Analysis
-
max time kernel
139s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 13:18
Static task
static1
Behavioral task
behavioral1
Sample
12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe
Resource
win7-20240221-en
General
-
Target
12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe
-
Size
610KB
-
MD5
0b90be647821fb3812e6c340c6587fae
-
SHA1
04ee5bf64f4fd6a512828a818c110697d19f18ab
-
SHA256
12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4
-
SHA512
d348ece6997947050c8b3c01df55f157767444892196c0bd001012c36c610b93696853f35080551e10bec6f4a15c1098cd1132acab84a697c4fed07deac34ab6
-
SSDEEP
12288:233bFUoSfRmhTIJgWGdm6HrC/QpCiriaEHCnLEovkR:23pqf8TIJge6HrCy6hHCLEd
Malware Config
Extracted
formbook
4.1
ns03
dipity.tech
agathis.fun
ekaterinai.store
elizabethsbookshelf.com
smilesustainably.com
tapeworm.xyz
beatricesswarthout.xyz
nsrpackersandpackers.in
yedxec.xyz
gildedbeautyaesthitics.com
hanibalbechar.com
fichaphuman.net
adilosk.shop
geezaran.com
ventasemail.com
phonecasesdirect.store
rctjuc.shop
sukimossmanagement.com
caller-id.today
kft07.vip
mahbubamaahi.com
tcindustrie.net
ng-stl.com
vb4n53g4fh354gf5jh.top
repair-services.today
fonbnk.pro
olivabelle.com
pqeomjr.cc
elevatedblanks.net
ambiatec.solutions
quantumaster.online
pocket-option.tech
circly.net
focus2c.com
armacao-de-oculos.com
bmcj365.com
maxhealthunity.com
taifengtechnologyservice.com
zerolethal.com
dramaqu.guru
kukrejaassociates.in
jamesjenner.com
signature-perfect.com
fbaparadise.com
yandada.us
rcpbooks.site
celonstore.fun
dailynewarker.com
594545.xyz
chuanruhaomen.com
planetpost.lol
kinovod130424.pro
lavanced.com
leclandesparents.com
childnchestcare.com
taiyuanbaoyang.com
engagenotrage.com
halffullliving.com
scheuermannworks.com
oengpalworld.store
derech-hamagah.com
clintomator.com
velvetgloveseasonings.store
pkclubc.site
grupooceanique.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5000-13-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exedescription pid process target process PID 4248 set thread context of 5000 4248 12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe 12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exepid process 5000 12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe 5000 12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe 5000 12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exedescription pid process target process PID 4248 wrote to memory of 5000 4248 12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe 12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe PID 4248 wrote to memory of 5000 4248 12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe 12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe PID 4248 wrote to memory of 5000 4248 12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe 12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe PID 4248 wrote to memory of 5000 4248 12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe 12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe PID 4248 wrote to memory of 5000 4248 12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe 12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe PID 4248 wrote to memory of 5000 4248 12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe 12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe"C:\Users\Admin\AppData\Local\Temp\12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe"C:\Users\Admin\AppData\Local\Temp\12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4248-8-0x00000000058F0000-0x0000000005904000-memory.dmpFilesize
80KB
-
memory/4248-6-0x0000000005810000-0x000000000581A000-memory.dmpFilesize
40KB
-
memory/4248-2-0x00000000059B0000-0x0000000005F54000-memory.dmpFilesize
5.6MB
-
memory/4248-3-0x0000000005400000-0x0000000005492000-memory.dmpFilesize
584KB
-
memory/4248-0-0x0000000074F00000-0x00000000756B0000-memory.dmpFilesize
7.7MB
-
memory/4248-5-0x0000000005380000-0x0000000005390000-memory.dmpFilesize
64KB
-
memory/4248-1-0x0000000000950000-0x00000000009EC000-memory.dmpFilesize
624KB
-
memory/4248-7-0x0000000005380000-0x0000000005390000-memory.dmpFilesize
64KB
-
memory/4248-4-0x0000000074F00000-0x00000000756B0000-memory.dmpFilesize
7.7MB
-
memory/4248-9-0x0000000005910000-0x000000000591A000-memory.dmpFilesize
40KB
-
memory/4248-10-0x00000000059A0000-0x00000000059AC000-memory.dmpFilesize
48KB
-
memory/4248-11-0x0000000006F20000-0x0000000006F96000-memory.dmpFilesize
472KB
-
memory/4248-12-0x00000000096E0000-0x000000000977C000-memory.dmpFilesize
624KB
-
memory/4248-16-0x0000000074F00000-0x00000000756B0000-memory.dmpFilesize
7.7MB
-
memory/5000-14-0x00000000014C0000-0x000000000180A000-memory.dmpFilesize
3.3MB
-
memory/5000-13-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB