Analysis
-
max time kernel
149s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
13-07-2024 12:20
Static task
static1
Behavioral task
behavioral1
Sample
d2944ccc7a3e0b9ca0ff84c52abaa3d05c00f6cfc6ff0e669cc152fbb79fd961.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
d2944ccc7a3e0b9ca0ff84c52abaa3d05c00f6cfc6ff0e669cc152fbb79fd961.exe
Resource
win10v2004-20240709-en
General
-
Target
d2944ccc7a3e0b9ca0ff84c52abaa3d05c00f6cfc6ff0e669cc152fbb79fd961.exe
-
Size
1.0MB
-
MD5
3d0257f3b89012fc88087b77ceecf50f
-
SHA1
59118559fee4ef72669e9bdcdfb59fee3223a04a
-
SHA256
d2944ccc7a3e0b9ca0ff84c52abaa3d05c00f6cfc6ff0e669cc152fbb79fd961
-
SHA512
daee1002806fdc7bdf425159dd28b29f5156a429302567c33d03bd945249d1d147022d5505e9c11cff00ab9908d22fd3ec2090d78b5ada85e8742cdc9203c666
-
SSDEEP
24576:8AHnh+eWsN3skA4RV1Hom2KXMmHaC9NazKZrTUnQWIsrKZ5:bh+ZkldoPK8YaCOzKZrTUndIsro
Malware Config
Extracted
formbook
4.1
pt46
twinportslocal.com
rovor.store
98169.club
mdywl.com
jrd3s.rest
aston1717.top
floridawoodworkingmachinery.com
17tk555t.com
ankitsho.shop
seclameh.com
realrecordlabel.com
trenchonbirmingham.com
af28.top
rtp1kenzototo.com
theselflovesite.com
promotegetpaid.info
strategiclogisticsagency.com
learneracademy.net
per-watch.com
betbox2341.com
22958.xyz
birthdaywishestexts.com
nihilculturamail.com
vasymaman.com
evriukpostaes.sbs
winkingbots.com
cb214.pro
osakanacreation.com
kingchuxing.com
dr-cotton.net
iiixc759q.xyz
eraplay88rtpgacor.lat
wguujb.com
dental-implants-89083.bond
liposuction-89237.bond
harbalmaizik.com
seoservicesdelhi.net
fakefox.xyz
wimetimephotos.com
healthsaveplus.com
wvufcw948o.top
dieselrockpartners.com
istchannelnet.com
123moviesonl.com
arlatwestern.shop
cloudproduction.cloud
gv3l1.vip
casino-x-zerkalo27pm.xyz
serverdayz.com
dvdripguides.com
vitalfitness.site
c21candacedevillier.com
gory12.online
0452frl.com
escpethemtrix.top
koumimi.tech
me29hs38g1.com
dreziuy.xyz
uddyen.shop
asia76s.xyz
melliccine.com
olxelang.com
paincareathome.com
sliveringaf.christmas
wheresthechocolateat.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2440-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2440-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2732-20-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
d2944ccc7a3e0b9ca0ff84c52abaa3d05c00f6cfc6ff0e669cc152fbb79fd961.exesvchost.exenetsh.exedescription pid process target process PID 2452 set thread context of 2440 2452 d2944ccc7a3e0b9ca0ff84c52abaa3d05c00f6cfc6ff0e669cc152fbb79fd961.exe svchost.exe PID 2440 set thread context of 1252 2440 svchost.exe Explorer.EXE PID 2732 set thread context of 1252 2732 netsh.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
svchost.exenetsh.exepid process 2440 svchost.exe 2440 svchost.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe 2732 netsh.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
d2944ccc7a3e0b9ca0ff84c52abaa3d05c00f6cfc6ff0e669cc152fbb79fd961.exesvchost.exenetsh.exepid process 2452 d2944ccc7a3e0b9ca0ff84c52abaa3d05c00f6cfc6ff0e669cc152fbb79fd961.exe 2440 svchost.exe 2440 svchost.exe 2440 svchost.exe 2732 netsh.exe 2732 netsh.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
svchost.exenetsh.exedescription pid process Token: SeDebugPrivilege 2440 svchost.exe Token: SeDebugPrivilege 2732 netsh.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
d2944ccc7a3e0b9ca0ff84c52abaa3d05c00f6cfc6ff0e669cc152fbb79fd961.exeExplorer.EXEnetsh.exedescription pid process target process PID 2452 wrote to memory of 2440 2452 d2944ccc7a3e0b9ca0ff84c52abaa3d05c00f6cfc6ff0e669cc152fbb79fd961.exe svchost.exe PID 2452 wrote to memory of 2440 2452 d2944ccc7a3e0b9ca0ff84c52abaa3d05c00f6cfc6ff0e669cc152fbb79fd961.exe svchost.exe PID 2452 wrote to memory of 2440 2452 d2944ccc7a3e0b9ca0ff84c52abaa3d05c00f6cfc6ff0e669cc152fbb79fd961.exe svchost.exe PID 2452 wrote to memory of 2440 2452 d2944ccc7a3e0b9ca0ff84c52abaa3d05c00f6cfc6ff0e669cc152fbb79fd961.exe svchost.exe PID 2452 wrote to memory of 2440 2452 d2944ccc7a3e0b9ca0ff84c52abaa3d05c00f6cfc6ff0e669cc152fbb79fd961.exe svchost.exe PID 1252 wrote to memory of 2732 1252 Explorer.EXE netsh.exe PID 1252 wrote to memory of 2732 1252 Explorer.EXE netsh.exe PID 1252 wrote to memory of 2732 1252 Explorer.EXE netsh.exe PID 1252 wrote to memory of 2732 1252 Explorer.EXE netsh.exe PID 2732 wrote to memory of 2780 2732 netsh.exe cmd.exe PID 2732 wrote to memory of 2780 2732 netsh.exe cmd.exe PID 2732 wrote to memory of 2780 2732 netsh.exe cmd.exe PID 2732 wrote to memory of 2780 2732 netsh.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\d2944ccc7a3e0b9ca0ff84c52abaa3d05c00f6cfc6ff0e669cc152fbb79fd961.exe"C:\Users\Admin\AppData\Local\Temp\d2944ccc7a3e0b9ca0ff84c52abaa3d05c00f6cfc6ff0e669cc152fbb79fd961.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\d2944ccc7a3e0b9ca0ff84c52abaa3d05c00f6cfc6ff0e669cc152fbb79fd961.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2440 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵PID:2780