Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12-07-2024 18:06
Static task
static1
Behavioral task
behavioral1
Sample
8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe
Resource
win7-20240705-en
General
-
Target
8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe
-
Size
620KB
-
MD5
6f6db1e7da6dcc039ad7a1bb95d153eb
-
SHA1
4e69bc26c9e11faececb76dfb4876165842a7383
-
SHA256
8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae
-
SHA512
0088f6a5cae353de2d418d942b0f16d82883bdd55af64af433f4d10a1b29b044c8892c246fa3cc4b70b364b213be4ec05b4874bcccd316d9d475b52981ff98b6
-
SSDEEP
12288:eb+YVK+orv7oWukJFoimuR6W5lzi7Cq82cXEC1ki2rpEWdzFTTLyh:V1+jMBmu3zCxcj1kdEcF
Malware Config
Extracted
formbook
4.1
sp26
co37.top
00050525.xyz
gucci-official.asia
xb1111.vip
brandignitemarketing.com
smqhr.vip
neuroenergetichealing.com
huskyrecords.com
bt365962.com
sonicmfers.com
bytoi.xyz
52725.xyz
tantargobank.com
quantumsolutionsblr.com
webzlp.xyz
euroelitegear.store
xyffaa.com
pickleballtvchampionship.com
hyrdomist.com
dgaaa.click
freetobe.cloud
d9666iii.com
fortunascience.com
swanzybz.christmas
sentradiskon.store
aprche.com
thepoolpatriot.com
pttapp.sbs
vasot.info
warmlycy.christmas
vintagesnap.shop
bestinkspot.com
beaconhillaccountants.com
l2l5f.rest
shtnalof.xyz
rizkkizak.bond
platform.vision
souvenirecommerce.com
activebabygear.com
touristplacesintripura.com
abcmuoisau.store
rajitha.xyz
ratesexchange.xyz
vidalkraft.com
evriukpostres.sbs
winvegasplus-casino.net
globalstimes.xyz
bondi.store
bt36565.com
ericjmusic.com
delco.agency
df5kj58.top
aakharikhaber.com
nmglawchambers.com
qzaxv.asia
smartvelocitybanking.com
lukaswarner.com
tapchain.fun
dalksj.com
xgzpw564r.xyz
bcas.app
viggo.motorcycles
incognicanada.com
theebdesigns.com
6na8m8k.asia
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2168-10-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exedescription pid process target process PID 2156 set thread context of 2168 2156 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exepowershell.exepid process 2156 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe 2156 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe 2168 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe 2828 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exepowershell.exedescription pid process Token: SeDebugPrivilege 2156 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe Token: SeDebugPrivilege 2828 powershell.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exedescription pid process target process PID 2156 wrote to memory of 2828 2156 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe powershell.exe PID 2156 wrote to memory of 2828 2156 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe powershell.exe PID 2156 wrote to memory of 2828 2156 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe powershell.exe PID 2156 wrote to memory of 2828 2156 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe powershell.exe PID 2156 wrote to memory of 2960 2156 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe PID 2156 wrote to memory of 2960 2156 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe PID 2156 wrote to memory of 2960 2156 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe PID 2156 wrote to memory of 2960 2156 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe PID 2156 wrote to memory of 2168 2156 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe PID 2156 wrote to memory of 2168 2156 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe PID 2156 wrote to memory of 2168 2156 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe PID 2156 wrote to memory of 2168 2156 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe PID 2156 wrote to memory of 2168 2156 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe PID 2156 wrote to memory of 2168 2156 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe PID 2156 wrote to memory of 2168 2156 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe 8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe"C:\Users\Admin\AppData\Local\Temp\8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe"C:\Users\Admin\AppData\Local\Temp\8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe"2⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe"C:\Users\Admin\AppData\Local\Temp\8bd0c48813f5c2578c3932b60ef84e4d62f7620f4f7e26d942f9765e2a589eae.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2168