Analysis
-
max time kernel
140s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 12:34
Static task
static1
Behavioral task
behavioral1
Sample
e1ad89d88c9ffed81a10e3b2e7a323c1.exe
Resource
win7-20240221-en
General
-
Target
e1ad89d88c9ffed81a10e3b2e7a323c1.exe
-
Size
746KB
-
MD5
e1ad89d88c9ffed81a10e3b2e7a323c1
-
SHA1
0888d6bb8344a647f353ac70ed5737e99bc613d5
-
SHA256
34ff91c0be47c6edae673081f4814ca9b7432d6db4975ab66a911f36fe481d70
-
SHA512
ac99f3dc6e5e63063203fbb0a948b17c69c5709aa7e46b6406c0df4a6693eb7cab099f6085e62980f43aa1113d1f9cb9f77fb36e4fa80c86a81ea9629b15b899
-
SSDEEP
12288:WaM+DkFpOdNfVhMkRVuWYfCdEG8dR8BwSDVoB1kAJR0OpROdt2NjFO:/DMOdNf8CdEGPmcoB1zodMNj0
Malware Config
Extracted
formbook
4.1
mxwf
orders-cialis.info
auctionorbuy.com
meanmugsamore.com
yachtcrewmark.com
sacredkashilifestudio.net
themintyard.com
bragafoods.com
sierp.com
hausofdeme.com
anthonyjames915.com
bajardepesoencasa.com
marciaroyal.com
earringlifter.com
dsdjfhd9ddksa1as.info
bmzproekt.com
employmentbc.com
ptsdtreatment.space
vrchance.com
cnrongding.com
welovelit.com
intercourierdelivery.services
ianwhitewrite.com
afcerd.com
beneficiodemedicare.com
gatel3ess.com
salesnksportswt.top
thewellnessloft365.com
totensa.com
jessicatheisen.com
snowtographers.com
executrainpr.com
puttypaw.com
popcorntimeipad.com
heyconi.com
llanoresources.com
ibusinesshero.com
1euro1ad.com
sparkleeapp.com
zhuxiugyh.com
calvinmaphoto.com
bjmaomao.com
isaacfujiki.com
zipwhipper.com
kontrollstutzen.com
hannaheason.media
zgcbw.net
letteringdagabi.com
kitefabrics.com
andherieastoffices.com
thewellnesstravelcompany.info
ohio.works
beacharita.com
alphamillls.com
sassandvinegar.com
usauber.com
ceylonherbslk.com
richardggreenhill.com
groupdae.com
jupiterccc.com
indoovo.com
sunnytheodora.com
gxpgfz.com
shoppandaxpress.com
heiboard.com
zahnimplantatangebotede.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3884-12-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e1ad89d88c9ffed81a10e3b2e7a323c1.exedescription pid process target process PID 228 set thread context of 3884 228 e1ad89d88c9ffed81a10e3b2e7a323c1.exe e1ad89d88c9ffed81a10e3b2e7a323c1.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
e1ad89d88c9ffed81a10e3b2e7a323c1.exee1ad89d88c9ffed81a10e3b2e7a323c1.exepid process 228 e1ad89d88c9ffed81a10e3b2e7a323c1.exe 228 e1ad89d88c9ffed81a10e3b2e7a323c1.exe 3884 e1ad89d88c9ffed81a10e3b2e7a323c1.exe 3884 e1ad89d88c9ffed81a10e3b2e7a323c1.exe 3884 e1ad89d88c9ffed81a10e3b2e7a323c1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e1ad89d88c9ffed81a10e3b2e7a323c1.exedescription pid process Token: SeDebugPrivilege 228 e1ad89d88c9ffed81a10e3b2e7a323c1.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
e1ad89d88c9ffed81a10e3b2e7a323c1.exedescription pid process target process PID 228 wrote to memory of 452 228 e1ad89d88c9ffed81a10e3b2e7a323c1.exe e1ad89d88c9ffed81a10e3b2e7a323c1.exe PID 228 wrote to memory of 452 228 e1ad89d88c9ffed81a10e3b2e7a323c1.exe e1ad89d88c9ffed81a10e3b2e7a323c1.exe PID 228 wrote to memory of 452 228 e1ad89d88c9ffed81a10e3b2e7a323c1.exe e1ad89d88c9ffed81a10e3b2e7a323c1.exe PID 228 wrote to memory of 3884 228 e1ad89d88c9ffed81a10e3b2e7a323c1.exe e1ad89d88c9ffed81a10e3b2e7a323c1.exe PID 228 wrote to memory of 3884 228 e1ad89d88c9ffed81a10e3b2e7a323c1.exe e1ad89d88c9ffed81a10e3b2e7a323c1.exe PID 228 wrote to memory of 3884 228 e1ad89d88c9ffed81a10e3b2e7a323c1.exe e1ad89d88c9ffed81a10e3b2e7a323c1.exe PID 228 wrote to memory of 3884 228 e1ad89d88c9ffed81a10e3b2e7a323c1.exe e1ad89d88c9ffed81a10e3b2e7a323c1.exe PID 228 wrote to memory of 3884 228 e1ad89d88c9ffed81a10e3b2e7a323c1.exe e1ad89d88c9ffed81a10e3b2e7a323c1.exe PID 228 wrote to memory of 3884 228 e1ad89d88c9ffed81a10e3b2e7a323c1.exe e1ad89d88c9ffed81a10e3b2e7a323c1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1ad89d88c9ffed81a10e3b2e7a323c1.exe"C:\Users\Admin\AppData\Local\Temp\e1ad89d88c9ffed81a10e3b2e7a323c1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e1ad89d88c9ffed81a10e3b2e7a323c1.exe"C:\Users\Admin\AppData\Local\Temp\e1ad89d88c9ffed81a10e3b2e7a323c1.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\e1ad89d88c9ffed81a10e3b2e7a323c1.exe"C:\Users\Admin\AppData\Local\Temp\e1ad89d88c9ffed81a10e3b2e7a323c1.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4172 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/228-6-0x00000000067F0000-0x000000000688C000-memory.dmpFilesize
624KB
-
memory/228-8-0x0000000075290000-0x0000000075A40000-memory.dmpFilesize
7.7MB
-
memory/228-2-0x0000000005BA0000-0x0000000006144000-memory.dmpFilesize
5.6MB
-
memory/228-3-0x0000000005500000-0x0000000005592000-memory.dmpFilesize
584KB
-
memory/228-4-0x00000000057B0000-0x00000000057C0000-memory.dmpFilesize
64KB
-
memory/228-5-0x00000000055A0000-0x00000000055AA000-memory.dmpFilesize
40KB
-
memory/228-1-0x0000000000A50000-0x0000000000B10000-memory.dmpFilesize
768KB
-
memory/228-7-0x00000000058C0000-0x00000000058DA000-memory.dmpFilesize
104KB
-
memory/228-0-0x0000000075290000-0x0000000075A40000-memory.dmpFilesize
7.7MB
-
memory/228-9-0x00000000057B0000-0x00000000057C0000-memory.dmpFilesize
64KB
-
memory/228-10-0x0000000007000000-0x00000000070A4000-memory.dmpFilesize
656KB
-
memory/228-11-0x0000000006E00000-0x0000000006E34000-memory.dmpFilesize
208KB
-
memory/228-14-0x0000000075290000-0x0000000075A40000-memory.dmpFilesize
7.7MB
-
memory/3884-12-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3884-15-0x0000000001740000-0x0000000001A8A000-memory.dmpFilesize
3.3MB