Analysis
- max time kernel
147s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
16/05/2024, 02:48
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
8650787630e554e6390a6d98c7b556f36af59ce72998c4660cbec74091cb2b09.exe
Resource
win7-20240508-en
windows7-x64
9 signatures
150 seconds
General
- Target 8650787630e554e6390a6d98c7b556f36af59ce72998c4660cbec74091cb2b09.exe
- Size 1.0MB
- Sample240516-dajeqsha5x
- SHA256 8650787630e554e6390a6d98c7b556f36af59ce72998c4660cbec74091cb2b09
- MD5 4bf8cec7b9259caf98331b42736b7fd9
- SHA1 beb1a54bf4c5a3548203899a75c2567db2516d58
- SHA512 c9a4c788b4db2a2e98470d880bb66cd5a02950f10dd8c5034eb2bd46ef325bac565e1140a92fba32d5d2b2765277dfd9c63ec0f7639d84792049bc8b1947daf4
- SSDEEP 24576:4AHnh+eWsN3skA4RV1Hom2KXMmHa8Y5qGHLnPRMpqiA5:/h+ZkldoPK8Ya8YQmnPR2G
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
se63
Decoy
-
socratesandhisclouds.com
-
versioncolor.com
-
ytcp011.com
-
908511.vip
-
egysrvs.com
-
ky5682011.cc
-
kkuu14.icu
-
wavebsb.com
-
klikadelivery.com
-
jnbxbpq.com
-
5o8oh.us
-
hemule.net
-
techinf.xyz
-
bevage.club
-
we37h.com
-
tipsde.shop
-
48136.vip
-
bestcampertrailerbrands.com
-
fairmedics.in
-
quixonic.tech
-
aldcr.in
-
drepeacewp.com
-
odty914.net
-
live2move.us
-
galeriaspognardi.com
-
danauslot.shop
-
usapubpong.com
-
jingchen.xyz
-
xztyvk.xyz
-
butimarproductions.com
-
wuhangyjs.com
-
baddogdigital.com
-
mb28apparel.com
-
bnkk9o3zrgsy5.quest
-
playsolutionsinc.com
-
warriors4earth.com
-
gastric-balloon-71533.bond
-
adptgn.com
-
psicologiaparausted.com
-
gothecleaningpros.com
-
xnc8ki.vip
-
908511.vip
-
ozr3np.com
-
tradingbase.cloud
-
36h9.com
-
iaobet.net
-
6902470365.com
-
qasolvers.in
-
00047.vip
-
massiverole.shop
-
used-cars-66201.bond
-
baisexual.com
-
shoreswimschool.com
-
shrike.foo
-
shemosservicesllc.net
-
electric-cars-97134.bond
-
aicryptochain.com
-
wg5688.com
-
nomades.digital
-
thesiamesebetta.store
-
abbymartz.com
-
kimsnailsii.top
-
producepatch.shop
-
ebridgereal.site
-
cincinnatisoup.com
Signatures
- Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/1200-11-0x0000000000490000-0x00000000004BF000-memory.dmp formbook behavioral2/memory/1200-15-0x0000000000490000-0x00000000004BF000-memory.dmp formbook behavioral2/memory/4008-20-0x00000000008E0000-0x000000000090F000-memory.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3904 set thread context of 1200 3904 8650787630e554e6390a6d98c7b556f36af59ce72998c4660cbec74091cb2b09.exe 86 PID 1200 set thread context of 3520 1200 svchost.exe 55 PID 4008 set thread context of 3520 4008 systray.exe 55 - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe 4008 systray.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 3904 8650787630e554e6390a6d98c7b556f36af59ce72998c4660cbec74091cb2b09.exe 3904 8650787630e554e6390a6d98c7b556f36af59ce72998c4660cbec74091cb2b09.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 4008 systray.exe 4008 systray.exe - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeDebugPrivilege 1200 svchost.exe Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeDebugPrivilege 4008 systray.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3904 8650787630e554e6390a6d98c7b556f36af59ce72998c4660cbec74091cb2b09.exe 3904 8650787630e554e6390a6d98c7b556f36af59ce72998c4660cbec74091cb2b09.exe 3520 Explorer.EXE 3520 Explorer.EXE - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3904 8650787630e554e6390a6d98c7b556f36af59ce72998c4660cbec74091cb2b09.exe 3904 8650787630e554e6390a6d98c7b556f36af59ce72998c4660cbec74091cb2b09.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3520 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3904 wrote to memory of 1200 3904 8650787630e554e6390a6d98c7b556f36af59ce72998c4660cbec74091cb2b09.exe 86 PID 3904 wrote to memory of 1200 3904 8650787630e554e6390a6d98c7b556f36af59ce72998c4660cbec74091cb2b09.exe 86 PID 3904 wrote to memory of 1200 3904 8650787630e554e6390a6d98c7b556f36af59ce72998c4660cbec74091cb2b09.exe 86 PID 3904 wrote to memory of 1200 3904 8650787630e554e6390a6d98c7b556f36af59ce72998c4660cbec74091cb2b09.exe 86 PID 3520 wrote to memory of 4008 3520 Explorer.EXE 87 PID 3520 wrote to memory of 4008 3520 Explorer.EXE 87 PID 3520 wrote to memory of 4008 3520 Explorer.EXE 87 PID 4008 wrote to memory of 4000 4008 systray.exe 96 PID 4008 wrote to memory of 4000 4008 systray.exe 96 PID 4008 wrote to memory of 4000 4008 systray.exe 96
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\8650787630e554e6390a6d98c7b556f36af59ce72998c4660cbec74091cb2b09.exe"C:\Users\Admin\AppData\Local\Temp\8650787630e554e6390a6d98c7b556f36af59ce72998c4660cbec74091cb2b09.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\8650787630e554e6390a6d98c7b556f36af59ce72998c4660cbec74091cb2b09.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1200
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵PID:4000
-
-