Overview
overview
10Static
static
3PO 778000 - JPG.exe
windows7-x64
10PO 778000 - JPG.exe
windows10-2004-x64
10$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDIR/vivo.dll
windows7-x64
3$PLUGINSDIR/vivo.dll
windows10-2004-x64
3$TEMP/SecUtil.exe
windows7-x64
1$TEMP/SecUtil.exe
windows10-2004-x64
1$TEMP/luciferase.dll
windows7-x64
1$TEMP/luciferase.dll
windows10-2004-x64
1Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 08:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PO 778000 - JPG.exe
Resource
win7-20231129-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
PO 778000 - JPG.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/vivo.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/vivo.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$TEMP/SecUtil.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
$TEMP/SecUtil.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
$TEMP/luciferase.dll
Resource
win7-20240220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
$TEMP/luciferase.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target PO 778000 - JPG.exe
- Size 338KB
- Sample240603-j2tyfagg6w
- SHA256 77df1a0146ca3b32c884fea68e1c16af0beb5b30876fedb692bed74b6295bad1
- MD5 95913252240e4a65881ed6cc1126be23
- SHA1 9e39d022d13736cf732add2ca97f370ce2c9e704
- SHA512 ea1d233bdad2eab4109d13d45c8220a89c50c6773da142476851b474cb95c26095409688089062bffb1bcdb8e34a520cfeb5e08f82335ecefae144b4fd5e284a
- SSDEEP 6144:Q5lz/PsxMKrNPWG5vy6FQXe2D0ZwBmyeBzqgWw22:AVIpVpq6R2wZwBmGg3
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
formbook
Version
-
3.9
Campaign
-
c206
Decoy
-
dlpglobal.com
-
czxpkj.com
-
gogreencourier.com
-
ageinplacetechnology.net
-
xn--dpqw2zqs4aydk.com
-
kj-gadgetsandgizmos.store
-
conrak.net
-
gzmeike.com
-
emcharlesco.com
-
dreamroomsoft.com
-
ctemplar.life
-
oleum.gmbh
-
memesthingsandeatingclean.com
-
0e9eighthell.men
-
joquinncpa.com
-
thebiscuitfloaters.com
-
boulderebeetles.com
-
vikaspharmacy.com
-
jxfbet2018.info
-
mysexproblemhelper.info
-
shootershackguns.com
-
cbespania.info
-
mycatholicprinting.net
-
hausofschnauzer.com
-
luwangongsi.com
-
loveofthewild.net
-
lighthouse-campus24.com
-
shangweiyoupin.com
-
iqianjiao.com
-
dachfix.com
-
terenium.com
-
liangwisdom.com
-
hejindt.com
-
swiftpaceconsulting.com
-
oregonbfr.com
-
housewebhd.com
-
hematberkah.com
-
salaj.news
-
chicagorefinancespot.com
-
stratocluster.com
-
kentodmen.com
-
pleasecooking.com
-
xinzhids.com
-
semuajadidekat.com
-
studioholz.com
-
wetsx.com
-
alharamjewellers.com
-
georgiasrealfood.com
-
ecotone.solutions
-
375bifa.com
-
vibe.restaurant
-
tellpizzqhut.com
-
standwithunion.com
-
sawtoothindustrial.com
-
mygreatcufflinks.com
-
hypnose-beziers.com
-
mydiscountedhospital.com
-
atlasco.wine
-
pupilfy.com
-
coxemen.com
-
quesovino.com
-
yamatobb.com
-
s1626.com
-
makeharveypay.info
-
jevmod.com
Signatures
- Formbook payload 2 IoCs
resource yara_rule behavioral2/memory/10324-10029-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/10324-10036-0x0000000000400000-0x000000000042A000-memory.dmp formbook - Loads dropped DLL 3 IoCs
pid Process 2364 PO 778000 - JPG.exe 2364 PO 778000 - JPG.exe 2364 PO 778000 - JPG.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CPXDCF = "C:\\Program Files (x86)\\Jip-\\ThumbCachezxrl4nep.exe" cmd.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 10324 set thread context of 3476 10324 cmd.exe 56 PID 8676 set thread context of 3476 8676 cmd.exe 56 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Jip-\ThumbCachezxrl4nep.exe cmd.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\win.ini PO 778000 - JPG.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \Registry\User\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmd.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\ PO 778000 - JPG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\VLC.backup PO 778000 - JPG.exe - Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 2364 PO 778000 - JPG.exe 2364 PO 778000 - JPG.exe 10324 cmd.exe 10324 cmd.exe 10324 cmd.exe 10324 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe 8676 cmd.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2364 PO 778000 - JPG.exe 10324 cmd.exe 10324 cmd.exe 10324 cmd.exe 8676 cmd.exe 8676 cmd.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 10324 cmd.exe Token: SeDebugPrivilege 8676 cmd.exe Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3476 Explorer.EXE - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84 PID 2364 wrote to memory of 10324 2364 PO 778000 - JPG.exe 84
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\PO 778000 - JPG.exe"C:\Users\Admin\AppData\Local\Temp\PO 778000 - JPG.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:10324
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:8676 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"3⤵PID:8756
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:1376
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\DB1
- Size 46KB
- SHA256 776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
- MD5 8f5942354d3809f865f9767eddf51314
- SHA1 20be11c0d42fc0cef53931ea9152b55082d1a11e
- SHA512 fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
- SSDEEP 96:FSXNKLyeymwHCn8MouOFlRGiZqYtFTCG:FSfHG7qqifTCG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\luciferase.dll
- Size 92KB
- SHA256 936babd677d69c25715d1ee19c66c18d33ff439a329c5476d59af2d54ba79bd2
- MD5 696e0a3df2927dde205b3d1894677e1e
- SHA1 b10d49e4c2809e4ea9f814fd6a0a311dad62fbe8
- SHA512 e688abb18745843b2ee018eccfc3de0fc58eb3df39a993a2f825725739862b93950ca2f164f0734e72d64b64f94720746eff4bb6d2c8cc81eb91abeacacc63d9
- SSDEEP 768:/JNGCURaXC8mbKyv7oAk3pfd7fIWmr/ph6KWzmgZh0HA+711t+c4qvOZNIC:XGznoAafd7gWc/pazvqRntKZNI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nst4334.tmp\UserInfo.dll
- Size 4KB
- SHA256 9aa388c7de8e96885adcb4325af871b470ac50edb60d4b0d876ad43f5332ffd1
- MD5 9eb662f3b5fbda28bffe020e0ab40519
- SHA1 0bd28183a9d8dbb98afbcf100fb1f4f6c5fc6c41
- SHA512 6c36f7b45efe792c21d8a87d03e63a4b641169fad6d014db1e7d15badd0e283144d746d888232d6123b551612173b2bb42bf05f16e3129b625f5ddba4134b5b8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nst4334.tmp\vivo.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\win.ini
- Size 131B
- SHA256 c8b84add37da849977a84fe62badb6cb908be99769edb70d60bcd04c0aec2a3f
- MD5 9848e4efb0abd437d65e6d3d1d973adb
- SHA1 f427ac7c50b19f66658ae7f92cbaf21110b49a47
- SHA512 f90f1f65b6b824a526469b8d739f733a54a7f485d8b5f680de7a35fac90786bf6ba5a0b1d62e139663c5ee73b8d687cf32d4ccf188e18c53084ec12d8c216b17
- MD5 SHA1 SHA512