Analysis
-
max time kernel
147s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 14:44
Static task
static1
Behavioral task
behavioral1
Sample
41c452f4ba12f523916ad3390d3711d9d6c05a7c698a83a890095a8c722249a5.exe
Resource
win7-20240221-en
General
-
Target
41c452f4ba12f523916ad3390d3711d9d6c05a7c698a83a890095a8c722249a5.exe
-
Size
347KB
-
MD5
cb200521eb0a2795343b74dc489bceb6
-
SHA1
c5b53fbdd52fab35a5ad70c16dbcc335b7a27644
-
SHA256
41c452f4ba12f523916ad3390d3711d9d6c05a7c698a83a890095a8c722249a5
-
SHA512
53a6b2343ba2d2cd871650a3d7c582e1506541866b4a56e2cbccdf934aaddd1837795f9f88f886a14d37495a85ef3292d3d7c954c1641d6b957083190b7293d7
-
SSDEEP
6144:wVe3lL1uX1ACTFC1NQYNYD3ffl1fqdIhwqB1pJd:EiRu3FoQ9vfl1ydIhN1
Malware Config
Extracted
formbook
4.1
ce10
universalbowls.com
bp5.site
thiagokielingwebdesign.net
grapper.fun
grow-more.us
cqdh888.com
facthunter.app
cstars05.xyz
baumeagency.com
montevallotowing.top
joshtdownes.com
ampvit88.info
timelesscoutureclothing.com
stimuscle.com
uppervillekeyword.top
victoriabaltzer.com
laguindah.art
kiddieboost.com
santafekeyword.top
818experience.com
xn--8mr685f.xn--6qq986b3xl
topratedselection.beauty
pilgrim13.online
joshalley.com
hty1tqhm.top
endangerda.com
nursing-degrees-39640.bond
geogit.tech
auctionhouse275.com
primeprodeals.com
zkq8kor5.shop
onchainpayments.net
northstudiogt.com
hirr.site
quix.agency
nl-prod.com
waubaykeyword.top
saveourstreamliner.com
mesabae.com
glovegpt.com
evelethtowing.top
stcstage.live
nvvaconsulting.net
markusmartl.club
charmcokeyword.top
ravichandranc.net
prettyandslayedco.com
jakobwakolbinger.com
leveringtowing.top
qc8o.site
animasafe.com
kantoshopping.com
threein.live
mavvericklabs.com
8kdz0dcm9h.com
hd6385.com
daovertise.com
14whoduhw.top
5pfxcicm.com
xyg222.com
ebov33.com
bachatstorepk.com
pinkcosmeticscompany.com
kinoxe.xyz
curlioshop.com
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4308-2-0x00000000024A0000-0x00000000024CF000-memory.dmp formbook behavioral2/memory/4308-3-0x0000000000400000-0x0000000000879000-memory.dmp formbook -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2548 4308 WerFault.exe 41c452f4ba12f523916ad3390d3711d9d6c05a7c698a83a890095a8c722249a5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\41c452f4ba12f523916ad3390d3711d9d6c05a7c698a83a890095a8c722249a5.exe"C:\Users\Admin\AppData\Local\Temp\41c452f4ba12f523916ad3390d3711d9d6c05a7c698a83a890095a8c722249a5.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 2682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4308 -ip 43081⤵