Analysis
-
max time kernel
146s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-05-2024 07:40
Static task
static1
Behavioral task
behavioral1
Sample
wkUOj276sJEoMFq.exe
Resource
win7-20240508-en
General
-
Target
wkUOj276sJEoMFq.exe
-
Size
594KB
-
MD5
34b8885c737fa78ecc68c1bf0628f8c0
-
SHA1
32936d1bce243a085c81147f1d569a1c20c44bb2
-
SHA256
380c21fd37cafa3619196df7b6337783921656dbf58f1f54b63c74ad411421e0
-
SHA512
ed336237c0f5c038a1ffd2646b38c1d4cd6f4133e2be0f645f25a9e0b844c3f8f69aa6bcde18a072cc57da434006914ded57e2779084e0244dbbf44a3f193196
-
SSDEEP
12288:zQ3yvK/bBMqQOa/71j+zmxnHJaA8YPGTU+aJczbxLedJJ4iav2hcll0WEm:+yqBMqQOiLnoYeyqzbxuv4im2hcT0fm
Malware Config
Extracted
formbook
4.1
cr12
nff1291.com
satyainfra.com
hechiceradeamores.com
jfgminimalist.com
qut68q.com
pedandmore.com
sugardefender24-usa.us
somalse.com
lotusluxecandle.com
certificadobassetpro.com
veryaroma.com
thehistoryofindia.in
33155.cc
terastudy.net
84031.vip
heilsambegegnen.com
horizon-rg.info
junongpei.website
winstons.club
henslotalt.us
home-care-72875.bond
elmetaversal.com
thetrendingproduct.com
kiki-hello-jury.com
fertami.info
free-cell-phones-en-arena.sbs
emilogiska.com
airexam.in
masters-of-1.com
othersidings.com
fullpaw.com
xmmtrader.com
astronomersparadise.net
cert.agency
pools-97641.bond
forexsignals-trading.com
bxsmediaconsulting.com
perfectedskincare.com
footresort.com
warehouse-inventory-80963.bond
purifygenius.com
bolinkpass.club
velleclub.com
epuar.com
winningpickleballshots.com
spiaggia.club
kadinzuri.com
keyboards-280323.cfd
africanfemalefounders.club
tkoelectriical.com
wg5688.com
properrr.com
fortune-tiger-rede.com
65302.vip
psychologyzerodegrees.today
top99bet4d.site
priuswuxi.com
carneden.com
ptwix.xyz
furniture-70925.bond
064817.com
ferradaoffroad.com
pix2click.life
jurj.xyz
spiritualpath.info
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/448-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/448-16-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/228-23-0x0000000000880000-0x00000000008AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
wkUOj276sJEoMFq.exewkUOj276sJEoMFq.exeraserver.exedescription pid process target process PID 2660 set thread context of 448 2660 wkUOj276sJEoMFq.exe wkUOj276sJEoMFq.exe PID 448 set thread context of 3388 448 wkUOj276sJEoMFq.exe Explorer.EXE PID 228 set thread context of 3388 228 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
wkUOj276sJEoMFq.exeraserver.exepid process 448 wkUOj276sJEoMFq.exe 448 wkUOj276sJEoMFq.exe 448 wkUOj276sJEoMFq.exe 448 wkUOj276sJEoMFq.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe 228 raserver.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
wkUOj276sJEoMFq.exeraserver.exepid process 448 wkUOj276sJEoMFq.exe 448 wkUOj276sJEoMFq.exe 448 wkUOj276sJEoMFq.exe 228 raserver.exe 228 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
wkUOj276sJEoMFq.exeraserver.exedescription pid process Token: SeDebugPrivilege 448 wkUOj276sJEoMFq.exe Token: SeDebugPrivilege 228 raserver.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3388 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
wkUOj276sJEoMFq.exeExplorer.EXEraserver.exedescription pid process target process PID 2660 wrote to memory of 448 2660 wkUOj276sJEoMFq.exe wkUOj276sJEoMFq.exe PID 2660 wrote to memory of 448 2660 wkUOj276sJEoMFq.exe wkUOj276sJEoMFq.exe PID 2660 wrote to memory of 448 2660 wkUOj276sJEoMFq.exe wkUOj276sJEoMFq.exe PID 2660 wrote to memory of 448 2660 wkUOj276sJEoMFq.exe wkUOj276sJEoMFq.exe PID 2660 wrote to memory of 448 2660 wkUOj276sJEoMFq.exe wkUOj276sJEoMFq.exe PID 2660 wrote to memory of 448 2660 wkUOj276sJEoMFq.exe wkUOj276sJEoMFq.exe PID 3388 wrote to memory of 228 3388 Explorer.EXE raserver.exe PID 3388 wrote to memory of 228 3388 Explorer.EXE raserver.exe PID 3388 wrote to memory of 228 3388 Explorer.EXE raserver.exe PID 228 wrote to memory of 4360 228 raserver.exe cmd.exe PID 228 wrote to memory of 4360 228 raserver.exe cmd.exe PID 228 wrote to memory of 4360 228 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wkUOj276sJEoMFq.exe"C:\Users\Admin\AppData\Local\Temp\wkUOj276sJEoMFq.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wkUOj276sJEoMFq.exe"C:\Users\Admin\AppData\Local\Temp\wkUOj276sJEoMFq.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\wkUOj276sJEoMFq.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/228-23-0x0000000000880000-0x00000000008AF000-memory.dmpFilesize
188KB
-
memory/228-22-0x00000000009E0000-0x00000000009FF000-memory.dmpFilesize
124KB
-
memory/228-19-0x00000000009E0000-0x00000000009FF000-memory.dmpFilesize
124KB
-
memory/448-11-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/448-16-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/448-17-0x0000000000DC0000-0x0000000000DD4000-memory.dmpFilesize
80KB
-
memory/448-14-0x0000000001240000-0x000000000158A000-memory.dmpFilesize
3.3MB
-
memory/2660-6-0x0000000005290000-0x00000000052A6000-memory.dmpFilesize
88KB
-
memory/2660-1-0x0000000000450000-0x00000000004EA000-memory.dmpFilesize
616KB
-
memory/2660-9-0x0000000006140000-0x00000000061B6000-memory.dmpFilesize
472KB
-
memory/2660-10-0x0000000009130000-0x00000000091CC000-memory.dmpFilesize
624KB
-
memory/2660-7-0x0000000006110000-0x000000000611C000-memory.dmpFilesize
48KB
-
memory/2660-13-0x0000000075010000-0x00000000757C0000-memory.dmpFilesize
7.7MB
-
memory/2660-0-0x000000007501E000-0x000000007501F000-memory.dmpFilesize
4KB
-
memory/2660-5-0x0000000075010000-0x00000000757C0000-memory.dmpFilesize
7.7MB
-
memory/2660-4-0x00000000050A0000-0x00000000050AA000-memory.dmpFilesize
40KB
-
memory/2660-8-0x0000000006120000-0x0000000006130000-memory.dmpFilesize
64KB
-
memory/2660-3-0x0000000004EE0000-0x0000000004F72000-memory.dmpFilesize
584KB
-
memory/2660-2-0x0000000005560000-0x0000000005B04000-memory.dmpFilesize
5.6MB
-
memory/3388-18-0x0000000009010000-0x00000000091B9000-memory.dmpFilesize
1.7MB
-
memory/3388-25-0x0000000009010000-0x00000000091B9000-memory.dmpFilesize
1.7MB
-
memory/3388-28-0x00000000036B0000-0x00000000037A9000-memory.dmpFilesize
996KB
-
memory/3388-29-0x00000000036B0000-0x00000000037A9000-memory.dmpFilesize
996KB
-
memory/3388-32-0x00000000036B0000-0x00000000037A9000-memory.dmpFilesize
996KB