Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 14:48
Static task
static1
Behavioral task
behavioral1
Sample
36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe
Resource
win7-20240220-en
General
-
Target
36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe
-
Size
638KB
-
MD5
6975f1f27e4016368f71dabba716ca6e
-
SHA1
3225deb13c647b26a52c59a328b3432cff5e8871
-
SHA256
36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1
-
SHA512
362c0901c959f12357263254bbbc0105824bdee7da87ca4c1e9ea0f0c7717761a97a0b954ec3150c4e4e74aea0e33a77c1b8a360e344c9395d75e0f108284702
-
SSDEEP
12288:n9d2iNjJz/IIHF3fKqHqWLr66AEWzP0S0iHjl8KqUitqfZqb2V2M31VgCnoe:nn1NJz/IIHFv9HtLW6AEWz/0SitAgmLP
Malware Config
Extracted
formbook
4.1
gy14
mavbam.com
theanhedonia.com
budgetnurseries.com
buflitr.com
alqamarhotel.com
2660348.top
123bu6.shop
v72999.com
yzyz841.xyz
247fracing.com
naples.beauty
twinklethrive.com
loscaseros.com
creditspisatylegko.site
sgyy3ej2dgwesb5.com
ufocafe.net
techn9nehollywoodundead.com
truedatalab.com
alterdpxlmarketing.com
harborspringsfire.com
soulheroes.online
tryscriptify.com
collline.com
tulisanemas.com
thelectricandsolar.com
jokergiftcard.buzz
sciencemediainstitute.com
loading-231412.info
ampsportss.com
dianetion.com
169cc.xyz
zezfhys.com
smnyg.com
elenorbet327.com
whatsapp1.autos
0854n5.shop
jxscols.top
camelpmkrf.com
myxtremecleanshq.services
beautyloungebydede.online
artbydianayorktownva.com
functional-yarns.com
accepted6.com
ug19bklo.com
roelofsen.online
batuoe.com
amiciperlacoda.com
883831.com
qieqyt.xyz
vendorato.online
6733633.com
stadtliche-arbeit.info
survivordental.com
mrbmed.com
elbt-ag.com
mtdiyx.xyz
mediayoki.site
zom11.com
biosif.com
aicashu.com
inovarevending.com
8x101n.xyz
ioherstrulybeauty.com
mosaica.online
venitro.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4892-19-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4892-35-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3588-75-0x00000000005B0000-0x00000000005DF000-memory.dmp formbook behavioral2/memory/3588-77-0x00000000005B0000-0x00000000005DF000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exeRegSvcs.exeraserver.exedescription pid process target process PID 5060 set thread context of 4892 5060 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe RegSvcs.exe PID 4892 set thread context of 3404 4892 RegSvcs.exe Explorer.EXE PID 3588 set thread context of 3404 3588 raserver.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 59 IoCs
Processes:
36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exepowershell.exeRegSvcs.exeraserver.exepid process 5060 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe 5060 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe 5060 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe 4156 powershell.exe 4892 RegSvcs.exe 4892 RegSvcs.exe 4892 RegSvcs.exe 4892 RegSvcs.exe 4156 powershell.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe 3588 raserver.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exeraserver.exepid process 4892 RegSvcs.exe 4892 RegSvcs.exe 4892 RegSvcs.exe 3588 raserver.exe 3588 raserver.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exepowershell.exeRegSvcs.exeExplorer.EXEraserver.exedescription pid process Token: SeDebugPrivilege 5060 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe Token: SeDebugPrivilege 4156 powershell.exe Token: SeDebugPrivilege 4892 RegSvcs.exe Token: SeShutdownPrivilege 3404 Explorer.EXE Token: SeCreatePagefilePrivilege 3404 Explorer.EXE Token: SeDebugPrivilege 3588 raserver.