Analysis
-
max time kernel
16s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 19:38
Static task
static1
Behavioral task
behavioral1
Sample
rDocumentodesolicitacaodepedidoNo24850.exe
Resource
win7-20240221-en
General
-
Target
rDocumentodesolicitacaodepedidoNo24850.exe
-
Size
664KB
-
MD5
316d52ffa3e819ca0afe9c8c70e93eee
-
SHA1
136f3ed7b097d9af4046c7119c0f8856c67df474
-
SHA256
bd90dba924ee14fc81a245124d6e9b425b290f83cd793f76573b1408ebf5f284
-
SHA512
bbca5419b73df55e068e42fa86702313a7843daa846f18aa41437fba21992cc07c6aa30bbbf641582765648bfe617afd8e7f361f95d6bb14447752da543f8952
-
SSDEEP
12288:nJEasCzbd0aBJHAKoumkG7yC9AhPhakJzJGMjta9c3kOdJhC+mugBY:7sVCgQA9LyJGMJT0c09
Malware Config
Extracted
formbook
4.1
pz12
paucanyes.com
autonwheels.com
cowboysandcaviarbar.com
fitnessengineeredworkouts.com
nuevobajonfavorito.com
dflx8.com
rothability.com
sxybet88.com
onesource.live
brenjitu1904.com
airdrop-zero1labs.com
guangdongqiangzhetc.com
apartments-for-rent-72254.bond
ombak99.lol
qqfoodsolutions.com
kyyzz.com
thepicklematch.com
ainth.com
missorris.com
gabbygomez.com
aromacuppa.com
kaskusbagus.com
zoox1.asia
hemophilia-treatment-41433.bond
meidupro.com
shrisona.com
sekanse.com
marcocostasax.com
loyalbahis356.com
mzmz97.com
ma-google.com
xiangadvanced.site
tuotalogis.com
xcxocef.shop
fidgetbottles.com
shuaninvolved.site
ambientelatino.com
98980901.com
singhbrothersframes.com
pureamyl.com
hgs0713.net
surejobzapp.com
slotgame99.bet
datalakeflow.com
ebehemin.com
vanessasmobilespa.com
317wb.com
motchillssss.top
huesch.net
salesgymshark.shop
mejorcompra99.com
tacubashop.com
jessicaxsimmons.com
roar-stores.com
chalkandthimble.com
84556.vip
luyutuwen.com
siliconcollege.icu
marvowhite.com
gjxuh82y0u3h6.top
e2taop5.top
businessbroadway.com
cripmz.xyz
4hu259.com
jnhdh8827.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2632-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
rDocumentodesolicitacaodepedidoNo24850.exedescription pid process target process PID 2024 set thread context of 2632 2024 rDocumentodesolicitacaodepedidoNo24850.exe rDocumentodesolicitacaodepedidoNo24850.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rDocumentodesolicitacaodepedidoNo24850.exedescription pid process target process PID 2024 wrote to memory of 2092 2024 rDocumentodesolicitacaodepedidoNo24850.exe powershell.exe PID 2024 wrote to memory of 2092 2024 rDocumentodesolicitacaodepedidoNo24850.exe powershell.exe PID 2024 wrote to memory of 2092 2024 rDocumentodesolicitacaodepedidoNo24850.exe powershell.exe PID 2024 wrote to memory of 2092 2024 rDocumentodesolicitacaodepedidoNo24850.exe powershell.exe PID 2024 wrote to memory of 2632 2024 rDocumentodesolicitacaodepedidoNo24850.exe rDocumentodesolicitacaodepedidoNo24850.exe PID 2024 wrote to memory of 2632 2024 rDocumentodesolicitacaodepedidoNo24850.exe rDocumentodesolicitacaodepedidoNo24850.exe PID 2024 wrote to memory of 2632 2024 rDocumentodesolicitacaodepedidoNo24850.exe rDocumentodesolicitacaodepedidoNo24850.exe PID 2024 wrote to memory of 2632 2024 rDocumentodesolicitacaodepedidoNo24850.exe rDocumentodesolicitacaodepedidoNo24850.exe PID 2024 wrote to memory of 2632 2024 rDocumentodesolicitacaodepedidoNo24850.exe rDocumentodesolicitacaodepedidoNo24850.exe PID 2024 wrote to memory of 2632 2024 rDocumentodesolicitacaodepedidoNo24850.exe rDocumentodesolicitacaodepedidoNo24850.exe PID 2024 wrote to memory of 2632 2024 rDocumentodesolicitacaodepedidoNo24850.exe rDocumentodesolicitacaodepedidoNo24850.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\rDocumentodesolicitacaodepedidoNo24850.exe"C:\Users\Admin\AppData\Local\Temp\rDocumentodesolicitacaodepedidoNo24850.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\rDocumentodesolicitacaodepedidoNo24850.exe"2⤵
- Command and Scripting Interpreter: PowerShell
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\rDocumentodesolicitacaodepedidoNo24850.exe"C:\Users\Admin\AppData\Local\Temp\rDocumentodesolicitacaodepedidoNo24850.exe"2⤵PID:2632
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2024-6-0x0000000000790000-0x00000000007A0000-memory.dmpFilesize
64KB
-
memory/2024-5-0x0000000000560000-0x000000000056C000-memory.dmpFilesize
48KB
-
memory/2024-3-0x0000000004270000-0x000000000431C000-memory.dmpFilesize
688KB
-
memory/2024-2-0x00000000745F0000-0x0000000074CDE000-memory.dmpFilesize
6.9MB
-
memory/2024-1-0x0000000000BA0000-0x0000000000C4C000-memory.dmpFilesize
688KB
-
memory/2024-0-0x00000000745FE000-0x00000000745FF000-memory.dmpFilesize
4KB
-
memory/2024-4-0x0000000000760000-0x0000000000782000-memory.dmpFilesize
136KB
-
memory/2024-7-0x0000000007E60000-0x0000000007ED6000-memory.dmpFilesize
472KB
-
memory/2024-18-0x00000000745F0000-0x0000000074CDE000-memory.dmpFilesize
6.9MB
-
memory/2632-15-0x0000000000770000-0x0000000000A73000-memory.dmpFilesize
3.0MB
-
memory/2632-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2632-14-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2632-10-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2632-9-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB