Analysis
-
max time kernel
96s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17-08-2024 01:21
Static task
static1
Behavioral task
behavioral1
Sample
cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe
Resource
win7-20240704-en
General
-
Target
cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe
-
Size
733KB
-
MD5
7095e01e6bf3655a8b1d1449a91cd195
-
SHA1
59bcb0f7b17b4d6ccb6efd8f3a47a5bf6f1b2268
-
SHA256
cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba
-
SHA512
ab6444bc46a4f037ecdce3b57b9f92732ce17e4034e9616d067c6148bae34ed3bfeba4f6e2b2aee2d4391cd679a0737e4fabaf0d0c940ec0b22bad167e501a21
-
SSDEEP
12288:FoQyRAvxF72mzaRZJvfUAp2F0Fthci5UoiKqBLXpOi/8UOkWTSWK:sSxF7HzaRFpA0X3viKk5JsfSz
Malware Config
Extracted
formbook
4.1
bi05
ollow-the-bit.online
aopho.autos
14ra567dp.autos
48651301.top
ussian-dating-54714.bond
sychology-degree-80838.bond
lytracker.xyz
strology-forest.sbs
swjbcl3.top
ridgenexttechnologies.partners
lroy.sbs
kyscreen.vip
anhit.live
uckyheart.xyz
orddserials.online
hetune.shop
nherited-traits-ant.bond
stanaslot-1.xyz
sychologist-therapy-36914.bond
iandramonami.net
5125.photo
p-fmweb002c684.top
x-scissor-lifts-glob-512.today
7winvn.net
oudya.shop
enks.top
ashion247.shop
oadtekpaving.net
istinctcsolutions.net
sjin.info
ata-protection-30362.bond
pfrt-22-mb.click
ucknowgames.info
nnovadis.online
gent.business
ffordableimpoundedcars.online
ort.lol
kwow.top
s-usdt.top
vnaiinew.info
rm888.shop
hnbakery.shop
hisismylguana.xyz
panish-classes-87877.bond
olan-paaaa.buzz
lkiv.xyz
hp520.xyz
uocdiengiai.website
fx168.shop
erapiacontraeldolor.net
ortal-bfl.online
antoshy.online
ruises-treatment-93183.bond
ursociotheory.xyz
9243.net
ingerie-43588.bond
udistsex.top
refabricated-homes-72652.bond
mail-marketing-91020.bond
d7xey20.top
7-casino-zsl.buzz
isualquotations.xyz
dn8pvdr.forum
dormy.click
hyma.cyou
Signatures
-
Formbook payload 1 IoCs
resource yara_rule behavioral2/memory/1120-24-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1328 powershell.exe 1460 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3892 set thread context of 1120 3892 cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe 101 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2436 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3892 cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe 1460 powershell.exe 1460 powershell.exe 3892 cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe 3892 cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe 1328 powershell.exe 1328 powershell.exe 1120 cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe 1120 cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe 1120 cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe 1460 powershell.exe 1328 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3892 cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe Token: SeDebugPrivilege 1460 powershell.exe Token: SeDebugPrivilege 1328 powershell.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3892 wrote to memory of 1460 3892 cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe 95 PID 3892 wrote to memory of 1460 3892 cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe 95 PID 3892 wrote to memory of 1460 3892 cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe 95 PID 3892 wrote to memory of 1328 3892 cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe 97 PID 3892 wrote to memory of 1328 3892 cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe 97 PID 3892 wrote to memory of 1328 3892 cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe 97 PID 3892 wrote to memory of 2436 3892 cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe 99 PID 3892 wrote to memory of 2436 3892 cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe 99 PID 3892 wrote to memory of 2436 3892 cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe 99 PID 3892 wrote to memory of 1120 3892 cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe 101 PID 3892 wrote to memory of 1120 3892 cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe 101 PID 3892 wrote to memory of 1120 3892 cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe 101 PID 3892 wrote to memory of 1120 3892 cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe 101 PID 3892 wrote to memory of 1120 3892 cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe 101 PID 3892 wrote to memory of 1120 3892 cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe"C:\Users\Admin\AppData\Local\Temp\cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1460
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ajZqJStNo.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1328
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ajZqJStNo" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE280.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2436
-
-
C:\Users\Admin\AppData\Local\Temp\cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe"C:\Users\Admin\AppData\Local\Temp\cbeee5f0d63a9178155739c1eca36e16ceaffc7ccda4154d991f068766df52ba.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1120
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD53132bce958bdb1468504db49bc1f1ac1
SHA14174a6880a51cc7cc3c4141f73d578dfd426f888
SHA2561894ac7e6266ad8a4d2de5f852a11e28b52d8483ce3afa243d232ba251737d66
SHA512e9ae69ff281e35cd4fc62524dba226c4a455fae231e27595cc959ac53adef3b528565081a8c9f44413514953c282ff281944c10aabe09db7a5ef18eae654fa7d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5c3360a1c0cb91b6d1f57020544287be5
SHA1fd5a41ec87e8099672238c02c1af16a50329ef93
SHA256974e23de650c3430a0d8d78021c59e0cef518818e31649efe5f3e3fe9a69e361
SHA51221c0638d072323c764db3befedc8526176be0b36d2dab5ed5ea7b61cc0664509b37cdd1153e6c0160b5358cf79ebc3d05852a0398e135f106c116aec53864719