Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 08:59
Static task
static1
Behavioral task
behavioral1
Sample
ZIMUXIA8376.exe
Resource
win7-20231129-en
General
-
Target
ZIMUXIA8376.exe
-
Size
765KB
-
MD5
4d7e0095c7770a52783f6dfc479bafa0
-
SHA1
3f49034d7415ecdeaf887afff1a95199ba2043ff
-
SHA256
ff5d67d2cfdae5296cda453f2f78fcacd79169bb9dbbe94a2007d9dcb382d2ef
-
SHA512
2570fa14760448878d9205d832ba52c82558f1776cfc2cb00c8ecc45dd8f6a2953b49ac6c8f02b65cc110c19f11be7eccaaf0dfc9e29f83c6093d2769b5f10a1
-
SSDEEP
12288:8CqnHvjNIrpf9rN/mc/Ciu2OAgXH/q6tVKfvfOkx6Mnf1SVfeEyuOlQnPssJAMDl:8/PjKr5BNDYEUH/q6tVqvGwtsVmEXksp
Malware Config
Extracted
formbook
4.1
jn17
hynasty.com
africacementreview.com
5280micropantry.com
qcyu2.us
jl777-web.com
hcwsports.com
update-number-au.com
ymymvip.top
postds.buzz
dogwifnobrim.com
usapubpong.com
shopscoopido.com
medical-equipment.company
onyagu.com
tldrparent.com
jvpeople.com
seangalbraithphotography.com
ptt-gov.art
mutcosmeticsec.com
metameme.online
mwintallation.com
luxury-collectables.com
4uprofreefavorite.lat
asopiti.com
egmrm.club
optimaenergy.cloud
zb1zq9.vip
landavacations.com
lilwef.site
smart-beds-15979.bond
vedicloud.com
floodedbasementcleanupnovimi.us
barakehlocal.com
music-europe.com
johnasian.com
jinhengbinguan.com
lkiu.xyz
cma-graphic.com
beatamin.club
ybqo.cc
salahtimeonline.com
lsdlj.com
hhhky.top
synfuturedefi.app
268120.com
mecpu.com
6bi0d.us
sjmsd.loan
green-vending-co.com
jgrlum.shop
gamedaemons.site
odysseyeurope.com
obet2359.com
manegociation.com
divainparfaumsnl.shop
colissimo-portail.com
mthfrgeneawareness.xyz
santeportailameli.info
davidonej.com
nyarapiyo.com
xn--lrxq61dxlf.top
in2glass.com
groda.art
mememeclothingshop.com
erocom.link
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3148-20-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3148-40-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3148-73-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3344-75-0x0000000000FD0000-0x0000000000FFF000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ZIMUXIA8376.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation ZIMUXIA8376.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
ZIMUXIA8376.exeZIMUXIA8376.exemstsc.exedescription pid process target process PID 2216 set thread context of 3148 2216 ZIMUXIA8376.exe ZIMUXIA8376.exe PID 3148 set thread context of 3480 3148 ZIMUXIA8376.exe Explorer.EXE PID 3148 set thread context of 3480 3148 ZIMUXIA8376.exe Explorer.EXE PID 3344 set thread context of 3480 3344 mstsc.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
powershell.exeZIMUXIA8376.exemstsc.exepid process 1052 powershell.exe 3148 ZIMUXIA8376.exe 3148 ZIMUXIA8376.exe 1052 powershell.exe 3148 ZIMUXIA8376.exe 3148 ZIMUXIA8376.exe 3148 ZIMUXIA8376.exe 3148 ZIMUXIA8376.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe 3344 mstsc.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
ZIMUXIA8376.exemstsc.exepid process 3148 ZIMUXIA8376.exe 3148 ZIMUXIA8376.exe 3148 ZIMUXIA8376.exe 3148 ZIMUXIA8376.exe 3344 mstsc.exe 3344 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
powershell.exeZIMUXIA8376.exeExplorer.EXEmstsc.exedescription pid process Token: SeDebugPrivilege 1052 powershell.exe Token: SeDebugPrivilege 3148 ZIMUXIA8376.exe Token: SeShutdownPrivilege 3480 Explorer.EXE Token: SeCreatePagefilePrivilege 3480 Explorer.EXE Token: SeDebugPrivilege 3344 mstsc.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
Explorer.EXEpid process 3480 Explorer.EXE 3480 Explorer.EXE 3480 Explorer.EXE -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
Explorer.EXEpid process 3480 Explorer.EXE 3480 Explorer.EXE 3480 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3480 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
ZIMUXIA8376.exeExplorer.EXEmstsc.exedescription pid process target process PID 2216 wrote to memory of 1052 2216 ZIMUXIA8376.exe powershell.exe PID 2216 wrote to memory of 1052 2216 ZIMUXIA8376.exe powershell.exe PID 2216 wrote to memory of 1052 2216 ZIMUXIA8376.exe powershell.exe PID 2216 wrote to memory of 4180 2216 ZIMUXIA8376.exe schtasks.exe PID 2216 wrote to memory of 4180 2216 ZIMUXIA8376.exe schtasks.exe PID 2216 wrote to memory of 4180 2216 ZIMUXIA8376.exe schtasks.exe PID 2216 wrote to memory of 3148 2216 ZIMUXIA8376.exe ZIMUXIA8376.exe PID 2216 wrote to memory of 3148 2216 ZIMUXIA8376.exe ZIMUXIA8376.exe PID 2216 wrote to memory of 3148 2216 ZIMUXIA8376.exe ZIMUXIA8376.exe PID 2216 wrote to memory of 3148 2216 ZIMUXIA8376.exe ZIMUXIA8376.exe PID 2216 wrote to memory of 3148 2216 ZIMUXIA8376.exe ZIMUXIA8376.exe PID 2216 wrote to memory of 3148 2216 ZIMUXIA8376.exe ZIMUXIA8376.exe PID 3480 wrote to memory of 3344 3480 Explorer.EXE mstsc.exe PID 3480 wrote to memory of 3344 3480 Explorer.EXE mstsc.exe PID 3480 wrote to memory of 3344 3480 Explorer.EXE mstsc.exe PID 3344 wrote to memory of 2936 3344 mstsc.exe cmd.exe PID 3344 wrote to memory of 2936 3344 mstsc.exe cmd.exe PID 3344 wrote to memory of 2936 3344 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ZIMUXIA8376.exe"C:\Users\Admin\AppData\Local\Temp\ZIMUXIA8376.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aBHfONTpHr.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBHfONTpHr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5D24.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\ZIMUXIA8376.exe"C:\Users\Admin\AppData\Local\Temp\ZIMUXIA8376.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ZIMUXIA8376.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ljrl4o4i.kah.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp5D24.tmpFilesize
1KB
MD5c1affc0ca98737729ed34ab38f0a1b33
SHA19a54fe09de920b4e3d23d733f5d672934c43e402
SHA256189f8521251777d608024c32f940cac1f27ca836b1527414a66b04230eeb3603
SHA51274b25901fafeb243c24681cbf7179544684629daa819c882413c7faaf0c785256b442870662f28286745413273d4193abef611b4ee86a6feebdd7d5790cfaf8a
-
memory/1052-38-0x0000000006340000-0x000000000638C000-memory.dmpFilesize
304KB
-
memory/1052-62-0x00000000076E0000-0x0000000007776000-memory.dmpFilesize
600KB
-
memory/1052-70-0x00000000745C0000-0x0000000074D70000-memory.dmpFilesize
7.7MB
-
memory/1052-67-0x0000000007780000-0x0000000007788000-memory.dmpFilesize
32KB
-
memory/1052-66-0x00000000077A0000-0x00000000077BA000-memory.dmpFilesize
104KB
-
memory/1052-65-0x00000000076A0000-0x00000000076B4000-memory.dmpFilesize
80KB
-
memory/1052-64-0x0000000007690000-0x000000000769E000-memory.dmpFilesize
