Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-03-2024 02:09
Static task
static1
Behavioral task
behavioral1
Sample
2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe
Resource
win7-20240221-en
General
-
Target
2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe
-
Size
617KB
-
MD5
7d1afa1b1a208fb161b8e5728ab0523f
-
SHA1
4c6fc1d025489ff1dc67fead4ae0bfa0acc26f3c
-
SHA256
2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2
-
SHA512
e3c2f52d17b93ddbef0c5fc2224b202863f82588c87cf4c0a908a3d37de354e237d877f904a7f46f7c3553848f814fcfb3cc5e5af6c1be1cd95af9b8328bec5b
-
SSDEEP
12288:5L2iNlw0k160S794BoVFdHlAWQ4deo8p7Ya+KRC1alSACiMkR:V1X30S794KVFdHlAOdB4MTKRCcck
Malware Config
Extracted
formbook
4.1
ns03
dipity.tech
agathis.fun
ekaterinai.store
elizabethsbookshelf.com
smilesustainably.com
tapeworm.xyz
beatricesswarthout.xyz
nsrpackersandpackers.in
yedxec.xyz
gildedbeautyaesthitics.com
hanibalbechar.com
fichaphuman.net
adilosk.shop
geezaran.com
ventasemail.com
phonecasesdirect.store
rctjuc.shop
sukimossmanagement.com
caller-id.today
kft07.vip
mahbubamaahi.com
tcindustrie.net
ng-stl.com
vb4n53g4fh354gf5jh.top
repair-services.today
fonbnk.pro
olivabelle.com
pqeomjr.cc
elevatedblanks.net
ambiatec.solutions
quantumaster.online
pocket-option.tech
circly.net
focus2c.com
armacao-de-oculos.com
bmcj365.com
maxhealthunity.com
taifengtechnologyservice.com
zerolethal.com
dramaqu.guru
kukrejaassociates.in
jamesjenner.com
signature-perfect.com
fbaparadise.com
yandada.us
rcpbooks.site
celonstore.fun
dailynewarker.com
594545.xyz
chuanruhaomen.com
planetpost.lol
kinovod130424.pro
lavanced.com
leclandesparents.com
childnchestcare.com
taiyuanbaoyang.com
engagenotrage.com
halffullliving.com
scheuermannworks.com
oengpalworld.store
derech-hamagah.com
clintomator.com
velvetgloveseasonings.store
pkclubc.site
grupooceanique.com
Signatures
-
Detects executables packed with SmartAssembly 1 IoCs
Processes:
resource yara_rule behavioral1/memory/844-4-0x0000000001E30000-0x0000000001E3C000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly -
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/964-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exedescription pid process target process PID 844 set thread context of 964 844 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exepid process 844 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe 844 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe 964 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exedescription pid process Token: SeDebugPrivilege 844 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exedescription pid process target process PID 844 wrote to memory of 2912 844 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe PID 844 wrote to memory of 2912 844 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe PID 844 wrote to memory of 2912 844 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe PID 844 wrote to memory of 2912 844 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe PID 844 wrote to memory of 2084 844 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe PID 844 wrote to memory of 2084 844 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe PID 844 wrote to memory of 2084 844 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe PID 844 wrote to memory of 2084 844 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe PID 844 wrote to memory of 964 844 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe PID 844 wrote to memory of 964 844 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe PID 844 wrote to memory of 964 844 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe PID 844 wrote to memory of 964 844 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe PID 844 wrote to memory of 964 844 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe PID 844 wrote to memory of 964 844 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe PID 844 wrote to memory of 964 844 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe 2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe"C:\Users\Admin\AppData\Local\Temp\2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe"C:\Users\Admin\AppData\Local\Temp\2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe"C:\Users\Admin\AppData\Local\Temp\2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe"C:\Users\Admin\AppData\Local\Temp\2eab6a48a08726441514655a1d84a3921af8139cd2e7b61f23a30c11785f28f2.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/844-0-0x00000000002C0000-0x000000000035A000-memory.dmpFilesize
616KB
-
memory/844-1-0x0000000074030000-0x000000007471E000-memory.dmpFilesize
6.9MB
-
memory/844-2-0x0000000001DA0000-0x0000000001DE0000-memory.dmpFilesize
256KB
-
memory/844-3-0x00000000007F0000-0x0000000000802000-memory.dmpFilesize
72KB
-
memory/844-4-0x0000000001E30000-0x0000000001E3C000-memory.dmpFilesize
48KB
-
memory/844-5-0x0000000004D80000-0x0000000004DF6000-memory.dmpFilesize
472KB
-
memory/844-13-0x0000000074030000-0x000000007471E000-memory.dmpFilesize
6.9MB
-
memory/964-6-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/964-8-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/964-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/964-12-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/964-14-0x0000000000A00000-0x0000000000D03000-memory.dmpFilesize
3.0MB