Analysis
-
max time kernel
140s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 02:58
Static task
static1
Behavioral task
behavioral1
Sample
d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exe
Resource
win7-20240221-en
General
-
Target
d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exe
-
Size
643KB
-
MD5
54c09b432ceed3439d758f235ac8ec1d
-
SHA1
c384270d0c1f59c48b36614c20d31d8591600bf1
-
SHA256
d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1
-
SHA512
df0a62086926edaa2d011439cbee9e25c70440e847e0e21430caa419b79220ebbb613d43ec4a2dbc5d655571f556c8c6693b1e4d324b357f189519cb93d32cdb
-
SSDEEP
12288:7drLbDZaNRpA40Yo2W1ymtumaumtf+aqf+cx8GdMPhvla3i:pLDZMRpxlu8kumRmKMP+
Malware Config
Extracted
formbook
4.1
sl07
stryper.net
riseandvibetime.com
thebenmorley.com
kdfdq.com
pet4cus.com
agrosoft.farm
utopiagood.com
sanduskyspeedway.com
eldozz-quarter.top
weixuninvest.com
taxiboativano.net
odvip377.com
bubblegome.com
peakwealtharchitects.com
mondaytoyoulive.lat
huohullq.com
the-inferno-slots-casino.top
yy88abcd88yyy.xyz
azbenfica.com
hunectar.com
6609.us
softenamelpins.com
lv46gc.vip
kancase.com
mygpmoments.com
0ezutb.com
schoolsafetysummit.com
fc888.life
desscz.info
sandibet88.net
qwlvxdxsyyxvmcv.college
whiteningsolutions.life
sobattoto.lol
wholesalefreshweed.com
catchaone.com
wanderingmemoriess.com
2taobao413ba.xyz
mcc888.info
juthaiworld.com
mufvrr.com
columbusjacks.com
othershealth.com
ventureinproperties.com
8gvip116.top
bifocalsunnies.shop
arch-it.tech
descartesmedical.com
nexaportfoliostrategies.com
icloud-idevicesmaps.us
dyerene.com
thesunflowercarwash.com
crystalcreekcraftsllc.store
gocumgirl.com
annelizabethco.com
nice888-web.com
totaleclipse2044.com
servicioelectrigas.com
uwaco.xyz
trumpmagiccoin.xyz
starnaloja.com
usxng.pw
mellox.net
glassemergencyreplacement.com
fptcoaching.com
manuelcastanho.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1508-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exedescription pid process target process PID 2860 set thread context of 1508 2860 d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exe d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exepid process 1508 d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exe 1508 d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exedescription pid process target process PID 2860 wrote to memory of 1508 2860 d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exe d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exe PID 2860 wrote to memory of 1508 2860 d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exe d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exe PID 2860 wrote to memory of 1508 2860 d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exe d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exe PID 2860 wrote to memory of 1508 2860 d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exe d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exe PID 2860 wrote to memory of 1508 2860 d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exe d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exe PID 2860 wrote to memory of 1508 2860 d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exe d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exe"C:\Users\Admin\AppData\Local\Temp\d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exe"C:\Users\Admin\AppData\Local\Temp\d7e1f067ee0b2d5556d1f7b1fdee8b0cf099ca3f45cf412d115440d79d76ebb1.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1508-11-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1508-15-0x0000000001560000-0x00000000018AA000-memory.dmpFilesize
3.3MB
-
memory/1508-14-0x0000000001560000-0x00000000018AA000-memory.dmpFilesize
3.3MB
-
memory/2860-5-0x0000000074B40000-0x00000000752F0000-memory.dmpFilesize
7.7MB
-
memory/2860-4-0x00000000056A0000-0x00000000056AA000-memory.dmpFilesize
40KB
-
memory/2860-6-0x0000000005A30000-0x0000000005ACC000-memory.dmpFilesize
624KB
-
memory/2860-0-0x0000000074B4E000-0x0000000074B4F000-memory.dmpFilesize
4KB
-
memory/2860-7-0x0000000005780000-0x00000000057A2000-memory.dmpFilesize
136KB
-
memory/2860-8-0x0000000005960000-0x000000000596C000-memory.dmpFilesize
48KB
-
memory/2860-9-0x0000000002F20000-0x0000000002F30000-memory.dmpFilesize
64KB
-
memory/2860-10-0x00000000067D0000-0x0000000006846000-memory.dmpFilesize
472KB
-
memory/2860-3-0x00000000056B0000-0x0000000005742000-memory.dmpFilesize
584KB
-
memory/2860-13-0x0000000074B40000-0x00000000752F0000-memory.dmpFilesize
7.7MB
-
memory/2860-2-0x0000000005D60000-0x0000000006304000-memory.dmpFilesize
5.6MB
-
memory/2860-1-0x0000000000C00000-0x0000000000CA6000-memory.dmpFilesize
664KB