Analysis
-
max time kernel
133s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 02:43
Static task
static1
Behavioral task
behavioral1
Sample
483080c26096e479fad0997bedffb6dd.exe
Resource
win7-20240221-en
General
-
Target
483080c26096e479fad0997bedffb6dd.exe
-
Size
456KB
-
MD5
483080c26096e479fad0997bedffb6dd
-
SHA1
d7362052d9c1451b235075703b6c88f02d5ef71e
-
SHA256
e16af0a74030cfbd17c2086bc1151995852fb5333949a54dfb36bc2992bb87eb
-
SHA512
c976033a62a43766a71c7009d69d464f43f7de75db9228282467c35efcd25ec1905ff8e2c4422351edddd3ca7aa033cd62016b92a6d3ab8b45b6ec8bdb5b61fc
-
SSDEEP
6144:Q/mPIFTMlikyqCQB+cxnQdoQsk+xi72mINsaU9h:Q0UwxyqCwFQdz+ojaU9h
Malware Config
Extracted
formbook
3.9
sa
masleyscabinetshop.com
drmarissathomas.com
alkalinewaterpurifier.com
kabluchok.com
jqm65e51.biz
hellomelmel.com
futsalfutsal.com
speedyrooftarp.com
cyberhostingnet.com
295qp.com
fais-moi-une-offre.com
maketing.today
thedevicreations.com
domuservizi.online
goldanddenim.com
oimkv4.info
benefitmanagementllc401k.com
niniiiiii.com
shortkits.com
nukamika.net
kids0408.com
torcosboard.com
ismartrigos.com
hana-dwi.com
trucker.repair
toolsproxy2.online
durangos.men
unartdevivre.online
silviaevincenzo.com
thebigandgoodfreetoupdates.win
olliesopals.com
www11111vns.com
bluemountain.video
thehivebrewery.com
dewestinnovations.com
downtodonate.com
cheeshingho.com
lcone.info
easydownloads.zone
din95.com
aussiehookupcams.com
zfcoin.net
whipstitchfestivalcider.com
xn--4qwr8q52ftm2b.com
taipurun.com
h3nnyshop.com
tiandaliuxue.com
jualgerabahlombok.com
testdkdk.online
zhot.biz
zyuanli.net
massifhomme.info
zhongdalighting.com
hashnaked.com
stayclassylongbeach.com
yanbozhang.com
familyakers.com
coolmkath.com
healthsfire.com
councilrockwrestling.net
konzil.online
squidhive.com
limachain.com
csdwdz.com
setdop.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1444-11-0x0000000000560000-0x000000000058A000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
483080c26096e479fad0997bedffb6dd.exedescription pid process target process PID 552 set thread context of 1444 552 483080c26096e479fad0997bedffb6dd.exe 483080c26096e479fad0997bedffb6dd.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3496 1444 WerFault.exe 483080c26096e479fad0997bedffb6dd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
483080c26096e479fad0997bedffb6dd.exedescription pid process Token: SeDebugPrivilege 552 483080c26096e479fad0997bedffb6dd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
483080c26096e479fad0997bedffb6dd.exedescription pid process target process PID 552 wrote to memory of 1444 552 483080c26096e479fad0997bedffb6dd.exe 483080c26096e479fad0997bedffb6dd.exe PID 552 wrote to memory of 1444 552 483080c26096e479fad0997bedffb6dd.exe 483080c26096e479fad0997bedffb6dd.exe PID 552 wrote to memory of 1444 552 483080c26096e479fad0997bedffb6dd.exe 483080c26096e479fad0997bedffb6dd.exe PID 552 wrote to memory of 1444 552 483080c26096e479fad0997bedffb6dd.exe 483080c26096e479fad0997bedffb6dd.exe PID 552 wrote to memory of 1444 552 483080c26096e479fad0997bedffb6dd.exe 483080c26096e479fad0997bedffb6dd.exe PID 552 wrote to memory of 1444 552 483080c26096e479fad0997bedffb6dd.exe 483080c26096e479fad0997bedffb6dd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\483080c26096e479fad0997bedffb6dd.exe"C:\Users\Admin\AppData\Local\Temp\483080c26096e479fad0997bedffb6dd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\483080c26096e479fad0997bedffb6dd.exe"C:\Users\Admin\AppData\Local\Temp\483080c26096e479fad0997bedffb6dd.exe"2⤵PID:1444
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 1843⤵
- Program crash
PID:3496
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1444 -ip 14441⤵PID:4460