Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
17-07-2024 14:21
Static task
static1
Behavioral task
behavioral1
Sample
Custom Clearance 5816641785332.exe
Resource
win7-20240708-en
General
-
Target
Custom Clearance 5816641785332.exe
-
Size
785KB
-
MD5
6d8d9238f841e55f9b34ac5f2a438495
-
SHA1
c7f8651a41b9ff7b0ca8e9e462f23758d76423bc
-
SHA256
98744503d8f81bb42030a999aa4e2284717cfca54c4395ddfd72fd7bfea44872
-
SHA512
9b1187eabf09aa32a4b2e88abb27390388d5b2a008fbeb3250ad8538f3f37fe7fb673ea1d0dbf437dd5006e38bd3c973ba7440e0ea571e7b2ccf6b520094da79
-
SSDEEP
12288:5q9VTNbF6zEkZVi8fPiQgrZEZR79Hcg1pRavD7R5GtYG2ucIqB/:c99QVpPiJ+9Hcg7G7GVcB/
Malware Config
Extracted
formbook
4.1
na10
tetheus.com
ventlikeyoumeanit.com
tintbliss.com
rinabet357.com
sapphireboutiqueusa.com
abc8bet6.com
xzcn3i7jb13cqei.buzz
pinktravelsnagpur.com
bt365038.com
rtpbossujang303.shop
osthirmaker.com
thelonelyteacup.com
rlc2019.com
couverture-charpente.com
productivagc.com
defendercarcare.com
abcentixdigital.com
petco.ltd
oypivh.top
micro.guru
hokivegasslots.club
5663876.com
symboleffekt.info
tworiverlabsintake.com
pegaso.store
sasoera.com
material.chat
taniamckirdy.com
dansistosproductions.com
moromorojp.com
z27e1thx976ez3u.buzz
skinrenue.com
nbvci.xyz
jakobniinja.xyz
snykee.com
sl24.top
wawturkiye.xyz
virtualeventsbyelaine.com
giorgiaclerico.com
d9psk8.xyz
hard-to-miss.space
awclog.com
topcomparativos.com
somoyboutique.com
findlove.pro
zbo170.app
dexcoenergy.com
nona23.lat
ingelset.com
hexatelier.com
nftees.tech
visionarymaterialsinstitute.com
khanyos.com
bz59.top
migraine-treatment-28778.bond
catboxbot.online
kkugames.com
llmsearchoptimization.com
fipbhvvb.xyz
vmytzptc.xyz
intermediafx.shop
lhrrs.com
grimreapervalley.com
discount-fess.space
liamcollinai.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3276-13-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3276-18-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3020-23-0x0000000000770000-0x000000000079F000-memory.dmp formbook -
Blocklisted process makes network request 2 IoCs
Processes:
wscript.exeflow pid process 65 3020 wscript.exe 71 3020 wscript.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Custom Clearance 5816641785332.exeCustom Clearance 5816641785332.exewscript.exedescription pid process target process PID 892 set thread context of 3276 892 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 3276 set thread context of 3552 3276 Custom Clearance 5816641785332.exe Explorer.EXE PID 3020 set thread context of 3552 3020 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
Custom Clearance 5816641785332.exeCustom Clearance 5816641785332.exewscript.exepid process 892 Custom Clearance 5816641785332.exe 892 Custom Clearance 5816641785332.exe 3276 Custom Clearance 5816641785332.exe 3276 Custom Clearance 5816641785332.exe 3276 Custom Clearance 5816641785332.exe 3276 Custom Clearance 5816641785332.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe 3020 wscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Custom Clearance 5816641785332.exewscript.exepid process 3276 Custom Clearance 5816641785332.exe 3276 Custom Clearance 5816641785332.exe 3276 Custom Clearance 5816641785332.exe 3020 wscript.exe 3020 wscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Custom Clearance 5816641785332.exeCustom Clearance 5816641785332.exewscript.exedescription pid process Token: SeDebugPrivilege 892 Custom Clearance 5816641785332.exe Token: SeDebugPrivilege 3276 Custom Clearance 5816641785332.exe Token: SeDebugPrivilege 3020 wscript.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3552 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Custom Clearance 5816641785332.exeExplorer.EXEwscript.exedescription pid process target process PID 892 wrote to memory of 3276 892 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 892 wrote to memory of 3276 892 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 892 wrote to memory of 3276 892 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 892 wrote to memory of 3276 892 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 892 wrote to memory of 3276 892 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 892 wrote to memory of 3276 892 Custom Clearance 5816641785332.exe Custom Clearance 5816641785332.exe PID 3552 wrote to memory of 3020 3552 Explorer.EXE wscript.exe PID 3552 wrote to memory of 3020 3552 Explorer.EXE wscript.exe PID 3552 wrote to memory of 3020 3552 Explorer.EXE wscript.exe PID 3020 wrote to memory of 4524 3020 wscript.exe cmd.exe PID 3020 wrote to memory of 4524 3020 wscript.exe cmd.exe PID 3020 wrote to memory of 4524 3020 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\Custom Clearance 5816641785332.exe"C:\Users\Admin\AppData\Local\Temp\Custom Clearance 5816641785332.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\Custom Clearance 5816641785332.exe"C:\Users\Admin\AppData\Local\Temp\Custom Clearance 5816641785332.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3276 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Custom Clearance 5816641785332.exe"3⤵PID:4524