Analysis
-
max time kernel
147s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
17-07-2024 17:01
Static task
static1
Behavioral task
behavioral1
Sample
MalwareBazaar.exe
Resource
win7-20240704-en
General
-
Target
MalwareBazaar.exe
-
Size
677KB
-
MD5
978af787e7c03fa3cb90bc9cecf33862
-
SHA1
c7748a8f4b34af3a8e76e1583ac14cd95c32ac9e
-
SHA256
2a346621e42f809c9cbfaf01bd2baa682838165f5e24c7c945f855671fc457e4
-
SHA512
943269d4678ca4de5f45ca891b3eecdbd6c5835c53055c246bfd918beaea6f09c4c0a2b263ec687a7440a4d0b492a4089aa168c6d80f5d36b89a4f9669d71ca6
-
SSDEEP
12288:bUME/4AgZ9n0Ao3NX0pQm0FSD8GBkxb3fOOE7MxIpNu4jOtM/u61IVA:FE/4AgX0AL108AGBE3fu1jOeW61IVA
Malware Config
Extracted
formbook
4.1
v15n
dyahwoahjuk.store
toysstorm.com
y7rak9.com
2222233p6.shop
betbox2341.com
visualvarta.com
nijssenadventures.com
main-12.site
leng4d.net
kurainu.xyz
hatesa.xyz
culturamosaica.com
supermallify.store
gigboard.app
rxforgive.com
ameliestones.com
kapalwin.live
tier.credit
sobol-ksa.com
faredeal.online
226b.xyz
talktohannaford500.shop
mxrkpkngishbdss.xyz
mirotcg.info
turbo3club.site
hjnd28t010cop.cyou
marveloustep.shop
syedlatief.com
comfortableleather.com
alltradescortland.com
dnwgt80508yoec8pzq.top
kedai168ef.com
gelgoodlife.com
nxtskey.com
milliedevine.store
wordcraftart.fun
mpo525.monster
bt365851.com
dogeversetoken.net
boostgrowmode.com
dacapital.net
project21il.com
go4stores.com
brunoduarte.online
sexgodmasterclass.com
wuhey.shop
jdginl892e.xyz
agenkilat-official.space
hacks.digital
suv.xyz
fwbsmg.life
vicmvm649n.top
wbahdfw.icu
creativelyloud.com
merrycleanteam.com
solar-systems-panels-58747.bond
rotaryclubofmukono.com
bethanyumcnola.info
breezafan.com
ny-robotictoys.com
lawyers-br-pt-9390663.fyi
neurasaudi.com
dgccb.com
sayuri-walk.com
gtur.top
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2832-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2832-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2752-20-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2608 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
MalwareBazaar.exeMalwareBazaar.exeexplorer.exedescription pid process target process PID 2696 set thread context of 2832 2696 MalwareBazaar.exe MalwareBazaar.exe PID 2832 set thread context of 1180 2832 MalwareBazaar.exe Explorer.EXE PID 2752 set thread context of 1180 2752 explorer.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
MalwareBazaar.exeexplorer.exepid process 2832 MalwareBazaar.exe 2832 MalwareBazaar.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
MalwareBazaar.exeexplorer.exepid process 2832 MalwareBazaar.exe 2832 MalwareBazaar.exe 2832 MalwareBazaar.exe 2752 explorer.exe 2752 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
MalwareBazaar.exeexplorer.exedescription pid process Token: SeDebugPrivilege 2832 MalwareBazaar.exe Token: SeDebugPrivilege 2752 explorer.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
MalwareBazaar.exeExplorer.EXEexplorer.exedescription pid process target process PID 2696 wrote to memory of 2832 2696 MalwareBazaar.exe MalwareBazaar.exe PID 2696 wrote to memory of 2832 2696 MalwareBazaar.exe MalwareBazaar.exe PID 2696 wrote to memory of 2832 2696 MalwareBazaar.exe MalwareBazaar.exe PID 2696 wrote to memory of 2832 2696 MalwareBazaar.exe MalwareBazaar.exe PID 2696 wrote to memory of 2832 2696 MalwareBazaar.exe MalwareBazaar.exe PID 2696 wrote to memory of 2832 2696 MalwareBazaar.exe MalwareBazaar.exe PID 2696 wrote to memory of 2832 2696 MalwareBazaar.exe MalwareBazaar.exe PID 1180 wrote to memory of 2752 1180 Explorer.EXE explorer.exe PID 1180 wrote to memory of 2752 1180 Explorer.EXE explorer.exe PID 1180 wrote to memory of 2752 1180 Explorer.EXE explorer.exe PID 1180 wrote to memory of 2752 1180 Explorer.EXE explorer.exe PID 2752 wrote to memory of 2608 2752 explorer.exe cmd.exe PID 2752 wrote to memory of 2608 2752 explorer.exe cmd.exe PID 2752 wrote to memory of 2608 2752 explorer.exe cmd.exe PID 2752 wrote to memory of 2608 2752 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2832 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"3⤵
- Deletes itself
PID:2608