Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
17-07-2024 14:21
Static task
static1
Behavioral task
behavioral1
Sample
Custom Clearance 5816641785332.exe
Resource
win7-20240704-en
General
-
Target
Custom Clearance 5816641785332.exe
-
Size
785KB
-
MD5
6d8d9238f841e55f9b34ac5f2a438495
-
SHA1
c7f8651a41b9ff7b0ca8e9e462f23758d76423bc
-
SHA256
98744503d8f81bb42030a999aa4e2284717cfca54c4395ddfd72fd7bfea44872
-
SHA512
9b1187eabf09aa32a4b2e88abb27390388d5b2a008fbeb3250ad8538f3f37fe7fb673ea1d0dbf437dd5006e38bd3c973ba7440e0ea571e7b2ccf6b520094da79
-
SSDEEP
12288:5q9VTNbF6zEkZVi8fPiQgrZEZR79Hcg1pRavD7R5GtYG2ucIqB/:c99QVpPiJ+9Hcg7G7GVcB/
Malware Config
Extracted
formbook
4.1
na10
tetheus.com
ventlikeyoumeanit.com
tintbliss.com
rinabet357.com
sapphireboutiqueusa.com
abc8bet6.com
xzcn3i7jb13cqei.buzz
pinktravelsnagpur.com
bt365038.com
rtpbossujang303.shop
osthirmaker.com
thelonelyteacup.com
rlc2019.com
couverture-charpente.com
productivagc.com
defendercarcare.com
abcentixdigital.com
petco.ltd
oypivh.top
micro.guru
hokivegasslots.club
5663876.com
symboleffekt.info
tworiverlabsintake.com
pegaso.store
sasoera.com
material.chat
taniamckirdy.com
dansistosproductions.com
moromorojp.com
z27e1thx976ez3u.buzz
skinrenue.com
nbvci.xyz
jakobniinja.xyz
snykee.com
sl24.top
wawturkiye.xyz
virtualeventsbyelaine.com
giorgiaclerico.com
d9psk8.xyz
hard-to-miss.space
awclog.com
topcomparativos.com
somoyboutique.com
findlove.pro
zbo170.app
dexcoenergy.com
nona23.lat
ingelset.com
hexatelier.com
nftees.tech
visionarymaterialsinstitute.com
khanyos.com
bz59.top
migraine-treatment-28778.bond
catboxbot.online
kkugames.com
llmsearchoptimization.com
fipbhvvb.xyz
vmytzptc.xyz
intermediafx.shop
lhrrs.com
grimreapervalley.com
discount-fess.space
liamcollinai.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3616-13-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3616-18-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3556-23-0x0000000000600000-0x000000000062F000-memory.dmp formbook -
Blocklisted process makes network request 2 IoCs
Processes:
cscript.exeflow pid process 67 3556 cscript.exe 71 3556 cscript.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Custom Clearance 5816641785332.exeCustom Clearance 5816641785332.execscript.exedescription pid process target process PID 892 set thread context of 3616 892 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 3616 set thread context of 3416 3616 Custom Clearance 5816641785332.exe Explorer.EXE PID 3556 set thread context of 3416 3556 cscript.exe Explorer.EXE -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
Custom Clearance 5816641785332.exeCustom Clearance 5816641785332.execscript.exepid process 892 Custom Clearance 5816641785332.exe 892 Custom Clearance 5816641785332.exe 892 Custom Clearance 5816641785332.exe 892 Custom Clearance 5816641785332.exe 3616 Custom Clearance 5816641785332.exe 3616 Custom Clearance 5816641785332.exe 3616 Custom Clearance 5816641785332.exe 3616 Custom Clearance 5816641785332.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe 3556 cscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Custom Clearance 5816641785332.execscript.exepid process 3616 Custom Clearance 5816641785332.exe 3616 Custom Clearance 5816641785332.exe 3616 Custom Clearance 5816641785332.exe 3556 cscript.exe 3556 cscript.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
Custom Clearance 5816641785332.exeCustom Clearance 5816641785332.execscript.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 892 Custom Clearance 5816641785332.exe Token: SeDebugPrivilege 3616 Custom Clearance 5816641785332.exe Token: SeDebugPrivilege 3556 cscript.exe Token: SeShutdownPrivilege 3416 Explorer.EXE Token: SeCreatePagefilePrivilege 3416 Explorer.EXE Token: SeShutdownPrivilege 3416 Explorer.EXE Token: SeCreatePagefilePrivilege 3416 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3416 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Custom Clearance 5816641785332.exeExplorer.EXEcscript.exedescription pid process target process PID 892 wrote to memory of 4580 892 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 892 wrote to memory of 4580 892 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 892 wrote to memory of 4580 892 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 892 wrote to memory of 4580 892 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 892 wrote to memory of 4580 892 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 892 wrote to memory of 4580 892 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 892 wrote to memory of 3616 892 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 892 wrote to memory of 3616 892 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 892 wrote to memory of 3616 892 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 892 wrote to memory of 3616 892 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 892 wrote to memory of 3616 892 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 892 wrote to memory of 3616 892 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 3416 wrote to memory of 3556 3416 Explorer.EXE cscript.exe PID 3416 wrote to memory of 3556 3416 Explorer.EXE cscript.exe PID 3416 wrote to memory of 3556 3416 Explorer.EXE cscript.exe PID 3556 wrote to memory of 4472 3556 cscript.exe cmd.exe PID 3556 wrote to memory of 4472 3556 cscript.exe cmd.exe PID 3556 wrote to memory of 4472 3556 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\Custom Clearance 5816641785332.exe"C:\Users\Admin\AppData\Local\Temp\Custom Clearance 5816641785332.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\Custom Clearance 5816641785332.exe"C:\Users\Admin\AppData\Local\Temp\Custom Clearance 5816641785332.exe"3⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\Custom Clearance 5816641785332.exe"C:\Users\Admin\AppData\Local\Temp\Custom Clearance 5816641785332.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3616 -
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Custom Clearance 5816641785332.exe"3⤵PID:4472