56KB
-
memory/1052-63-0x0000000007660000-0x0000000007671000-memory.dmpFilesize
68KB
-
memory/1052-14-0x0000000004B70000-0x0000000004BA6000-memory.dmpFilesize
216KB
-
memory/1052-16-0x00000000745C0000-0x0000000074D70000-memory.dmpFilesize
7.7MB
-
memory/1052-15-0x0000000005220000-0x0000000005848000-memory.dmpFilesize
6.2MB
-
memory/1052-61-0x00000000074D0000-0x00000000074DA000-memory.dmpFilesize
40KB
-
memory/1052-19-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/1052-18-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/1052-60-0x0000000006810000-0x000000000682A000-memory.dmpFilesize
104KB
-
memory/1052-25-0x0000000005AD0000-0x0000000005B36000-memory.dmpFilesize
408KB
-
memory/1052-22-0x0000000005A60000-0x0000000005AC6000-memory.dmpFilesize
408KB
-
memory/1052-21-0x00000000059C0000-0x00000000059E2000-memory.dmpFilesize
136KB
-
memory/1052-59-0x0000000007B00000-0x000000000817A000-memory.dmpFilesize
6.5MB
-
memory/1052-34-0x0000000005C40000-0x0000000005F94000-memory.dmpFilesize
3.3MB
-
memory/1052-58-0x00000000071D0000-0x0000000007273000-memory.dmpFilesize
652KB
-
memory/1052-56-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/1052-37-0x0000000006130000-0x000000000614E000-memory.dmpFilesize
120KB
-
memory/1052-57-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/1052-55-0x0000000006760000-0x000000000677E000-memory.dmpFilesize
120KB
-
memory/1052-45-0x0000000074E50000-0x0000000074E9C000-memory.dmpFilesize
304KB
-
memory/1052-43-0x00000000066F0000-0x0000000006722000-memory.dmpFilesize
200KB
-
memory/1052-44-0x000000007F350000-0x000000007F360000-memory.dmpFilesize
64KB
-
memory/2216-4-0x0000000005820000-0x0000000005830000-memory.dmpFilesize
64KB
-
memory/2216-9-0x000000000C780000-0x000000000C81C000-memory.dmpFilesize
624KB
-
memory/2216-8-0x0000000009670000-0x00000000096E6000-memory.dmpFilesize
472KB
-
memory/2216-7-0x0000000005AD0000-0x0000000005AE4000-memory.dmpFilesize
80KB
-
memory/2216-1-0x00000000745C0000-0x0000000074D70000-memory.dmpFilesize
7.7MB
-
memory/2216-3-0x0000000005850000-0x00000000058E2000-memory.dmpFilesize
584KB
-
memory/2216-2-0x0000000005E00000-0x00000000063A4000-memory.dmpFilesize
5.6MB
-
memory/2216-5-0x00000000057E0000-0x00000000057EA000-memory.dmpFilesize
40KB
-
memory/2216-6-0x0000000005A80000-0x0000000005AA0000-memory.dmpFilesize
128KB
-
memory/2216-0-0x0000000000E70000-0x0000000000F34000-memory.dmpFilesize
784KB
-
memory/2216-35-0x00000000745C0000-0x0000000074D70000-memory.dmpFilesize
7.7MB
-
memory/3148-36-0x0000000001A30000-0x0000000001D7A000-memory.dmpFilesize
3.3MB
-
memory/3148-40-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3148-41-0x0000000001920000-0x0000000001935000-memory.dmpFilesize
84KB
-
memory/3148-20-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3148-73-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3344-72-0x0000000000770000-0x00000000008AA000-memory.dmpFilesize
1.2MB
-
memory/3344-74-0x0000000000770000-0x00000000008AA000-memory.dmpFilesize
1.2MB
-
memory/3344-75-0x0000000000FD0000-0x0000000000FFF000-memory.dmpFilesize
188KB
-
memory/3480-78-0x0000000008AF0000-0x0000000008C35000-memory.dmpFilesize
1.3MB
-
memory/3480-42-0x0000000002F20000-0x0000000003031000-memory.dmpFilesize
1.1MB