Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
25/06/2024, 01:46
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
bd8a38d06603be4dafa830f2a5faa9f55b3e24cb692314908dc246adad8c8999.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
General
- Target bd8a38d06603be4dafa830f2a5faa9f55b3e24cb692314908dc246adad8c8999.exe
- Size 1.1MB
- Sample240625-b6579sxdml
- SHA256 bd8a38d06603be4dafa830f2a5faa9f55b3e24cb692314908dc246adad8c8999
- MD5 c8d850146b27ea87e5242f103088ef2d
- SHA1 b7425314a1dd4316e2e7038d8cbf6a0a41804855
- SHA512 c2eaf840856f613cf7e71dbba6f5112c1b09c40cd3b7328322b27a3092229b125230264f7b2db6360bb285a65290d372ec23e74a91f11a10f3e15c2cef285f02
- SSDEEP 24576:eAHnh+eWsN3skA4RV1Hom2KXMmHa6ZAXd/HGOeb7r5:Jh+ZkldoPK8Ya6ZAXd/mlbR
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
as02
Decoy
-
qwin777.com
-
robinhoods.live
-
h3jh-dal.pics
-
braindeadcopywriting.com
-
kktcbet1000.com
-
mpo0463.cfd
-
raboteshoes.com
-
ab1718.com
-
lowcrusiers.com
-
gregcopelandmusic.com
-
dkfndch.store
-
firstclassuni.com
-
00ewu1ub.com
-
shunweichemical.com
-
sugarits.com
-
marqify.com
-
mistmajik.com
-
trezip.online
-
tinytables.xyz
-
suestergocoaching.com
-
dominoad.com
-
specials.website
-
thatpilatesgirl.com
-
vrexpressok.com
-
sdegtho.com
-
svhomesinspections.com
-
rumbol88.com
-
dzplricfpf.com
-
fastcoolify.com
-
bloominginwholeness.com
-
12ser3.com
-
curtsreno.com
-
defx.ventures
-
dev-patel.xyz
-
ltyidc.com
-
wheiunudweowuqiwuebfyewui3.com
-
039c5m2ciwt99.top
-
pmpm.xyz
-
akabuka.net
-
parkerslandscapingllc.com
-
hamcast.com
-
jiangcapable.site
-
sassysensoryclips.com
-
arsalan.shop
-
thecryptocaviar.com
-
ofbsconsulting.com
-
j8j3e.cfd
-
cinexgltd.com
-
justcallnadia.com
-
qcyiran.com
-
uniseekglobal.com
-
milieunightclub.com
-
sisasimoslot.com
-
svizzblem.net
-
20644.asia
-
shroomberparty.com
-
contractcrafters.net
-
selectstylehome.shop
-
blackhillspr.com
-
topsolutionquality.online
-
diywithbje.com
-
simplywellcoach.com
-
popothebear.site
-
entendiendomedicare.com
-
sopaindam.com
Signatures
- Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/4120-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4120-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3244-20-0x0000000000400000-0x000000000042F000-memory.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4492 set thread context of 4120 4492 bd8a38d06603be4dafa830f2a5faa9f55b3e24cb692314908dc246adad8c8999.exe 80 PID 4120 set thread context of 3516 4120 svchost.exe 56 PID 3244 set thread context of 3516 3244 svchost.exe 56 - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 4120 svchost.exe 4120 svchost.exe 4120 svchost.exe 4120 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 4492 bd8a38d06603be4dafa830f2a5faa9f55b3e24cb692314908dc246adad8c8999.exe 4120 svchost.exe 4120 svchost.exe 4120 svchost.exe 3244 svchost.exe 3244 svchost.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4120 svchost.exe Token: SeDebugPrivilege 3244 svchost.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 4492 bd8a38d06603be4dafa830f2a5faa9f55b3e24cb692314908dc246adad8c8999.exe 4492 bd8a38d06603be4dafa830f2a5faa9f55b3e24cb692314908dc246adad8c8999.exe 3516 Explorer.EXE 3516 Explorer.EXE 3516 Explorer.EXE - Suspicious use of SendNotifyMessage 5 IoCs
pid Process 4492 bd8a38d06603be4dafa830f2a5faa9f55b3e24cb692314908dc246adad8c8999.exe 4492 bd8a38d06603be4dafa830f2a5faa9f55b3e24cb692314908dc246adad8c8999.exe 3516 Explorer.EXE 3516 Explorer.EXE 3516 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4492 wrote to memory of 4120 4492 bd8a38d06603be4dafa830f2a5faa9f55b3e24cb692314908dc246adad8c8999.exe 80 PID 4492 wrote to memory of 4120 4492 bd8a38d06603be4dafa830f2a5faa9f55b3e24cb692314908dc246adad8c8999.exe 80 PID 4492 wrote to memory of 4120 4492 bd8a38d06603be4dafa830f2a5faa9f55b3e24cb692314908dc246adad8c8999.exe 80 PID 4492 wrote to memory of 4120 4492 bd8a38d06603be4dafa830f2a5faa9f55b3e24cb692314908dc246adad8c8999.exe 80 PID 3516 wrote to memory of 3244 3516 Explorer.EXE 81 PID 3516 wrote to memory of 3244 3516 Explorer.EXE 81 PID 3516 wrote to memory of 3244 3516 Explorer.EXE 81 PID 3244 wrote to memory of 1656 3244 svchost.exe 82 PID 3244 wrote to memory of 1656 3244 svchost.exe 82 PID 3244 wrote to memory of 1656 3244 svchost.exe 82
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\bd8a38d06603be4dafa830f2a5faa9f55b3e24cb692314908dc246adad8c8999.exe"C:\Users\Admin\AppData\Local\Temp\bd8a38d06603be4dafa830f2a5faa9f55b3e24cb692314908dc246adad8c8999.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\bd8a38d06603be4dafa830f2a5faa9f55b3e24cb692314908dc246adad8c8999.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4120
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵PID:1656
-
-