Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 01:26
Static task
static1
Behavioral task
behavioral1
Sample
b123.exe
Resource
win7-20231129-en
General
-
Target
b123.exe
-
Size
227KB
-
MD5
b3104364708fa64e5242cbe54885ec56
-
SHA1
4be2064313b2f72e472b8a81797e7b14a5b3aec8
-
SHA256
f4abecbd1a56abc36103d0595086bfd31c50f33236b9431b53860e5c1e20c2a7
-
SHA512
2aa6da2a189de20c9ce5d919fc6fe8e5f050151721cf496fa93f8862dcb6775d1b5f90b5666fb01659265721b81ed788e4b938961d8166d0c09245f75f8d2591
-
SSDEEP
6144:2wVqCOiGWu2dw9r6bDo78j+JEwh3pc8aMxfcPbwoP:2KyWhw9x8spc7MiPbwoP
Malware Config
Extracted
formbook
4.1
lt0h
originalindigofurniture.co.uk
fl6588.com
acecademy.com
yaerofinerindalnalising.com
mendilovic.online
rishenght.com
famlees.com
myhomeofficemarket.com
bouquetarabia.com
chrisbani.com
freebandslegally.com
hernandezinsurancegroup.net
slicedandfresh.com
apnathikanas.com
chadhatesyou.com
ansilsas.com
in3development.com
nitiren.net
peespn.com
valengz.com
theseakelpcompany.com
tlcrentny.com
sancakcraft.com
kamenb.com
samanthajobenson.com
alphagearz.com
sprins.net
adestramentos.com
civoconstruction.com
masrmasr.com
jagrit.codes
zusammenurlaub.com
mssjqs.com
ic695niu001.com
anelimplus.com
mutlob.com
beyondmickey.net
sliever.club
perfumefashion.icu
massimilianogiannocco.com
dentoncountyattorneys.media
filigreefilly.com
mooremgmtandcompany.com
smpdj.com
stainlesspropmgmt.com
creativecollectivecommunity.com
dmdrogist.com
spokenandheardpodcast.com
garenbid.com
bestcomandcalls.space
tairunshihua.com
nemski-projekt.com
6mum.com
portlandhemorrhoidcenter.com
platinumforsale.net
driven.plus
ontheedgeoutdoorshunting.com
manatapmasalalu.com
idscustomprinting.com
safepassagereform.com
fairop.xyz
natetacticz.com
etoys-sucks.com
rhinolabs.net
bulverderoofing.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3312-2-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3312-5-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2220-11-0x00000000008F0000-0x000000000091E000-memory.dmp formbook behavioral2/memory/2220-17-0x00000000008F0000-0x000000000091E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
b123.exeb123.exeWWAHost.exedescription pid process target process PID 5084 set thread context of 3312 5084 b123.exe b123.exe PID 3312 set thread context of 3492 3312 b123.exe Explorer.EXE PID 2220 set thread context of 3492 2220 WWAHost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
b123.exeWWAHost.exepid process 3312 b123.exe 3312 b123.exe 3312 b123.exe 3312 b123.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe 2220 WWAHost.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
b123.exeb123.exeWWAHost.exepid process 5084 b123.exe 3312 b123.exe 3312 b123.exe 3312 b123.exe 2220 WWAHost.exe 2220 WWAHost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
b123.exeWWAHost.exedescription pid process Token: SeDebugPrivilege 3312 b123.exe Token: SeDebugPrivilege 2220 WWAHost.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
b123.exeExplorer.EXEWWAHost.exedescription pid process target process PID 5084 wrote to memory of 3312 5084 b123.exe b123.exe PID 5084 wrote to memory of 3312 5084 b123.exe b123.exe PID 5084 wrote to memory of 3312 5084 b123.exe b123.exe PID 5084 wrote to memory of 3312 5084 b123.exe b123.exe PID 3492 wrote to memory of 2220 3492 Explorer.EXE WWAHost.exe PID 3492 wrote to memory of 2220 3492 Explorer.EXE WWAHost.exe PID 3492 wrote to memory of 2220 3492 Explorer.EXE WWAHost.exe PID 2220 wrote to memory of 5068 2220 WWAHost.exe cmd.exe PID 2220 wrote to memory of 5068 2220 WWAHost.exe cmd.exe PID 2220 wrote to memory of 5068 2220 WWAHost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b123.exe"C:\Users\Admin\AppData\Local\Temp\b123.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b123.exe"C:\Users\Admin\AppData\Local\Temp\b123.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\b123.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2220-8-0x0000000000410000-0x00000000004EC000-memory.dmpFilesize
880KB
-
memory/2220-17-0x00000000008F0000-0x000000000091E000-memory.dmpFilesize
184KB
-
memory/2220-14-0x00000000018C0000-0x0000000001953000-memory.dmpFilesize
588KB
-
memory/2220-12-0x0000000001B20000-0x0000000001E6A000-memory.dmpFilesize
3.3MB
-
memory/2220-11-0x00000000008F0000-0x000000000091E000-memory.dmpFilesize
184KB
-
memory/2220-10-0x0000000000410000-0x00000000004EC000-memory.dmpFilesize
880KB
-
memory/3312-6-0x0000000001950000-0x0000000001964000-memory.dmpFilesize
80KB
-
memory/3312-5-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3312-3-0x00000000014E0000-0x000000000182A000-memory.dmpFilesize
3.3MB
-
memory/3312-2-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3492-7-0x0000000008D60000-0x0000000008E7C000-memory.dmpFilesize
1.1MB
-
memory/3492-15-0x0000000008D60000-0x0000000008E7C000-memory.dmpFilesize
1.1MB
-
memory/3492-18-0x0000000008F00000-0x000000000902B000-memory.dmpFilesize
1.2MB
-
memory/3492-20-0x0000000008F00000-0x000000000902B000-memory.dmpFilesize
1.2MB
-
memory/3492-23-0x0000000008F00000-0x000000000902B000-memory.dmpFilesize
1.2MB
-
memory/5084-0-0x00000000000C0000-0x00000000000C6000-memory.dmpFilesize
24KB
-
memory/5084-1-0x0000000002B40000-0x0000000002B42000-memory.dmpFilesize
8KB