Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 13:33
Static task
static1
Behavioral task
behavioral1
Sample
e1c967ab4b9d87b235516a57b2572ceb.exe
Resource
win7-20240221-en
General
-
Target
e1c967ab4b9d87b235516a57b2572ceb.exe
-
Size
1.3MB
-
MD5
e1c967ab4b9d87b235516a57b2572ceb
-
SHA1
8d6e73b957a94daca6498dfc3e8a14deced74940
-
SHA256
231540b133e8ed8746f69eea6c0fb3652a56d13f52d1acf1648215396129a687
-
SHA512
59fab2d8d827eec4bcaf1b246b8774c5ba919eb3b2a81d093f730e08dbe85f073764ae56a441063b756279f2bfde0eb3c7921eda661a676328f31860ccfc9958
-
SSDEEP
24576:PqpwZW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+hu:i2Aiec+NQuiNBzgicO5nle
Malware Config
Extracted
formbook
4.1
wz6a
commonebisu.com
onlinedatingforyou.com
nomoreink.com
directcare.doctor
protego1.com
buvettechamonix.com
dissertationshelp.net
theawakenedmother.life
leonwickham.com
renaultstoreiran.com
lsxwsj.com
uniontattoosupply.com
herfitnessandbeauty.com
jesselynleephotography.com
imaginebyccp.com
athomeproductive.com
laratome.com
smoothsailingexpress.com
freedrumlessons4u.com
easylivego.com
peekypetshop.com
suachuanha123.com
hamdiistanbullutv.com
economicsfortoddlers.com
donaldbichonfrise.com
ahhazu.com
fallincoffee.com
ospfenetres.com
mybusinessdoor.com
unfreecitizens.com
sofahaven.com
angelicmichele.com
boroda.codes
creationsbyba.com
324518.com
adventuresindiy3dprinting.com
onehitwonderthemusical.com
valsinvoguenails.com
inclusionpractitioner.com
downbytheriverside.online
pengpengcooking.com
tricket24.com
hanyajadi.com
iinntenna.com
basicallyindia.com
qfjg.net
lawartcultureweekly.com
whjmglj.com
mijnwebaanvraag.info
biancacannavoslp.com
brurodrigues.com
zebratrainer.info
8146confluencept.com
inshaabytdh.com
ossierugs.com
smacey.com
performancehut.com
fostermarketing.energy
rama.fans
spotonspecialed.com
krushiaadhaar.com
betgobar8.com
lkstau.com
thaikeittio.com
setuseny.site
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3560-13-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e1c967ab4b9d87b235516a57b2572ceb.exedescription pid process target process PID 3808 set thread context of 3560 3808 e1c967ab4b9d87b235516a57b2572ceb.exe e1c967ab4b9d87b235516a57b2572ceb.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
e1c967ab4b9d87b235516a57b2572ceb.exepid process 3560 e1c967ab4b9d87b235516a57b2572ceb.exe 3560 e1c967ab4b9d87b235516a57b2572ceb.exe 3560 e1c967ab4b9d87b235516a57b2572ceb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e1c967ab4b9d87b235516a57b2572ceb.exedescription pid process Token: SeDebugPrivilege 3808 e1c967ab4b9d87b235516a57b2572ceb.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
e1c967ab4b9d87b235516a57b2572ceb.exedescription pid process target process PID 3808 wrote to memory of 3560 3808 e1c967ab4b9d87b235516a57b2572ceb.exe e1c967ab4b9d87b235516a57b2572ceb.exe PID 3808 wrote to memory of 3560 3808 e1c967ab4b9d87b235516a57b2572ceb.exe e1c967ab4b9d87b235516a57b2572ceb.exe PID 3808 wrote to memory of 3560 3808 e1c967ab4b9d87b235516a57b2572ceb.exe e1c967ab4b9d87b235516a57b2572ceb.exe PID 3808 wrote to memory of 3560 3808 e1c967ab4b9d87b235516a57b2572ceb.exe e1c967ab4b9d87b235516a57b2572ceb.exe PID 3808 wrote to memory of 3560 3808 e1c967ab4b9d87b235516a57b2572ceb.exe e1c967ab4b9d87b235516a57b2572ceb.exe PID 3808 wrote to memory of 3560 3808 e1c967ab4b9d87b235516a57b2572ceb.exe e1c967ab4b9d87b235516a57b2572ceb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1c967ab4b9d87b235516a57b2572ceb.exe"C:\Users\Admin\AppData\Local\Temp\e1c967ab4b9d87b235516a57b2572ceb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e1c967ab4b9d87b235516a57b2572ceb.exe"C:\Users\Admin\AppData\Local\Temp\e1c967ab4b9d87b235516a57b2572ceb.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3560-13-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3560-16-0x0000000001810000-0x0000000001B5A000-memory.dmpFilesize
3.3MB
-
memory/3808-8-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/3808-9-0x0000000005610000-0x0000000005620000-memory.dmpFilesize
64KB
-
memory/3808-4-0x0000000005440000-0x00000000054D2000-memory.dmpFilesize
584KB
-
memory/3808-5-0x0000000005610000-0x0000000005620000-memory.dmpFilesize
64KB
-
memory/3808-6-0x0000000005370000-0x000000000537A000-memory.dmpFilesize
40KB
-
memory/3808-7-0x0000000005680000-0x00000000056D6000-memory.dmpFilesize
344KB
-
memory/3808-0-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/3808-3-0x00000000059F0000-0x0000000005F94000-memory.dmpFilesize
5.6MB
-
memory/3808-10-0x00000000067E0000-0x0000000006816000-memory.dmpFilesize
216KB
-
memory/3808-11-0x00000000011E0000-0x000000000125C000-memory.dmpFilesize
496KB
-
memory/3808-12-0x0000000000FD0000-0x0000000001004000-memory.dmpFilesize
208KB
-
memory/3808-2-0x00000000053A0000-0x000000000543C000-memory.dmpFilesize
624KB
-
memory/3808-15-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/3808-1-0x0000000000820000-0x0000000000976000-memory.dmpFilesize
1.3MB