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3404 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exeExplorer.EXEraserver.exedescription pid process target process PID 5060 wrote to memory of 4156 5060 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe powershell.exe PID 5060 wrote to memory of 4156 5060 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe powershell.exe PID 5060 wrote to memory of 4156 5060 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe powershell.exe PID 5060 wrote to memory of 3608 5060 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe schtasks.exe PID 5060 wrote to memory of 3608 5060 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe schtasks.exe PID 5060 wrote to memory of 3608 5060 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe schtasks.exe PID 5060 wrote to memory of 4892 5060 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe RegSvcs.exe PID 5060 wrote to memory of 4892 5060 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe RegSvcs.exe PID 5060 wrote to memory of 4892 5060 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe RegSvcs.exe PID 5060 wrote to memory of 4892 5060 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe RegSvcs.exe PID 5060 wrote to memory of 4892 5060 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe RegSvcs.exe PID 5060 wrote to memory of 4892 5060 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe RegSvcs.exe PID 3404 wrote to memory of 3588 3404 Explorer.EXE raserver.exe PID 3404 wrote to memory of 3588 3404 Explorer.EXE raserver.exe PID 3404 wrote to memory of 3588 3404 Explorer.EXE raserver.exe PID 3588 wrote to memory of 4816 3588 raserver.exe cmd.exe PID 3588 wrote to memory of 4816 3588 raserver.exe cmd.exe PID 3588 wrote to memory of 4816 3588 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe"C:\Users\Admin\AppData\Local\Temp\36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sauCxoBUXLq.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sauCxoBUXLq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB41D.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1ojdgkop.rz1.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpB41D.tmpFilesize
1KB
MD58e299b6f115d5ad501f7fe3f4781b875
SHA17ac00e83e5ebc14067ba3175930cc774e1ea5a0b
SHA256c880bfa71ecf25b0f237aa23735171c0030d39f0e033cbc25519113595470906
SHA512d30a0ab74cf1f2210c074e84bdf9ae4bcfadcb0dfa5a4e4b174f1e1b3f986caf54fb89d477b3bd389ca5856a8baf29daaf8b7017cd880dcf3411abae277c605d
-
memory/3404-85-0x0000000009060000-0x0000000009153000-memory.dmpFilesize
972KB
-
memory/3404-82-0x0000000009060000-0x0000000009153000-memory.dmpFilesize
972KB
-
memory/3404-81-0x0000000009060000-0x0000000009153000-memory.dmpFilesize
972KB
-
memory/3404-41-0x0000000008E90000-0x0000000008F48000-memory.dmpFilesize
736KB
-
memory/3588-78-0x0000000002580000-0x0000000002614000-memory.dmpFilesize
592KB
-
memory/3588-77-0x00000000005B0000-0x00000000005DF000-memory.dmpFilesize
188KB
-
memory/3588-76-0x0000000002740000-0x0000000002A8A000-memory.dmpFilesize
3.3MB
-
memory/3588-75-0x00000000005B0000-0x00000000005DF000-memory.dmpFilesize
188KB
-
memory/3588-74-0x00000000009F0000-0x0000000000A0F000-memory.dmpFilesize
124KB
-
memory/3588-72-0x00000000009F0000-0x0000000000A0F000-memory.dmpFilesize
124KB
-
memory/4156-65-0x0000000007720000-0x000000000772E000-memory.dmpFilesize
56KB
-
memory/4156-45-0x000000007F490000-0x000000007F4A0000-memory.dmpFilesize
64KB
-
memory/4156-16-0x0000000074A70000-0x0000000075220000-memory.dmpFilesize
7.7MB
-
memory/4156-21-0x0000000005310000-0x0000000005332000-memory.dmpFilesize
136KB
-
memory/4156-71-0x0000000074A70000-0x0000000075220000-memory.dmpFilesize
7.7MB
-
memory/4156-67-0x0000000007830000-0x000000000784A000-memory.dmpFilesize
104KB
-
memory/4156-22-0x00000000053B0000-0x0000000005416000-memory.dmpFilesize
408KB
-
memory/4156-30-0x00000000029E0000-0x00000000029F0000-memory.dmpFilesize
64KB
-
memory/4156-15-0x00000000028A0000-0x00000000028D6000-memory.dmpFilesize
216KB
-
memory/4156-68-0x0000000007810000-0x0000000007818000-memory.dmpFilesize
32KB
-
memory/4156-66-0x0000000007730000-0x0000000007744000-memory.dmpFilesize
80KB
-
memory/4156-33-0x0000000005C10000-0x0000000005F64000-memory.dmpFilesize
3.3MB
-
memory/4156-32-0x00000000029E0000-0x00000000029F0000-memory.dmpFilesize
64KB
-
memory/4156-24-0x0000000005550000-0x00000000055B6000-memory.dmpFilesize
408KB
-
memory/4156-64-0x00000000076F0000-0x0000000007701000-memory.dmpFilesize
68KB
-
memory/4156-63-0x0000000007770000-0x0000000007806000-memory.dmpFilesize
600KB
-
memory/4156-62-0x0000000007560000-0x000000000756A000-memory.dmpFilesize
40KB
-
memory/4156-43-0x00000000061D0000-0x00000000061EE000-memory.dmpFilesize
120KB
-
memory/4156-44-0x0000000006200000-0x000000000624C000-memory.dmpFilesize
304KB
-
memory/4156-47-0x0000000075300000-0x000000007534C000-memory.dmpFilesize
304KB
-
memory/4156-46-0x0000000006790000-0x00000000067C2000-memory.dmpFilesize
200KB
-
memory/4156-18-0x00000000055E0000-0x0000000005C08000-memory.dmpFilesize
6.2MB
-
memory/4156-58-0x0000000006760000-0x000000000677E000-memory.dmpFilesize
120KB
-
memory/4156-57-0x00000000029E0000-0x00000000029F0000-memory.dmpFilesize
64KB
-
memory/4156-59-0x00000000073C0000-0x0000000007463000-memory.dmpFilesize
652KB
-
memory/4156-60-0x0000000007B40000-0x00000000081BA000-memory.dmpFilesize
6.5MB
-
memory/4156-61-0x00000000074F0000-0x000000000750A000-memory.dmpFilesize
104KB
-
memory/4892-35-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4892-38-0x0000000001410000-0x0000000001425000-memory.dmpFilesize
84KB
-
memory/4892-42-0x00000000016F0000-0x0000000001A3A000-memory.dmpFilesize
3.3MB
-
memory/4892-19-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/5060-9-0x000000000C2C0000-0x000000000C32E000-memory.dmpFilesize
440KB
-
memory/5060-34-0x0000000074A70000-0x0000000075220000-memory.dmpFilesize
7.7MB
-
memory/5060-0-0x0000000000B90000-0x0000000000C36000-memory.dmpFilesize
664KB
-
memory/5060-20-0x0000000074A70000-0x0000000075220000-memory.dmpFilesize
7.7MB
-
memory/5060-10-0x000000000F950000-0x000000000F9EC000-memory.dmpFilesize
624KB
-
memory/5060-8-0x0000000004F90000-0x0000000004F9E000-memory.dmpFilesize
56KB
-
memory/5060-7-0x0000000006B40000-0x0000000006B4A000-memory.dmpFilesize
40KB
-
memory/5060-6-0x0000000005980000-0x00000000059A0000-memory.dmpFilesize
128KB
-
memory/5060-5-0x00000000056B0000-0x00000000056BA000-memory.dmpFilesize
40KB
-
memory/5060-4-0x0000000005690000-0x00000000056A0000-memory.dmpFilesize
64KB
-
memory/5060-3-0x00000000054E0000-0x0000000005572000-memory.dmpFilesize
584KB
-
memory/5060-2-0x00000000059A0000-0x0000000005F44000-memory.dmpFilesize
5.6MB
-
memory/5060-1-0x0000000074A70000-0x0000000075220000-memory.dmpFilesize
7.7MB