Analysis
- max time kernel
298s - max time network
293s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system - submitted
06/06/2024, 14:35
Static task
static1
Behavioral task
behavioral1
Sample
Tlcf4ubbOhvrFYkon.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
300 seconds
General
- Target Tlcf4ubbOhvrFYkon.exe
- Size 591KB
- Sample240606-rx229agd96
- SHA256 a3474b0f77b365c5bb21ee74a83575788f6009263c725c592cfef674e22915d4
- MD5 9c4b350eb7315c2f6f4b2eb64bccd918
- SHA1 85b8ecde652c7fcd28b609f4ca34e8233e282ffe
- SHA512 5c009b3ef1f76f7c688cdca9ff6b54d8db1d0b026ea862d5ab12e41b4389c8b2932d35e9561373516dc9370f07fb37145f727a87da5d74f7ecb12a5ce19b4572
- SSDEEP 12288:LZxxAYeicWjZSvFNlHXOBDLFo/uL4dbV1I2DmzDy7VS04tP:LPxLgWlMJHXOBDLFUdbV1I2DV79G
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
muti
Decoy
-
faceboo-com.com
-
abgagp.cfd
-
fksclp.cfd
-
psyco.space
-
eshopkhaliji.store
-
ecogreendiamond.com
-
marif.site
-
watchingshortfilm.com
-
kampspacex.com
-
fordeentertainment.com
-
trendingl.com
-
shopadamsstore.com
-
ufgcgz.cfd
-
huananzi.com
-
admire.services
-
jujuvex.top
-
glirmmpse7.com
-
swommoly.com
-
caxars.store
-
florts.site
-
sohu.store
-
randyhicks.com
-
plastivision2023.net
-
cheneymodeling.com
-
180gjfdz02.xyz
-
yukbmnuw.top
-
tuifoundationinc.com
-
miulwow.top
-
beijingivyleague.com
-
h3omvz.icu
-
angies.tech
-
houseofshorts.com
-
cogitabat.com
-
odpackage.com
-
horsebackbrazil.net
-
66861656.app
-
boschimp.cloud
-
nbdkcygs.com
-
cosmeticycle.net
-
chenalon.dev
-
x.investments
-
taiyuanguoji14.com
-
anshenterprises.online
-
baineadvisory.com
-
megaachadinho.com
-
hobbyone.biz
-
flcc555.com
-
933333hs.com
-
xtacr.com
-
masterz-fitness.com
-
bellabooze.com
-
cty6c.com
-
6rqh25.cfd
-
jemstitches.com
-
jobsnetgulf.com
-
wallofevenements.com
-
aucoq.net
-
yzjnms.com
-
iidjzl.cfd
-
szyz-ceb.com
-
wellnesswithruchi.net
-
marsenburg.com
-
fuckloganpaul.net
-
segurocanino.com
-
stresslessobsessed.com
Signatures
- Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/3224-4-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3224-7-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2188-15-0x0000000000FA0000-0x0000000000FCF000-memory.dmp formbook - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GXFPDXVXX = "C:\\Program Files (x86)\\Windows Media Player\\wmplayer.exe" WWAHost.exe Key created \Registry\User\S-1-5-21-3107365284-1576850094-161165143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run WWAHost.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1184 set thread context of 3224 1184 Tlcf4ubbOhvrFYkon.exe 82 PID 3224 set thread context of 3276 3224 wmplayer.exe 53 PID 2188 set thread context of 3276 2188 WWAHost.exe 53 -
description ioc Process Key created \Registry\User\S-1-5-21-3107365284-1576850094-161165143-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 WWAHost.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3224 wmplayer.exe 3224 wmplayer.exe 3224 wmplayer.exe 3224 wmplayer.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 3224 wmplayer.exe 3224 wmplayer.exe 3224 wmplayer.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe 2188 WWAHost.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 1184 Tlcf4ubbOhvrFYkon.exe Token: SeDebugPrivilege 3224 wmplayer.exe Token: SeShutdownPrivilege 3276 Explorer.EXE Token: SeCreatePagefilePrivilege 3276 Explorer.EXE Token: SeShutdownPrivilege 3276 Explorer.EXE Token: SeCreatePagefilePrivilege 3276 Explorer.EXE Token: SeShutdownPrivilege 3276 Explorer.EXE Token: SeCreatePagefilePrivilege 3276 Explorer.EXE Token: SeShutdownPrivilege 3276 Explorer.EXE Token: SeCreatePagefilePrivilege 3276 Explorer.EXE Token: SeShutdownPrivilege 3276 Explorer.EXE Token: SeCreatePagefilePrivilege 3276 Explorer.EXE Token: SeShutdownPrivilege 3276 Explorer.EXE Token: SeCreatePagefilePrivilege 3276 Explorer.EXE Token: SeShutdownPrivilege 3276 Explorer.EXE Token: SeCreatePagefilePrivilege 3276 Explorer.EXE Token: SeShutdownPrivilege 3276 Explorer.EXE Token: SeCreatePagefilePrivilege 3276 Explorer.EXE Token: SeShutdownPrivilege 3276 Explorer.EXE Token: SeCreatePagefilePrivilege 3276 Explorer.EXE Token: SeShutdownPrivilege 3276 Explorer.EXE Token: SeCreatePagefilePrivilege 3276 Explorer.EXE Token: SeShutdownPrivilege 3276 Explorer.EXE Token: SeCreatePagefilePrivilege 3276 Explorer.EXE Token: SeShutdownPrivilege 3276 Explorer.EXE Token: SeCreatePagefilePrivilege 3276 Explorer.EXE Token: SeShutdownPrivilege 3276 Explorer.EXE Token: SeCreatePagefilePrivilege 3276 Explorer.EXE Token: SeDebugPrivilege 2188 WWAHost.exe Token: SeShutdownPrivilege 3276 Explorer.EXE Token: SeCreatePagefilePrivilege 3276 Explorer.EXE Token: SeShutdownPrivilege 3276 Explorer.EXE Token: SeCreatePagefilePrivilege 3276 Explorer.EXE Token: SeShutdownPrivilege 3276 Explorer.EXE Token: SeCreatePagefilePrivilege 3276 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3276 Explorer.EXE - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1184 wrote to memory of 3036 1184 Tlcf4ubbOhvrFYkon.exe 81 PID 1184 wrote to memory of 3036 1184 Tlcf4ubbOhvrFYkon.exe 81 PID 1184 wrote to memory of 3036 1184 Tlcf4ubbOhvrFYkon.exe 81 PID 1184 wrote to memory of 3036 1184 Tlcf4ubbOhvrFYkon.exe 81 PID 1184 wrote to memory of 3224 1184 Tlcf4ubbOhvrFYkon.exe 82 PID 1184 wrote to memory of 3224 1184 Tlcf4ubbOhvrFYkon.exe 82 PID 1184 wrote to memory of 3224 1184 Tlcf4ubbOhvrFYkon.exe 82 PID 1184 wrote to memory of 3224 1184 Tlcf4ubbOhvrFYkon.exe 82 PID 1184 wrote to memory of 3224 1184 Tlcf4ubbOhvrFYkon.exe 82 PID 1184 wrote to memory of 3224 1184 Tlcf4ubbOhvrFYkon.exe 82 PID 1184 wrote to memory of 3272 1184 Tlcf4ubbOhvrFYkon.exe 83 PID 1184 wrote to memory of 3272 1184 Tlcf4ubbOhvrFYkon.exe 83 PID 1184 wrote to memory of 3272 1184 Tlcf4ubbOhvrFYkon.exe 83 PID 3276 wrote to memory of 2188 3276 Explorer.EXE 87 PID 3276 wrote to memory of 2188 3276 Explorer.EXE 87 PID 3276 wrote to memory of 2188 3276 Explorer.EXE 87 PID 2188 wrote to memory of 4516 2188 WWAHost.exe 89 PID 2188 wrote to memory of 4516 2188 WWAHost.exe 89 PID 2188 wrote to memory of 4516 2188 WWAHost.exe 89 PID 2188 wrote to memory of 3812 2188 WWAHost.exe 91 PID 2188 wrote to memory of 3812 2188 WWAHost.exe 91 PID 2188 wrote to memory of 3812 2188 WWAHost.exe 91 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\Tlcf4ubbOhvrFYkon.exe"C:\Users\Admin\AppData\Local\Temp\Tlcf4ubbOhvrFYkon.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:3036
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3224
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"3⤵PID:3272
-
-
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:4516
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3812
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\DB1
- Size 46KB
- SHA256 776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
- MD5 8f5942354d3809f865f9767eddf51314
- SHA1 20be11c0d42fc0cef53931ea9152b55082d1a11e
- SHA512 fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
- SSDEEP 96:FSXNKLyeymwHCn8MouOFlRGiZqYtFTCG:FSfHG7qqifTCG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\5M04CDTE\5M0logim.jpeg
- Size 78KB
- SHA256 d6503e5a8031de6c710ff3bc5f8adb39da32bfe37e36fe814b8c900ee9ce4887
- MD5 1857eea63ec443e55f4714c52ed3e0c0
- SHA1 3a8fbacdac8e14117d57892f3469a0264496950b
- SHA512 2966639ca4b37dd94b63b7d28889ce6cfcc7a8f1461daeb6056e1ddca3ff96f534c0a8cf1f89626dfe9382ec5998c2ad5a4d5caf2159a68f5d28a802b4e72d34
- SSDEEP 1536:swr22jBySEk0tB4OksBQPYQJL+2UDQrofH5M02xulXi7Y:hn1yXtB4OkqQ302UkrofHS0iX7Y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\5M04CDTE\5M0logrf.ini
- Size 40B
- SHA256 1662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
- MD5 2f245469795b865bdd1b956c23d7893d
- SHA1 6ad80b974d3808f5a20ea1e766c7d2f88b9e5895
- SHA512 909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\5M04CDTE\5M0logrg.ini
- Size 38B
- SHA256 75034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56
- MD5 4aadf49fed30e4c9b3fe4a3dd6445ebe
- SHA1 1e332822167c6f351b99615eada2c30a538ff037
- SHA512 eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\5M04CDTE\5M0logri.ini
- Size 40B
- SHA256 eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
- MD5 d63a82e5d81e02e399090af26db0b9cb
- SHA1 91d0014c8f54743bba141fd60c9d963f869d76c9
- SHA512 38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\5M04CDTE\5M0logrv.ini
- Size 40B
- SHA256 6eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
- MD5 ba3b6bc807d4f76794c4b81b09bb9ba5
- SHA1 24cb89501f0212ff3095ecc0aba97dd563718fb1
- SHA512 ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf
- MD5 SHA1 SHA512