Analysis
-
max time kernel
145s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
17-07-2024 14:21
Static task
static1
Behavioral task
behavioral1
Sample
Custom Clearance 5816641785332.exe
Resource
win7-20240708-en
General
-
Target
Custom Clearance 5816641785332.exe
-
Size
785KB
-
MD5
6d8d9238f841e55f9b34ac5f2a438495
-
SHA1
c7f8651a41b9ff7b0ca8e9e462f23758d76423bc
-
SHA256
98744503d8f81bb42030a999aa4e2284717cfca54c4395ddfd72fd7bfea44872
-
SHA512
9b1187eabf09aa32a4b2e88abb27390388d5b2a008fbeb3250ad8538f3f37fe7fb673ea1d0dbf437dd5006e38bd3c973ba7440e0ea571e7b2ccf6b520094da79
-
SSDEEP
12288:5q9VTNbF6zEkZVi8fPiQgrZEZR79Hcg1pRavD7R5GtYG2ucIqB/:c99QVpPiJ+9Hcg7G7GVcB/
Malware Config
Extracted
formbook
4.1
na10
tetheus.com
ventlikeyoumeanit.com
tintbliss.com
rinabet357.com
sapphireboutiqueusa.com
abc8bet6.com
xzcn3i7jb13cqei.buzz
pinktravelsnagpur.com
bt365038.com
rtpbossujang303.shop
osthirmaker.com
thelonelyteacup.com
rlc2019.com
couverture-charpente.com
productivagc.com
defendercarcare.com
abcentixdigital.com
petco.ltd
oypivh.top
micro.guru
hokivegasslots.club
5663876.com
symboleffekt.info
tworiverlabsintake.com
pegaso.store
sasoera.com
material.chat
taniamckirdy.com
dansistosproductions.com
moromorojp.com
z27e1thx976ez3u.buzz
skinrenue.com
nbvci.xyz
jakobniinja.xyz
snykee.com
sl24.top
wawturkiye.xyz
virtualeventsbyelaine.com
giorgiaclerico.com
d9psk8.xyz
hard-to-miss.space
awclog.com
topcomparativos.com
somoyboutique.com
findlove.pro
zbo170.app
dexcoenergy.com
nona23.lat
ingelset.com
hexatelier.com
nftees.tech
visionarymaterialsinstitute.com
khanyos.com
bz59.top
migraine-treatment-28778.bond
catboxbot.online
kkugames.com
llmsearchoptimization.com
fipbhvvb.xyz
vmytzptc.xyz
intermediafx.shop
lhrrs.com
grimreapervalley.com
discount-fess.space
liamcollinai.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2704-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2704-18-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2896-23-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1656 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Custom Clearance 5816641785332.exeCustom Clearance 5816641785332.exehelp.exedescription pid process target process PID 2112 set thread context of 2704 2112 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 2704 set thread context of 1188 2704 Custom Clearance 5816641785332.exe Explorer.EXE PID 2896 set thread context of 1188 2896 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
Custom Clearance 5816641785332.exeCustom Clearance 5816641785332.exehelp.exepid process 2112 Custom Clearance 5816641785332.exe 2112 Custom Clearance 5816641785332.exe 2704 Custom Clearance 5816641785332.exe 2704 Custom Clearance 5816641785332.exe 2896 help.exe 2896 help.exe 2896 help.exe 2896 help.exe 2896 help.exe 2896 help.exe 2896 help.exe 2896 help.exe 2896 help.exe 2896 help.exe 2896 help.exe 2896 help.exe 2896 help.exe 2896 help.exe 2896 help.exe 2896 help.exe 2896 help.exe 2896 help.exe 2896 help.exe 2896 help.exe 2896 help.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Custom Clearance 5816641785332.exehelp.exepid process 2704 Custom Clearance 5816641785332.exe 2704 Custom Clearance 5816641785332.exe 2704 Custom Clearance 5816641785332.exe 2896 help.exe 2896 help.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Custom Clearance 5816641785332.exeCustom Clearance 5816641785332.exehelp.exedescription pid process Token: SeDebugPrivilege 2112 Custom Clearance 5816641785332.exe Token: SeDebugPrivilege 2704 Custom Clearance 5816641785332.exe Token: SeDebugPrivilege 2896 help.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Custom Clearance 5816641785332.exeExplorer.EXEhelp.exedescription pid process target process PID 2112 wrote to memory of 2704 2112 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 2112 wrote to memory of 2704 2112 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 2112 wrote to memory of 2704 2112 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 2112 wrote to memory of 2704 2112 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 2112 wrote to memory of 2704 2112 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 2112 wrote to memory of 2704 2112 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 2112 wrote to memory of 2704 2112 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 1188 wrote to memory of 2896 1188 Explorer.EXE help.exe PID 1188 wrote to memory of 2896 1188 Explorer.EXE help.exe PID 1188 wrote to memory of 2896 1188 Explorer.EXE help.exe PID 1188 wrote to memory of 2896 1188 Explorer.EXE help.exe PID 2896 wrote to memory of 1656 2896 help.exe cmd.exe PID 2896 wrote to memory of 1656 2896 help.exe cmd.exe PID 2896 wrote to memory of 1656 2896 help.exe cmd.exe PID 2896 wrote to memory of 1656 2896 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\Custom Clearance 5816641785332.exe"C:\Users\Admin\AppData\Local\Temp\Custom Clearance 5816641785332.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\Custom Clearance 5816641785332.exe"C:\Users\Admin\AppData\Local\Temp\Custom Clearance 5816641785332.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2704 -
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Custom Clearance 5816641785332.exe"3⤵
- Deletes itself
PID:1656