Analysis
- max time kernel
147s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 15:25
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Etisalat Summary Bill for the Month of May.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
General
- Target Etisalat Summary Bill for the Month of May.exe
- Size 1.0MB
- Sample240603-st3eaabh94
- SHA256 bcc5a9772d5c0d2a0db971eff31f5a0e6feccdd6cb8defccbea6f00b5967cf38
- MD5 6eb32cf2b1d4a3b38ef372e6c1d76b04
- SHA1 d72628520b0978a1b1be32f975676858c3d3476c
- SHA512 7e655a1ff81c24052a877ebd116e159a0c1bc79bb05e5b6823ba83c6c269a1a970a98babecd226fe8ffcc16d8bce8da1a56f6730153a695eed5e6b785c5eb4d3
- SSDEEP 24576:wAHnh+eWsN3skA4RV1Hom2KXMmHa2XbblkxUHjtcyd5:nh+ZkldoPK8Ya2XbblkCHjtc8
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
ss63
Decoy
-
catpig.xyz
-
chatladyanzensei7.site
-
onewayonepaydroptaxi.com
-
bima188.lol
-
wealth-km.online
-
seepao27200.top
-
6c958u9.lol
-
fbyu57ytsd.shop
-
baranetentegre.com
-
webaichimie.com
-
h3k38q2.lol
-
abicomsrl.com
-
338kp.vip
-
rescuecube.com
-
bubatz-t.com
-
psgluxuryapartments.com
-
goodfellowlawfirm.com
-
bais141.com
-
imingchu.com
-
ekzeanjfolzaks.top
-
hanweixn.com
-
getwalkapp.com
-
pharm-resources.com
-
montessorigpt.com
-
novaprivatecare.com
-
3656444.com
-
h61u4oxx4sraqjm.buzz
-
vak888.life
-
q43n.top
-
sushiommen.com
-
wvinsiders.com
-
emran-tahhan.com
-
manipulatedalgorithms.com
-
presentiei.shop
-
juntospelors.com
-
j0a6doy1x8eyx.com
-
yexoiup.xyz
-
bricoarq.com
-
hnxymaritime.com
-
selllocaljet.com
-
h5left513.xyz
-
65yty.com
-
everymgs01.com
-
barbaraht.com
-
mx5cucs.xyz
-
checkscamsv.com
-
smpn1madangsuku2.store
-
mixefy.shop
-
gacordewa288.life
-
srisaiprintpack.com
-
gasdepo168.com
-
etancheite-ajaccio.com
-
slow-man.com
-
thewhitehorsepub.biz
-
bay6studio.com
-
djhtshrtshgrg.lol
-
xcxocez.shop
-
games.broker
-
nudkiss.com
-
ccconnectglobal.com
-
wifmilio.com
-
dpuntada.com
-
ads8562.shop
-
diferenciaes.com
-
fashionchc.com
Signatures
- Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/2612-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2612-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/5100-20-0x0000000000FB0000-0x0000000000FDF000-memory.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 320 set thread context of 2612 320 Etisalat Summary Bill for the Month of May.exe 86 PID 2612 set thread context of 3600 2612 svchost.exe 56 PID 5100 set thread context of 3600 5100 wlanext.exe 56 - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 2612 svchost.exe 2612 svchost.exe 2612 svchost.exe 2612 svchost.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe 5100 wlanext.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 320 Etisalat Summary Bill for the Month of May.exe 2612 svchost.exe 2612 svchost.exe 2612 svchost.exe 5100 wlanext.exe 5100 wlanext.exe - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeDebugPrivilege 2612 svchost.exe Token: SeShutdownPrivilege 3600 Explorer.EXE Token: SeCreatePagefilePrivilege 3600 Explorer.EXE Token: SeShutdownPrivilege 3600 Explorer.EXE Token: SeCreatePagefilePrivilege 3600 Explorer.EXE Token: SeShutdownPrivilege 3600 Explorer.EXE Token: SeCreatePagefilePrivilege 3600 Explorer.EXE Token: SeShutdownPrivilege 3600 Explorer.EXE Token: SeCreatePagefilePrivilege 3600 Explorer.EXE Token: SeShutdownPrivilege 3600 Explorer.EXE Token: SeCreatePagefilePrivilege 3600 Explorer.EXE Token: SeShutdownPrivilege 3600 Explorer.EXE Token: SeCreatePagefilePrivilege 3600 Explorer.EXE Token: SeShutdownPrivilege 3600 Explorer.EXE Token: SeCreatePagefilePrivilege 3600 Explorer.EXE Token: SeShutdownPrivilege 3600 Explorer.EXE Token: SeCreatePagefilePrivilege 3600 Explorer.EXE Token: SeDebugPrivilege 5100 wlanext.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 320 Etisalat Summary Bill for the Month of May.exe 320 Etisalat Summary Bill for the Month of May.exe 3600 Explorer.EXE 3600 Explorer.EXE - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 320 Etisalat Summary Bill for the Month of May.exe 320 Etisalat Summary Bill for the Month of May.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3600 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 320 wrote to memory of 2612 320 Etisalat Summary Bill for the Month of May.exe 86 PID 320 wrote to memory of 2612 320 Etisalat Summary Bill for the Month of May.exe 86 PID 320 wrote to memory of 2612 320 Etisalat Summary Bill for the Month of May.exe 86 PID 320 wrote to memory of 2612 320 Etisalat Summary Bill for the Month of May.exe 86 PID 3600 wrote to memory of 5100 3600 Explorer.EXE 87 PID 3600 wrote to memory of 5100 3600 Explorer.EXE 87 PID 3600 wrote to memory of 5100 3600 Explorer.EXE 87 PID 5100 wrote to memory of 3824 5100 wlanext.exe 96 PID 5100 wrote to memory of 3824 5100 wlanext.exe 96 PID 5100 wrote to memory of 3824 5100 wlanext.exe 96
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\Etisalat Summary Bill for the Month of May.exe"C:\Users\Admin\AppData\Local\Temp\Etisalat Summary Bill for the Month of May.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Etisalat Summary Bill for the Month of May.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵PID:3824
-
-