Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 08:59
Static task
static1
Behavioral task
behavioral1
Sample
v0hRSGca3D2Z7cW.exe
Resource
win7-20240215-en
General
-
Target
v0hRSGca3D2Z7cW.exe
-
Size
779KB
-
MD5
79869ac2557f532c7db50785f59f8057
-
SHA1
4458bc01d37a3a3feb24b8da5b9f8190356c59d8
-
SHA256
6465b2c5702a723c7229e33fdf38676e3b0e0049b5b632e2fe6e210713f6a7e7
-
SHA512
b2079da931d878accc6c2f7f81f07b313689bcbeccb7319a3b1fac7dcf3abfc44406a40d48215bd8d74519bed1d266a3ccb81549b5fe14bd41c4600698647fea
-
SSDEEP
12288:HuqnHvjNIrpf9rN/mc/ChYgp70NtH95FYIqe17df6dFFHCApvlmJg0kR:H7PjKr5BNDUYgl8tdDY1qBf6d/HCApdr
Malware Config
Extracted
formbook
4.1
be03
458q14v4ams2.com
priceoctopus.com
betinplay.xyz
bcnd.xyz
1510soliveavenue.com
mcdpropertypros.com
reddcrownexpress.com
rewardlabs.shop
burenbrand.com
revand.io
tractionendurancecoaching.com
jotaerreshopp.com
shopboyg.com
dakor.shop
groundswellmag.life
nehagadodia.com
dancarellibizbroker.com
meconline.co
ttmq.cc
thegoldenyouph.com
poolcenter.store
portalesexpress.com
okltyf.xyz
wnkj001.site
wltk.site
nexosmedic.com
cartell.app
yteam.tech
gpt-toolbox.io
plexirecruiters.com
beerattraction.com
11111bet365.com
24laura.info
stupididiotmoron.com
test-igot.com
gramotnosti.store
truck-driver-jobs-2024.online
fundedxprop.com
xpendly.cc
mobtruecrime.com
3051harborview.com
6891ybfh.xyz
growthpfad.com
sygtrainings.com
fastgrowthleads.com
kiwiceleste.store
fidesinvicta.com
oneupmushroom.store
socialsellingbootcamp.com
dy-gmvrp.xyz
d3cargo.com
6ixsoft.com
fengyuncq.com
stmerry888.com
yahliker.online
numoneypro.com
jadediver.com
lauvhoney.com
oirdesign.com
robobussy.com
healthstartsinyour20s.com
roofing-jobs4-in-205nz.today
alexisfennillustration.com
abandoned-houses-se-0.bond
j88.kids
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1416-10-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1416-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3068-20-0x0000000000120000-0x000000000014F000-memory.dmp formbook behavioral2/memory/3068-22-0x0000000000120000-0x000000000014F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
v0hRSGca3D2Z7cW.exev0hRSGca3D2Z7cW.execmmon32.exedescription pid process target process PID 4180 set thread context of 1416 4180 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 1416 set thread context of 3432 1416 v0hRSGca3D2Z7cW.exe Explorer.EXE PID 3068 set thread context of 3432 3068 cmmon32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
v0hRSGca3D2Z7cW.execmmon32.exepid process 1416 v0hRSGca3D2Z7cW.exe 1416 v0hRSGca3D2Z7cW.exe 1416 v0hRSGca3D2Z7cW.exe 1416 v0hRSGca3D2Z7cW.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
v0hRSGca3D2Z7cW.execmmon32.exepid process 1416 v0hRSGca3D2Z7cW.exe 1416 v0hRSGca3D2Z7cW.exe 1416 v0hRSGca3D2Z7cW.exe 3068 cmmon32.exe 3068 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
v0hRSGca3D2Z7cW.execmmon32.exedescription pid process Token: SeDebugPrivilege 1416 v0hRSGca3D2Z7cW.exe Token: SeDebugPrivilege 3068 cmmon32.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
Explorer.EXEpid process 3432 Explorer.EXE 3432 Explorer.EXE 3432 Explorer.EXE -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
Explorer.EXEpid process 3432 Explorer.EXE 3432 Explorer.EXE 3432 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3432 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
