.dmpFilesize
72KB
-
memory/1776-20-0x00000000747B0000-0x0000000074E9E000-memory.dmpFilesize
6.9MB
-
memory/1776-2-0x0000000004C20000-0x0000000004C60000-memory.dmpFilesize
256KB
-
memory/1776-1-0x00000000747B0000-0x0000000074E9E000-memory.dmpFilesize
6.9MB
-
memory/2504-31-0x000000006EB80000-0x000000006F12B000-memory.dmpFilesize
5.7MB
-
memory/2504-32-0x000000006EB80000-0x000000006F12B000-memory.dmpFilesize
5.7MB
-
memory/2504-23-0x000000006EB80000-0x000000006F12B000-memory.dmpFilesize
5.7MB
-
memory/2504-27-0x0000000002A60000-0x0000000002AA0000-memory.dmpFilesize
256KB
-
memory/2504-29-0x0000000002A60000-0x0000000002AA0000-memory.dmpFilesize
256KB
-
memory/2504-24-0x0000000002A60000-0x0000000002AA0000-memory.dmpFilesize
256KB
-
memory/2612-15-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2612-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2612-25-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2612-26-0x0000000000190000-0x00000000001A4000-memory.dmpFilesize
80KB
-
memory/2612-19-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2612-36-0x00000000003B0000-0x00000000003C4000-memory.dmpFilesize
80KB
-
memory/2612-35-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2612-30-0x0000000000B00000-0x0000000000E03000-memory.dmpFilesize
3.0MB
-
memory/2612-13-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2692-39-0x0000000000120000-0x0000000000224000-memory.dmpFilesize
1.0MB
-
memory/2692-40-0x00000000000C0000-0x00000000000EF000-memory.dmpFilesize
188KB
-
memory/2692-41-0x0000000002260000-0x0000000002563000-memory.dmpFilesize
3.0MB
-
memory/2692-42-0x00000000000C0000-0x00000000000EF000-memory.dmpFilesize
188KB
-
memory/2692-44-0x00000000021C0000-0x0000000002253000-memory.dmpFilesize
588KB
-
memory/2692-38-0x0000000000120000-0x0000000000224000-memory.dmpFilesize
1.0MB