Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 06:58
Static task
static1
Behavioral task
behavioral1
Sample
narudba Rs211-24400.exe
Resource
win7-20231129-en
General
-
Target
narudba Rs211-24400.exe
-
Size
619KB
-
MD5
996f511df3eb434b0c8c8bb2f5ffac86
-
SHA1
61c47ca95118845ed58d0a95861534b2c697e073
-
SHA256
ed70aaa765d3f4e890b381829f6ab14eef928f6fc9bc6207f83dec6695525924
-
SHA512
443152150b99c31c82ef2d74e6a9bbba4b970c4863ed4527b6df299f622705c72a72d0e34f1698227cd463ed77d66322d284f8e650451dc020d2d62b69e04d13
-
SSDEEP
12288:WG2iNlw0Tpi/K61Zp5TIoc2uEj+5Qf+rdu7BrYb0kg4taHk9KnQbJUNkR:h1XLodbpOoci2Q+rdUrYQjHkcQbZ
Malware Config
Extracted
formbook
4.1
dd20
unblurd.com
docu-zign.com
randijpaulsen.com
angsabet.com
sedatelynx.com
opiumcore.store
thelordismysaviormerch.com
mindstudio.support
waterbygraceteam.com
furnitureinspiredbythesea.com
amablanca.com
hespelerdental.com
arcalid.net
balajinursingbureau.online
caixias.shop
solingen-buergerstiftung.com
194916.top
6travel-insurance.xyz
xn--fiqp9b17y.xn--czr694b
syntixi.trade
dataaudit.xyz
judgefever.com
agapornis.pet
sparkasse-banking-service.app
holylandmerch.com
synive.com
knittingbyangela.com
keytorapidweightloss.com
maradesarrollos.store
asherveer.com
kalame.info
khuwezu.top
myfreebd.com
jeepcherokeedeals.xyz
pointschauds.net
narae.xyz
nsivyyu.top
vetlinx360.com
1709frankford.com
checchintrasportilogistica.com
grupoagrarius.com
themasternoi.com
wurdsspeledrong.com
xn--diseafacil-w9a.com
playtoown.shop
butrikl.xyz
amazonpublisherservice.com
belihape.com
ajaysilverpalace.in
geredehanhotel.com
cruises-11028.bond
catering-57592.bond
haloogi.com
compasstransportaion.com
713952.site
downloadfirekirin.xyz
soapcoverr.store
wellnesswomenassociation.com
nortiapro.com
trustedoakllc.info
canadasimnigeria.com
aiappsreviews.com
dct15.com
venenciadorapp.com
fight4yourhappiness.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4480-19-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4480-34-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3056-72-0x00000000004B0000-0x00000000004DF000-memory.dmp formbook behavioral2/memory/3056-74-0x00000000004B0000-0x00000000004DF000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
narudba Rs211-24400.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation narudba Rs211-24400.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
narudba Rs211-24400.exeRegSvcs.exesystray.exedescription pid process target process PID 3040 set thread context of 4480 3040 narudba Rs211-24400.exe RegSvcs.exe PID 4480 set thread context of 3444 4480 RegSvcs.exe Explorer.EXE PID 3056 set thread context of 3444 3056 systray.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
narudba Rs211-24400.exepowershell.exeRegSvcs.exesystray.exepid process 3040 narudba Rs211-24400.exe 3040 narudba Rs211-24400.exe 3040 narudba Rs211-24400.exe 3040 narudba Rs211-24400.exe 2248 powershell.exe 2248 powershell.exe 4480 RegSvcs.exe 4480 RegSvcs.exe 4480 RegSvcs.exe 4480 RegSvcs.exe 4480 RegSvcs.exe 4480 RegSvcs.exe 2248 powershell.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe 3056 systray.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exesystray.exepid process 4480 RegSvcs.exe 4480 RegSvcs.exe 4480 RegSvcs.exe 3056 systray.exe 3056 systray.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