v0hRSGca3D2Z7cW.exeExplorer.EXEcmmon32.exedescription pid process target process PID 4180 wrote to memory of 1416 4180 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 4180 wrote to memory of 1416 4180 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 4180 wrote to memory of 1416 4180 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 4180 wrote to memory of 1416 4180 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 4180 wrote to memory of 1416 4180 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 4180 wrote to memory of 1416 4180 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 3432 wrote to memory of 3068 3432 Explorer.EXE cmmon32.exe PID 3432 wrote to memory of 3068 3432 Explorer.EXE cmmon32.exe PID 3432 wrote to memory of 3068 3432 Explorer.EXE cmmon32.exe PID 3068 wrote to memory of 2908 3068 cmmon32.exe cmd.exe PID 3068 wrote to memory of 2908 3068 cmmon32.exe cmd.exe PID 3068 wrote to memory of 2908 3068 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v0hRSGca3D2Z7cW.exe"C:\Users\Admin\AppData\Local\Temp\v0hRSGca3D2Z7cW.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v0hRSGca3D2Z7cW.exe"C:\Users\Admin\AppData\Local\Temp\v0hRSGca3D2Z7cW.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\v0hRSGca3D2Z7cW.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1416-10-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1416-15-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1416-16-0x0000000001000000-0x0000000001014000-memory.dmpFilesize
80KB
-
memory/1416-13-0x0000000001070000-0x00000000013BA000-memory.dmpFilesize
3.3MB
-
memory/3068-20-0x0000000000120000-0x000000000014F000-memory.dmpFilesize
188KB
-
memory/3068-18-0x0000000000370000-0x000000000037C000-memory.dmpFilesize
48KB
-
memory/3068-24-0x0000000002180000-0x0000000002213000-memory.dmpFilesize
588KB
-
memory/3068-22-0x0000000000120000-0x000000000014F000-memory.dmpFilesize
188KB
-
memory/3068-21-0x0000000002300000-0x000000000264A000-memory.dmpFilesize
3.3MB
-
memory/3068-19-0x0000000000370000-0x000000000037C000-memory.dmpFilesize
48KB
-
memory/3432-17-0x0000000008E80000-0x0000000008FF2000-memory.dmpFilesize
1.4MB
-
memory/3432-25-0x0000000008E80000-0x0000000008FF2000-memory.dmpFilesize
1.4MB
-
memory/3432-35-0x0000000007B80000-0x0000000007CC2000-memory.dmpFilesize
1.3MB
-
memory/3432-32-0x0000000007B80000-0x0000000007CC2000-memory.dmpFilesize
1.3MB
-
memory/3432-31-0x0000000007B80000-0x0000000007CC2000-memory.dmpFilesize
1.3MB
-
memory/4180-9-0x000000000BE40000-0x000000000BEDC000-memory.dmpFilesize
624KB
-
memory/4180-4-0x0000000005110000-0x0000000005120000-memory.dmpFilesize
64KB
-
memory/4180-12-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/4180-1-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/4180-8-0x0000000008D30000-0x0000000008DA6000-memory.dmpFilesize
472KB
-
memory/4180-7-0x00000000052F0000-0x0000000005304000-memory.dmpFilesize
80KB
-
memory/4180-6-0x0000000005330000-0x0000000005350000-memory.dmpFilesize
128KB
-
memory/4180-5-0x0000000004F40000-0x0000000004F4A000-memory.dmpFilesize
40KB
-
memory/4180-0-0x00000000003E0000-0x00000000004A4000-memory.dmpFilesize
784KB
-
memory/4180-2-0x0000000005360000-0x0000000005904000-memory.dmpFilesize
5.6MB
-
memory/4180-3-0x0000000004E90000-0x0000000004F22000-memory.dmpFilesize
584KB