Analysis
- max time kernel
148s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
10/06/2024, 13:54
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
employee record.exe
Resource
win7-20240508-en
windows7-x64
9 signatures
150 seconds
General
- Target employee record.exe
- Size 1.1MB
- Sample240610-q7xpvayanc
- SHA256 b3c9d64752b245d128587e3b30d1aec01c2d67d8793a437b4a7ef4f5183eb472
- MD5 b8b2cf41ef3720aefe9c632e626cf083
- SHA1 c6ccc563304741296e2a8af8bb0e74d18b94995c
- SHA512 af44fd2fe3d4817ab6005c0b63a774bdd5f6099e79d6810054776494b6060ace2d027bfa88f4a9f790faddc4f3180cbab126f781c6d994cb7532fc52f281efc3
- SSDEEP 24576:NAHnh+eWsN3skA4RV1Hom2KXMmHaJtj+xZ3wuwmrC5:sh+ZkldoPK8YaJp+xZAx
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
as02
Decoy
-
qwin777.com
-
robinhoods.live
-
h3jh-dal.pics
-
braindeadcopywriting.com
-
kktcbet1000.com
-
mpo0463.cfd
-
raboteshoes.com
-
ab1718.com
-
lowcrusiers.com
-
gregcopelandmusic.com
-
dkfndch.store
-
firstclassuni.com
-
00ewu1ub.com
-
shunweichemical.com
-
sugarits.com
-
marqify.com
-
mistmajik.com
-
trezip.online
-
tinytables.xyz
-
suestergocoaching.com
-
dominoad.com
-
specials.website
-
thatpilatesgirl.com
-
vrexpressok.com
-
sdegtho.com
-
svhomesinspections.com
-
rumbol88.com
-
dzplricfpf.com
-
fastcoolify.com
-
bloominginwholeness.com
-
12ser3.com
-
curtsreno.com
-
defx.ventures
-
dev-patel.xyz
-
ltyidc.com
-
wheiunudweowuqiwuebfyewui3.com
-
039c5m2ciwt99.top
-
pmpm.xyz
-
akabuka.net
-
parkerslandscapingllc.com
-
hamcast.com
-
jiangcapable.site
-
sassysensoryclips.com
-
arsalan.shop
-
thecryptocaviar.com
-
ofbsconsulting.com
-
j8j3e.cfd
-
cinexgltd.com
-
justcallnadia.com
-
qcyiran.com
-
uniseekglobal.com
-
milieunightclub.com
-
sisasimoslot.com
-
svizzblem.net
-
20644.asia
-
shroomberparty.com
-
contractcrafters.net
-
selectstylehome.shop
-
blackhillspr.com
-
topsolutionquality.online
-
diywithbje.com
-
simplywellcoach.com
-
popothebear.site
-
entendiendomedicare.com
-
sopaindam.com
Signatures
- Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/2348-11-0x00000000004B0000-0x00000000004DF000-memory.dmp formbook behavioral2/memory/2348-15-0x00000000004B0000-0x00000000004DF000-memory.dmp formbook behavioral2/memory/3308-21-0x0000000000A90000-0x0000000000ABF000-memory.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4804 set thread context of 2348 4804 employee record.exe 84 PID 2348 set thread context of 3516 2348 svchost.exe 56 PID 3308 set thread context of 3516 3308 mstsc.exe 56 - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 2348 svchost.exe 2348 svchost.exe 2348 svchost.exe 2348 svchost.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe 3308 mstsc.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 4804 employee record.exe 4804 employee record.exe 2348 svchost.exe 2348 svchost.exe 2348 svchost.exe 3308 mstsc.exe 3308 mstsc.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2348 svchost.exe Token: SeDebugPrivilege 3308 mstsc.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 4804 employee record.exe 4804 employee record.exe 3516 Explorer.EXE 3516 Explorer.EXE 3516 Explorer.EXE - Suspicious use of SendNotifyMessage 5 IoCs
pid Process 4804 employee record.exe 4804 employee record.exe 3516 Explorer.EXE 3516 Explorer.EXE 3516 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3516 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4804 wrote to memory of 2348 4804 employee record.exe 84 PID 4804 wrote to memory of 2348 4804 employee record.exe 84 PID 4804 wrote to memory of 2348 4804 employee record.exe 84 PID 4804 wrote to memory of 2348 4804 employee record.exe 84 PID 3516 wrote to memory of 3308 3516 Explorer.EXE 86 PID 3516 wrote to memory of 3308 3516 Explorer.EXE 86 PID 3516 wrote to memory of 3308 3516 Explorer.EXE 86 PID 3308 wrote to memory of 1480 3308 mstsc.exe 87 PID 3308 wrote to memory of 1480 3308 mstsc.exe 87 PID 3308 wrote to memory of 1480 3308 mstsc.exe 87
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\employee record.exe"C:\Users\Admin\AppData\Local\Temp\employee record.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\employee record.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2348
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:4140
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵PID:1480
-
-