Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
17-07-2024 10:05
Static task
static1
Behavioral task
behavioral1
Sample
MalwareBazaar.exe
Resource
win7-20240704-en
General
-
Target
MalwareBazaar.exe
-
Size
1.0MB
-
MD5
d7ec81e472472a0428de8191f28ccdf0
-
SHA1
a603d1bc8ef7ac10d30c156d3ad70c7a716d01e0
-
SHA256
e9e614a16e3250dc0fdd6fd01247ab76f65d146466c5977b06ffb716d7438cae
-
SHA512
8653372938d81d727b480594f670742481f4be767877a2b03f89d26368b327c7e0da4d0c73f633de2a03701b9492d90554ee8232072b81eb7c89e65d90a602f7
-
SSDEEP
24576:4AHnh+eWsN3skA4RV1Hom2KXMmHa6eq8DsiCQ5:/h+ZkldoPK8Ya63it
Malware Config
Extracted
formbook
4.1
ty31
jejakunik.com
inb319.com
jifsjn.buzz
gkyukon.site
43443.cfd
cogil69id.com
oeaog.com
lpgatm.com
mymarketsales.com
tomclk.icu
404417.online
nysconstruction.com
ourwisequote.com
ahsanadvisory.com
ottawaherps.com
forevermust.com
apartments-for-rent-47679.bond
kdasjijaksdd.icu
buthaynah.com
manggungjayakanopi.com
cookygan.com
regalessencebeautystudio.com
material.directory
szxart.xyz
ykdbyjk.xyz
hankahve.com
tiituitdsa.net
avantbrews.com
springpace.com
seriesjeans.com
technikwunder.com
angellsonline.com
soujany.com
buysleepp.com
voltvanbage.com
qdhaohuisuan.com
bluedolphinshop.com
aguanegocios.com
abstractdiffusion.com
bahisanaliz16.xyz
weight-loss-34761.bond
x216.icu
twmallll.com
poalsdji.buzz
agtsolargrowth.biz
pixelcloudtec.com
0512155.com
mypsychedeliceducation.com
0306951.top
screw-air-compressor.com
10140wildhawk.com
antheaclinic.com
tppclients.com
needpickleball.com
iraq-visions.com
rtpbonanza138.skin
wjzjs.com
dw6msr8.icu
lepriossa.com
tiktokglobal.shop
youwu.autos
tripshipglobal.com
ncpekingducktogo.com
winbd24.com
xiaobanhome.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/996-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/996-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/996-18-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4404-23-0x0000000000590000-0x00000000005BF000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
cscript.exeflow pid process 67 4404 cscript.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
MalwareBazaar.exesvchost.execscript.exedescription pid process target process PID 5056 set thread context of 996 5056 MalwareBazaar.exe svchost.exe PID 996 set thread context of 3392 996 svchost.exe Explorer.EXE PID 996 set thread context of 3392 996 svchost.exe Explorer.EXE PID 4404 set thread context of 3392 4404 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
svchost.execscript.exepid process 996 svchost.exe 996 svchost.exe 996 svchost.exe 996 svchost.exe 996 svchost.exe 996 svchost.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe 4404 cscript.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
MalwareBazaar.exesvchost.execscript.exepid process 5056 MalwareBazaar.exe 996 svchost.exe 996 svchost.exe 996 svchost.exe 996 svchost.exe 4404 cscript.exe 4404 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
svchost.execscript.exedescription pid process Token: SeDebugPrivilege 996 svchost.exe Token: SeDebugPrivilege 4404 cscript.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3392 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
MalwareBazaar.exeExplorer.EXEcscript.exedescription pid process target process PID 5056 wrote to memory of 996 5056 MalwareBazaar.exe svchost.exe PID 5056 wrote to memory of 996 5056 MalwareBazaar.exe svchost.exe PID 5056 wrote to memory of 996 5056 MalwareBazaar.exe svchost.exe PID 5056 wrote to memory of 996 5056 MalwareBazaar.exe svchost.exe PID 3392 wrote to memory of 4404 3392 Explorer.EXE cscript.exe PID 3392 wrote to memory of 4404 3392 Explorer.EXE cscript.exe PID 3392 wrote to memory of 4404 3392 Explorer.EXE cscript.exe PID 4404 wrote to memory of 2408 4404 cscript.exe cmd.exe PID 4404 wrote to memory of 2408 4404 cscript.exe cmd.exe PID 4404 wrote to memory of 2408 4404 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:996 -
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:3988
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:3600
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:1612
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:60
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:1452
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵PID:2408