Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
09/04/2024, 17:27
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Inquiry Second Reminder.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
General
- Target Inquiry Second Reminder.exe
- Size 1.1MB
- Sample240409-v1eb5sde53
- SHA256 3d7ed6d1ed6ee914bb491dc7ba72c0e665727786d51e2b9aad8e2afb3e16b316
- MD5 a3cedbbfad4507bd6b37853b72a33724
- SHA1 0371e3308e3a1e39eca2474e9c00ddffeedfcfd2
- SHA512 010e5e488ad44089d0239b3d0b570ee57cc0f89fef102c87bd951dc52cf91e937a60a8a7b9b243ef7c406ad10ebcb391323173c36493d7cabb14e99fe9d5ab3f
- SSDEEP 24576:cqDEvCTbMWu7rQYlBQcBiT6rprG8a2o+dIk:cTvC/MTQYxsWR7a2o+dI
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
dz25
Decoy
-
sdw123.com
-
theflower-jeju.com
-
bigbargins.shop
-
xn--grsdetetizao-dcb9c.site
-
visionprobiz.com
-
ebruunalsigorta.xyz
-
51tree.net
-
tommeynadier.com
-
spx21.com
-
researchupdatehub.com
-
rserveohio.com
-
schemaconsultant.com
-
ec-peleti.com
-
songkokgelhq.shop
-
sixfigureswithkarah.net
-
quickfinancebrokerage.com
-
alliance-couverture.com
-
heartlandinnovates.com
-
art-friday.online
-
curi-o-rama.com
-
tlfpros.xyz
-
pusatjudionline1a.com
-
exitmusic.xyz
-
jegrapo.com
-
paintk.com
-
hyperbaricredlight.net
-
residencialvilaflora.com
-
learnorama.in
-
xpjs194.cc
-
szjfly.com
-
ucelmobilya.net
-
idealsconsulting.com
-
baku.technology
-
wijaya88e.xyz
-
marketpaysolutions.com
-
kuristusjuntta.com
-
marchlightfilms.com
-
memento5.com
-
tigus.us
-
escarlatalabs.com
-
emsonsupport.com
-
t3ht6g3.pw
-
goldprocleaning.com
-
verifycerts.net
-
nltwfkdt.info
-
ohmioz.com
-
qticompanny.com
-
thirteencat.com
-
eliteedgeresources.com
-
alsalmisteel.com
-
dfxzwd.xyz
-
daigaku-debut.info
-
aquamunitions.com
-
68296dd.com
-
asas886.com
-
boutiquecelestiala.com
-
tsg-egypt.com
-
cgdm.shop
-
bizzyprofitness.com
-
sayhellotonails.com
-
umeboshisan.tech
-
elnuevonuevoleon.com
-
glenpa.net
-
tbj.one
-
venusbackend.live
Signatures
- Formbook payload 4 IoCs
resource yara_rule behavioral2/memory/3848-11-0x0000000000600000-0x000000000062F000-memory.dmp formbook behavioral2/memory/3848-16-0x0000000000600000-0x000000000062F000-memory.dmp formbook behavioral2/memory/2608-21-0x0000000000880000-0x00000000008AF000-memory.dmp formbook behavioral2/memory/2608-23-0x0000000000880000-0x00000000008AF000-memory.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4228 set thread context of 3848 4228 Inquiry Second Reminder.exe 88 PID 3848 set thread context of 3476 3848 svchost.exe 57 PID 2608 set thread context of 3476 2608 mstsc.exe 57 - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe 2608 mstsc.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 4228 Inquiry Second Reminder.exe 4228 Inquiry Second Reminder.exe 3848 svchost.exe 3848 svchost.exe 3848 svchost.exe 2608 mstsc.exe 2608 mstsc.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 3848 svchost.exe Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeDebugPrivilege 2608 mstsc.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4228 Inquiry Second Reminder.exe 4228 Inquiry Second Reminder.exe 3476 Explorer.EXE 3476 Explorer.EXE - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4228 Inquiry Second Reminder.exe 4228 Inquiry Second Reminder.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3476 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4228 wrote to memory of 3848 4228 Inquiry Second Reminder.exe 88 PID 4228 wrote to memory of 3848 4228 Inquiry Second Reminder.exe 88 PID 4228 wrote to memory of 3848 4228 Inquiry Second Reminder.exe 88 PID 4228 wrote to memory of 3848 4228 Inquiry Second Reminder.exe 88 PID 3476 wrote to memory of 2608 3476 Explorer.EXE 89 PID 3476 wrote to memory of 2608 3476 Explorer.EXE 89 PID 3476 wrote to memory of 2608 3476 Explorer.EXE 89 PID 2608 wrote to memory of 1960 2608 mstsc.exe 95 PID 2608 wrote to memory of 1960 2608 mstsc.exe 95 PID 2608 wrote to memory of 1960 2608 mstsc.exe 95
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\Inquiry Second Reminder.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry Second Reminder.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry Second Reminder.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3848
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵PID:1960
-
-