narudba Rs211-24400.exepowershell.exeRegSvcs.exeExplorer.EXEsystray.exedescription pid process Token: SeDebugPrivilege 3040 narudba Rs211-24400.exe Token: SeDebugPrivilege 2248 powershell.exe Token: SeDebugPrivilege 4480 RegSvcs.exe Token: SeShutdownPrivilege 3444 Explorer.EXE Token: SeCreatePagefilePrivilege 3444 Explorer.EXE Token: SeDebugPrivilege 3056 systray.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3444 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
narudba Rs211-24400.exeExplorer.EXEsystray.exedescription pid process target process PID 3040 wrote to memory of 2248 3040 narudba Rs211-24400.exe powershell.exe PID 3040 wrote to memory of 2248 3040 narudba Rs211-24400.exe powershell.exe PID 3040 wrote to memory of 2248 3040 narudba Rs211-24400.exe powershell.exe PID 3040 wrote to memory of 2024 3040 narudba Rs211-24400.exe schtasks.exe PID 3040 wrote to memory of 2024 3040 narudba Rs211-24400.exe schtasks.exe PID 3040 wrote to memory of 2024 3040 narudba Rs211-24400.exe schtasks.exe PID 3040 wrote to memory of 4480 3040 narudba Rs211-24400.exe RegSvcs.exe PID 3040 wrote to memory of 4480 3040 narudba Rs211-24400.exe RegSvcs.exe PID 3040 wrote to memory of 4480 3040 narudba Rs211-24400.exe RegSvcs.exe PID 3040 wrote to memory of 4480 3040 narudba Rs211-24400.exe RegSvcs.exe PID 3040 wrote to memory of 4480 3040 narudba Rs211-24400.exe RegSvcs.exe PID 3040 wrote to memory of 4480 3040 narudba Rs211-24400.exe RegSvcs.exe PID 3444 wrote to memory of 3056 3444 Explorer.EXE systray.exe PID 3444 wrote to memory of 3056 3444 Explorer.EXE systray.exe PID 3444 wrote to memory of 3056 3444 Explorer.EXE systray.exe PID 3056 wrote to memory of 2592 3056 systray.exe cmd.exe PID 3056 wrote to memory of 2592 3056 systray.exe cmd.exe PID 3056 wrote to memory of 2592 3056 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\narudba Rs211-24400.exe"C:\Users\Admin\AppData\Local\Temp\narudba Rs211-24400.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hIHKJIXn.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hIHKJIXn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6C56.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h1azx5p1.pzu.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp6C56.tmpFilesize
1KB
MD56175dd23822c2b1949a4279f0a01ab57
SHA1a3d58930978c4ca3da1456682662eab8ec36f5a0
SHA2569e09a89e56a80ae826c2630634bfab2bd8bd63a25e21b205d0e4497c78370d0d
SHA512888e52f865c622c5e178e1bf2212bbf12a94e855a3657fffd7822bb78569c6a3f315b88b85f9116268ce2b5d8539c78e90e92fd899e59b89d62500fcb12546f1
-
memory/2248-40-0x0000000006820000-0x000000000683E000-memory.dmpFilesize
120KB
-
memory/2248-62-0x0000000007D50000-0x0000000007D61000-memory.dmpFilesize
68KB
-
memory/2248-57-0x0000000007830000-0x00000000078D3000-memory.dmpFilesize
652KB
-
memory/2248-56-0x0000000002F60000-0x0000000002F70000-memory.dmpFilesize
64KB
-
memory/2248-69-0x0000000074EC0000-0x0000000075670000-memory.dmpFilesize
7.7MB
-
memory/2248-65-0x0000000007E90000-0x0000000007EAA000-memory.dmpFilesize
104KB
-
memory/2248-66-0x0000000007E70000-0x0000000007E78000-memory.dmpFilesize
32KB
-
memory/2248-64-0x0000000007D90000-0x0000000007DA4000-memory.dmpFilesize
80KB
-
memory/2248-14-0x0000000002F00000-0x0000000002F36000-memory.dmpFilesize
216KB
-
memory/2248-15-0x0000000074EC0000-0x0000000075670000-memory.dmpFilesize
7.7MB
-
memory/2248-16-0x0000000002F60000-0x0000000002F70000-memory.dmpFilesize
