Resubmissions
25-05-2024 15:46
240525-s738qsaa28 10Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 15:46
Static task
static1
Behavioral task
behavioral1
Sample
c4ee18d4a484321620bef6ddd00fc620.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c4ee18d4a484321620bef6ddd00fc620.exe
Resource
win10v2004-20240508-en
General
-
Target
c4ee18d4a484321620bef6ddd00fc620.exe
-
Size
231KB
-
MD5
c4ee18d4a484321620bef6ddd00fc620
-
SHA1
0bb6e51bbd66dfa5afacf3e12ab9789252f2ff57
-
SHA256
4fa4620f075ed6875b96da8c661287fc12c586ddc524c866a6861a6a94a26bee
-
SHA512
563a9e23b48fe1cffb21e73dc92a611bae2431d6a5d2b50d77745169254f2818603c1fda6d2fea3e3b4ce450a94e9a72e62c5bf1f1e4c0ff5e478880a0575b60
-
SSDEEP
6144:qK90Si3cX/ljsdbhmuUhmA3gOETfcfmcb2pY:q50XidohmdOufcOcb1
Malware Config
Extracted
formbook
4.1
zizv
sacramenti.info
ggilrwzkg.icu
jamesmolloymakeup.net
chanelcheap.com
permutator.xyz
axsnaplp.icu
thor-baikyaku.xyz
rcelerity.com
fevirad.com
aroundtheregions.com
destwide.com
haasjustice.com
mindfulmannerllc.com
sanskaridevil.com
matrixcommunication.com
sharytee.com
kalpafoods.com
merchantstash.com
stellerproperties.com
beaute-ekinoxe.com
lettersclothingbrand.com
aomori-marina.com
benjaminrothschild.site
skincaretech.club
themakermaker.com
dianavictoria.life
furniturenearus.com
malkyscatering.com
ibluebelttvshop.com
chasintheblue.com
voezik.store
performanceebitda.com
cgscgroup.com
blogs2live.com
wearesafenyc.com
poiugy.com
luisxe.info
duhdutdut.net
surplussurvivalandstuff.com
bandkite.com
powerschoolteacher.com
ataydijital.com
discovercarpathians.com
minimoonshot.com
zhangdelu.com
braasher.com
advancedroofingofva.com
unitedexcesssurplus.com
daystohunt.com
cubavarato.com
jx2chess.com
powerconmsolutions.com
jtelectric.services
xn--9k3b15fitg.net
wabisabiphotoblog.com
applite-autodesbloqueio.com
xiaobaiyouzhuan.xyz
donalde.design
aditididi.com
yesterdaystomorrownow.com
terrimynatt.com
kwanhome.com
cartooningmasterclass.com
thevitamiumfreeddrops.com
thekalimasigroup.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1244-3-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c4ee18d4a484321620bef6ddd00fc620.exedescription pid process target process PID 1660 set thread context of 1244 1660 c4ee18d4a484321620bef6ddd00fc620.exe c4ee18d4a484321620bef6ddd00fc620.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
c4ee18d4a484321620bef6ddd00fc620.exepid process 1244 c4ee18d4a484321620bef6ddd00fc620.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
c4ee18d4a484321620bef6ddd00fc620.exepid process 1660 c4ee18d4a484321620bef6ddd00fc620.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
xpsrchvw.exepid process 2952 xpsrchvw.exe 2952 xpsrchvw.exe 2952 xpsrchvw.exe 2952 xpsrchvw.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
c4ee18d4a484321620bef6ddd00fc620.exedescription pid process target process PID 1660 wrote to memory of 1244 1660 c4ee18d4a484321620bef6ddd00fc620.exe c4ee18d4a484321620bef6ddd00fc620.exe PID 1660 wrote to memory of 1244 1660 c4ee18d4a484321620bef6ddd00fc620.exe c4ee18d4a484321620bef6ddd00fc620.exe PID 1660 wrote to memory of 1244 1660 c4ee18d4a484321620bef6ddd00fc620.exe c4ee18d4a484321620bef6ddd00fc620.exe PID 1660 wrote to memory of 1244 1660 c4ee18d4a484321620bef6ddd00fc620.exe c4ee18d4a484321620bef6ddd00fc620.exe PID 1660 wrote to memory of 1244 1660 c4ee18d4a484321620bef6ddd00fc620.exe c4ee18d4a484321620bef6ddd00fc620.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4ee18d4a484321620bef6ddd00fc620.exe"C:\Users\Admin\AppData\Local\Temp\c4ee18d4a484321620bef6ddd00fc620.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\c4ee18d4a484321620bef6ddd00fc620.exe"C:\Users\Admin\AppData\Local\Temp\c4ee18d4a484321620bef6ddd00fc620.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1244
-
C:\Windows\System32\xpsrchvw.exe"C:\Windows\System32\xpsrchvw.exe" "C:\Users\Admin\Desktop\WriteExport.xps"1⤵
- Suspicious use of SetWindowsHookEx
PID:2952
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1244-3-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1660-2-0x0000000000270000-0x0000000000272000-memory.dmpFilesize
8KB
-
memory/1660-1-0x0000000000090000-0x0000000000190000-memory.dmpFilesize
1024KB
-
memory/2952-6-0x0000000002780000-0x0000000002781000-memory.dmpFilesize
4KB