Analysis
- max time kernel
147s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
07/06/2024, 02:34
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
af38529f4fb8ac8bac4292c9f1ddc302cc48d26441de843ac670e0e77954ec7a.exe
Resource
win7-20240508-en
windows7-x64
9 signatures
150 seconds
General
- Target af38529f4fb8ac8bac4292c9f1ddc302cc48d26441de843ac670e0e77954ec7a.exe
- Size 1.1MB
- Sample240607-c2tt4sgc3s
- SHA256 af38529f4fb8ac8bac4292c9f1ddc302cc48d26441de843ac670e0e77954ec7a
- MD5 49e10873e2154eae0b6d608e17555384
- SHA1 9e3fc5d11deb68c9d163fe3efd64211fdffb56ad
- SHA512 e636955bc15a58bdff17d823fb6d452d84c750cc69f479f3d69ef42f87e8169053f8138aa281b9b3268058931c194ded8ebe21db1f20b5fd76b7d477efe5d181
- SSDEEP 24576:oAHnh+eWsN3skA4RV1Hom2KXMmHao1SM3zD5:vh+ZkldoPK8Yaob5
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
ss63
Decoy
-
catpig.xyz
-
chatladyanzensei7.site
-
onewayonepaydroptaxi.com
-
bima188.lol
-
wealth-km.online
-
seepao27200.top
-
6c958u9.lol
-
fbyu57ytsd.shop
-
baranetentegre.com
-
webaichimie.com
-
h3k38q2.lol
-
abicomsrl.com
-
338kp.vip
-
rescuecube.com
-
bubatz-t.com
-
psgluxuryapartments.com
-
goodfellowlawfirm.com
-
bais141.com
-
imingchu.com
-
ekzeanjfolzaks.top
-
hanweixn.com
-
getwalkapp.com
-
pharm-resources.com
-
montessorigpt.com
-
novaprivatecare.com
-
3656444.com
-
h61u4oxx4sraqjm.buzz
-
vak888.life
-
q43n.top
-
sushiommen.com
-
wvinsiders.com
-
emran-tahhan.com
-
manipulatedalgorithms.com
-
presentiei.shop
-
juntospelors.com
-
j0a6doy1x8eyx.com
-
yexoiup.xyz
-
bricoarq.com
-
hnxymaritime.com
-
selllocaljet.com
-
h5left513.xyz
-
65yty.com
-
everymgs01.com
-
barbaraht.com
-
mx5cucs.xyz
-
checkscamsv.com
-
smpn1madangsuku2.store
-
mixefy.shop
-
gacordewa288.life
-
srisaiprintpack.com
-
gasdepo168.com
-
etancheite-ajaccio.com
-
slow-man.com
-
thewhitehorsepub.biz
-
bay6studio.com
-
djhtshrtshgrg.lol
-
xcxocez.shop
-
games.broker
-
nudkiss.com
-
ccconnectglobal.com
-
wifmilio.com
-
dpuntada.com
-
ads8562.shop
-
diferenciaes.com
-
fashionchc.com
Signatures
- Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/1012-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1012-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3180-19-0x0000000001280000-0x00000000012AF000-memory.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 800 set thread context of 1012 800 af38529f4fb8ac8bac4292c9f1ddc302cc48d26441de843ac670e0e77954ec7a.exe 88 PID 1012 set thread context of 3440 1012 svchost.exe 56 PID 3180 set thread context of 3440 3180 help.exe 56 - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe 3180 help.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 800 af38529f4fb8ac8bac4292c9f1ddc302cc48d26441de843ac670e0e77954ec7a.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 3180 help.exe 3180 help.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 1012 svchost.exe Token: SeShutdownPrivilege 3440 Explorer.EXE Token: SeCreatePagefilePrivilege 3440 Explorer.EXE Token: SeShutdownPrivilege 3440 Explorer.EXE Token: SeCreatePagefilePrivilege 3440 Explorer.EXE Token: SeDebugPrivilege 3180 help.exe Token: SeShutdownPrivilege 3440 Explorer.EXE Token: SeCreatePagefilePrivilege 3440 Explorer.EXE Token: SeShutdownPrivilege 3440 Explorer.EXE Token: SeCreatePagefilePrivilege 3440 Explorer.EXE - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 800 af38529f4fb8ac8bac4292c9f1ddc302cc48d26441de843ac670e0e77954ec7a.exe 800 af38529f4fb8ac8bac4292c9f1ddc302cc48d26441de843ac670e0e77954ec7a.exe 3440 Explorer.EXE 3440 Explorer.EXE - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 800 af38529f4fb8ac8bac4292c9f1ddc302cc48d26441de843ac670e0e77954ec7a.exe 800 af38529f4fb8ac8bac4292c9f1ddc302cc48d26441de843ac670e0e77954ec7a.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3440 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 800 wrote to memory of 1012 800 af38529f4fb8ac8bac4292c9f1ddc302cc48d26441de843ac670e0e77954ec7a.exe 88 PID 800 wrote to memory of 1012 800 af38529f4fb8ac8bac4292c9f1ddc302cc48d26441de843ac670e0e77954ec7a.exe 88 PID 800 wrote to memory of 1012 800 af38529f4fb8ac8bac4292c9f1ddc302cc48d26441de843ac670e0e77954ec7a.exe 88 PID 800 wrote to memory of 1012 800 af38529f4fb8ac8bac4292c9f1ddc302cc48d26441de843ac670e0e77954ec7a.exe 88 PID 3440 wrote to memory of 3180 3440 Explorer.EXE 89 PID 3440 wrote to memory of 3180 3440 Explorer.EXE 89 PID 3440 wrote to memory of 3180 3440 Explorer.EXE 89 PID 3180 wrote to memory of 1820 3180 help.exe 96 PID 3180 wrote to memory of 1820 3180 help.exe 96 PID 3180 wrote to memory of 1820 3180 help.exe 96
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\af38529f4fb8ac8bac4292c9f1ddc302cc48d26441de843ac670e0e77954ec7a.exe"C:\Users\Admin\AppData\Local\Temp\af38529f4fb8ac8bac4292c9f1ddc302cc48d26441de843ac670e0e77954ec7a.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\af38529f4fb8ac8bac4292c9f1ddc302cc48d26441de843ac670e0e77954ec7a.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1012
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵PID:1820
-
-