64KB
-
memory/2248-63-0x0000000007D80000-0x0000000007D8E000-memory.dmpFilesize
56KB
-
memory/2248-18-0x0000000005950000-0x0000000005F78000-memory.dmpFilesize
6.2MB
-
memory/2248-55-0x0000000007810000-0x000000000782E000-memory.dmpFilesize
120KB
-
memory/2248-20-0x0000000005860000-0x0000000005882000-memory.dmpFilesize
136KB
-
memory/2248-61-0x0000000007DD0000-0x0000000007E66000-memory.dmpFilesize
600KB
-
memory/2248-60-0x0000000007BC0000-0x0000000007BCA000-memory.dmpFilesize
40KB
-
memory/2248-43-0x0000000006DF0000-0x0000000006E22000-memory.dmpFilesize
200KB
-
memory/2248-58-0x0000000008190000-0x000000000880A000-memory.dmpFilesize
6.5MB
-
memory/2248-59-0x0000000007B50000-0x0000000007B6A000-memory.dmpFilesize
104KB
-
memory/2248-44-0x00000000713B0000-0x00000000713FC000-memory.dmpFilesize
304KB
-
memory/2248-39-0x0000000006380000-0x00000000066D4000-memory.dmpFilesize
3.3MB
-
memory/2248-32-0x0000000006210000-0x0000000006276000-memory.dmpFilesize
408KB
-
memory/2248-30-0x0000000006130000-0x0000000006196000-memory.dmpFilesize
408KB
-
memory/2248-42-0x000000007F6E0000-0x000000007F6F0000-memory.dmpFilesize
64KB
-
memory/2248-41-0x00000000068D0000-0x000000000691C000-memory.dmpFilesize
304KB
-
memory/2248-50-0x0000000002F60000-0x0000000002F70000-memory.dmpFilesize
64KB
-
memory/3040-27-0x0000000074EC0000-0x0000000075670000-memory.dmpFilesize
7.7MB
-
memory/3040-2-0x0000000005AA0000-0x0000000006044000-memory.dmpFilesize
5.6MB
-
memory/3040-4-0x0000000005400000-0x0000000005410000-memory.dmpFilesize
64KB
-
memory/3040-1-0x00000000009D0000-0x0000000000A6C000-memory.dmpFilesize
624KB
-
memory/3040-5-0x00000000054C0000-0x00000000054CA000-memory.dmpFilesize
40KB
-
memory/3040-6-0x00000000056B0000-0x000000000574C000-memory.dmpFilesize
624KB
-
memory/3040-7-0x0000000005690000-0x00000000056A2000-memory.dmpFilesize
72KB
-
memory/3040-8-0x0000000005A60000-0x0000000005A6C000-memory.dmpFilesize
48KB
-
memory/3040-0-0x0000000074EC0000-0x0000000075670000-memory.dmpFilesize
7.7MB
-
memory/3040-3-0x0000000005410000-0x00000000054A2000-memory.dmpFilesize
584KB
-
memory/3040-9-0x0000000006900000-0x0000000006976000-memory.dmpFilesize
472KB
-
memory/3056-73-0x0000000002420000-0x000000000276A000-memory.dmpFilesize
3.3MB
-
memory/3056-76-0x0000000002260000-0x00000000022F4000-memory.dmpFilesize
592KB
-
memory/3056-74-0x00000000004B0000-0x00000000004DF000-memory.dmpFilesize
188KB
-
memory/3056-72-0x00000000004B0000-0x00000000004DF000-memory.dmpFilesize
188KB
-
memory/3056-71-0x0000000000CA0000-0x0000000000CA6000-memory.dmpFilesize
24KB
-
memory/3056-70-0x0000000000CA0000-0x0000000000CA6000-memory.dmpFilesize
24KB
-
memory/3444-31-0x00000000087D0000-0x00000000088BB000-memory.dmpFilesize
940KB
-
memory/3444-77-0x00000000087D0000-0x00000000088BB000-memory.dmpFilesize
940KB
-
memory/3444-79-0x00000000088C0000-0x000000000897C000-memory.dmpFilesize
752KB
-
memory/3444-80-0x00000000088C0000-0x000000000897C000-memory.dmpFilesize
752KB
-
memory/3444-84-0x00000000088C0000-0x000000000897C000-memory.dmpFilesize
752KB
-
memory/4480-33-0x0000000000AD0000-0x0000000000AE5000-memory.dmpFilesize
84KB
-
memory/4480-29-0x0000000000F60000-0x00000000012AA000-memory.dmpFilesize
3.3MB
-
memory/4480-34-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4480-19-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB