Analysis
-
max time kernel
148s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
17-07-2024 06:40
Static task
static1
Behavioral task
behavioral1
Sample
9RogliUNrK3XMIU.exe
Resource
win7-20240708-en
General
-
Target
9RogliUNrK3XMIU.exe
-
Size
636KB
-
MD5
66645c931f0efe0978e4e6f3a208355a
-
SHA1
a8d4f42410e8c03afbe6edff9fb7515811590f7f
-
SHA256
b362ced287b5f00b3b2ab2c3a7bbc85b57e13271d76a6c65423a831fde92876c
-
SHA512
7ee22cbc3f80cf079a47fc6c1aff047e3c48106b8b800163227be0d2bb1530654876503947ab75e44b2bcd0a89e89261c9e85c329e46d8f19ec3375e4e9a852e
-
SSDEEP
12288:O5bmfm3V8eY73Sv9+Vcfx4sWo7FxpLq0ubuIKOTeh2AQdRlF6U:IQ73a9+Vcl7FxpG0dhqemRv6U
Malware Config
Extracted
formbook
4.1
v15n
dyahwoahjuk.store
toysstorm.com
y7rak9.com
2222233p6.shop
betbox2341.com
visualvarta.com
nijssenadventures.com
main-12.site
leng4d.net
kurainu.xyz
hatesa.xyz
culturamosaica.com
supermallify.store
gigboard.app
rxforgive.com
ameliestones.com
kapalwin.live
tier.credit
sobol-ksa.com
faredeal.online
226b.xyz
talktohannaford500.shop
mxrkpkngishbdss.xyz
mirotcg.info
turbo3club.site
hjnd28t010cop.cyou
marveloustep.shop
syedlatief.com
comfortableleather.com
alltradescortland.com
dnwgt80508yoec8pzq.top
kedai168ef.com
gelgoodlife.com
nxtskey.com
milliedevine.store
wordcraftart.fun
mpo525.monster
bt365851.com
dogeversetoken.net
boostgrowmode.com
dacapital.net
project21il.com
go4stores.com
brunoduarte.online
sexgodmasterclass.com
wuhey.shop
jdginl892e.xyz
agenkilat-official.space
hacks.digital
suv.xyz
fwbsmg.life
vicmvm649n.top
wbahdfw.icu
creativelyloud.com
merrycleanteam.com
solar-systems-panels-58747.bond
rotaryclubofmukono.com
bethanyumcnola.info
breezafan.com
ny-robotictoys.com
lawyers-br-pt-9390663.fyi
neurasaudi.com
dgccb.com
sayuri-walk.com
gtur.top
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2916-13-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2916-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2864-22-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2620 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
9RogliUNrK3XMIU.exe9RogliUNrK3XMIU.execontrol.exedescription pid process target process PID 2556 set thread context of 2916 2556 9RogliUNrK3XMIU.exe 9RogliUNrK3XMIU.exe PID 2916 set thread context of 1180 2916 9RogliUNrK3XMIU.exe Explorer.EXE PID 2864 set thread context of 1180 2864 control.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
9RogliUNrK3XMIU.execontrol.exepid process 2916 9RogliUNrK3XMIU.exe 2916 9RogliUNrK3XMIU.exe 2864 control.exe 2864 control.exe 2864 control.exe 2864 control.exe 2864 control.exe 2864 control.exe 2864 control.exe 2864 control.exe 2864 control.exe 2864 control.exe 2864 control.exe 2864 control.exe 2864 control.exe 2864 control.exe 2864 control.exe 2864 control.exe 2864 control.exe 2864 control.exe 2864 control.exe 2864 control.exe 2864 control.exe 2864 control.exe 2864 control.exe 2864 control.exe 2864 control.exe 2864 control.exe 2864 control.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
9RogliUNrK3XMIU.execontrol.exepid process 2916 9RogliUNrK3XMIU.exe 2916 9RogliUNrK3XMIU.exe 2916 9RogliUNrK3XMIU.exe 2864 control.exe 2864 control.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
9RogliUNrK3XMIU.execontrol.exedescription pid process Token: SeDebugPrivilege 2916 9RogliUNrK3XMIU.exe Token: SeDebugPrivilege 2864 control.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
9RogliUNrK3XMIU.exeExplorer.EXEcontrol.exedescription pid process target process PID 2556 wrote to memory of 2916 2556 9RogliUNrK3XMIU.exe 9RogliUNrK3XMIU.exe PID 2556 wrote to memory of 2916 2556 9RogliUNrK3XMIU.exe 9RogliUNrK3XMIU.exe PID 2556 wrote to memory of 2916 2556 9RogliUNrK3XMIU.exe 9RogliUNrK3XMIU.exe PID 2556 wrote to memory of 2916 2556 9RogliUNrK3XMIU.exe 9RogliUNrK3XMIU.exe PID 2556 wrote to memory of 2916 2556 9RogliUNrK3XMIU.exe 9RogliUNrK3XMIU.exe PID 2556 wrote to memory of 2916 2556 9RogliUNrK3XMIU.exe 9RogliUNrK3XMIU.exe PID 2556 wrote to memory of 2916 2556 9RogliUNrK3XMIU.exe 9RogliUNrK3XMIU.exe PID 1180 wrote to memory of 2864 1180 Explorer.EXE control.exe PID 1180 wrote to memory of 2864 1180 Explorer.EXE control.exe PID 1180 wrote to memory of 2864 1180 Explorer.EXE control.exe PID 1180 wrote to memory of 2864 1180 Explorer.EXE control.exe PID 2864 wrote to memory of 2620 2864 control.exe cmd.exe PID 2864 wrote to memory of 2620 2864 control.exe cmd.exe PID 2864 wrote to memory of 2620 2864 control.exe cmd.exe PID 2864 wrote to memory of 2620 2864 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\9RogliUNrK3XMIU.exe"C:\Users\Admin\AppData\Local\Temp\9RogliUNrK3XMIU.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\9RogliUNrK3XMIU.exe"C:\Users\Admin\AppData\Local\Temp\9RogliUNrK3XMIU.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2916 -
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\9RogliUNrK3XMIU.exe"3⤵
- Deletes itself
PID:2620