Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
18-07-2024 13:26
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.MalwareX-gen.23257.3368.exe
Resource
win7-20240704-en
General
-
Target
SecuriteInfo.com.Win32.MalwareX-gen.23257.3368.exe
-
Size
134KB
-
MD5
7f723f9e10de5dd1ce6d4e6bde89abe4
-
SHA1
555e9af7d45b4436709150c474c28908225132f5
-
SHA256
dd36a21b3f11b6142a898ce80d046abf5f8e0b62fa112957db619c865272ce20
-
SHA512
ccce6e52dca4c11a8de88118b92b477c4f12f035557d6fe132d95e663d67721c76999cff688baeb349e494bfc89d49d636d8ff25207ed1c232f3b2f68508bb7e
-
SSDEEP
3072:/kHnTc+neY+r6MVpHQhIB2E+kgaJysLTVm1AYUb:/kHTi3US/
Malware Config
Extracted
formbook
4.1
mu94
thenextamendment.net
automatiza.xyz
psikologhazelgungor.com
90857.net
robertoblondetrealtor.site
rv0awy.rest
74657.ooo
adigidea.com
world-healing.online
health4world.com
shyan.fun
anviltotable.com
vinger.online
juizltd.com
twmk.asia
cakescrushbyruby.com
listxtreme.com
00050026.xyz
finessedesignhouse.com
jsmm-27.xyz
privet128.band
wyhl668.top
crystalcornerdesignn.com
kameltoe2024.xyz
mwquas.xyz
bt365860.com
c2r2h.xyz
bregylzj.xyz
dxlhu.asia
mythandbody.com
7y-sorte.net
gameogem.com
yourhug.xyz
reviewfreak.net
langitwin.lol
jkku2.rest
het789.com
cn00417984.shop
ry5ls1e02ai.top
cathedrals.shop
kaaatooni.com
ctventure.net
50732650.com
699519f.xyz
sailors.solutions
couples-therapy-39471.bond
eco-liga.com
youngtv.net
31hum.com
cocaincoutre.com
kzliw.xyz
online-business-70709.bond
cleliasfamilychildcare.com
commonhype.dev
tufabricadefiestas.com
playstayaussie.com
best-precious.com
kbk99.fun
cprcertificationcoach.com
mysleepfriend.shop
bt365437.com
rajasusu.pics
youtuberjumpstart.com
bfgj46578456454.vip
dmvdrivingpermit.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2736-4-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2736-7-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2244-14-0x0000000000C30000-0x0000000000C5F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
SecuriteInfo.com.Win32.MalwareX-gen.23257.3368.exeMSBuild.exemstsc.exedescription pid process target process PID 1388 set thread context of 2736 1388 SecuriteInfo.com.Win32.MalwareX-gen.23257.3368.exe MSBuild.exe PID 2736 set thread context of 3512 2736 MSBuild.exe Explorer.EXE PID 2244 set thread context of 3512 2244 mstsc.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
MSBuild.exemstsc.exepid process 2736 MSBuild.exe 2736 MSBuild.exe 2736 MSBuild.exe 2736 MSBuild.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe 2244 mstsc.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
MSBuild.exemstsc.exepid process 2736 MSBuild.exe 2736 MSBuild.exe 2736 MSBuild.exe 2244 mstsc.exe 2244 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
SecuriteInfo.com.Win32.MalwareX-gen.23257.3368.exeMSBuild.exeExplorer.EXEmstsc.exedescription pid process Token: SeDebugPrivilege 1388 SecuriteInfo.com.Win32.MalwareX-gen.23257.3368.exe Token: SeDebugPrivilege 2736 MSBuild.exe Token: SeShutdownPrivilege 3512 Explorer.EXE Token: SeCreatePagefilePrivilege 3512 Explorer.EXE Token: SeDebugPrivilege 2244 mstsc.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3512 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
SecuriteInfo.com.Win32.MalwareX-gen.23257.3368.exeExplorer.EXEmstsc.exedescription pid process target process PID 1388 wrote to memory of 2736 1388 SecuriteInfo.com.Win32.MalwareX-gen.23257.3368.exe MSBuild.exe PID 1388 wrote to memory of 2736 1388 SecuriteInfo.com.Win32.MalwareX-gen.23257.3368.exe MSBuild.exe PID 1388 wrote to memory of 2736 1388 SecuriteInfo.com.Win32.MalwareX-gen.23257.3368.exe MSBuild.exe PID 1388 wrote to memory of 2736 1388 SecuriteInfo.com.Win32.MalwareX-gen.23257.3368.exe MSBuild.exe PID 1388 wrote to memory of 2736 1388 SecuriteInfo.com.Win32.MalwareX-gen.23257.3368.exe MSBuild.exe PID 1388 wrote to memory of 2736 1388 SecuriteInfo.com.Win32.MalwareX-gen.23257.3368.exe MSBuild.exe PID 3512 wrote to memory of 2244 3512 Explorer.EXE mstsc.exe PID 3512 wrote to memory of 2244 3512 Explorer.EXE mstsc.exe PID 3512 wrote to memory of 2244 3512 Explorer.EXE mstsc.exe PID 2244 wrote to memory of 3744 2244 mstsc.exe cmd.exe PID 2244 wrote to memory of 3744 2244 mstsc.exe cmd.exe PID 2244 wrote to memory of 3744 2244 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.23257.3368.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.23257.3368.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" NoLabel3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2736 -
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵PID:3744