Analysis
- max time kernel
149s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
23/08/2024, 09:12
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
14b0d4325eaa7ad618ebbd5484993f0439ca78b36faa5d2b99faf22703a21d53.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
150 seconds
General
- Target 14b0d4325eaa7ad618ebbd5484993f0439ca78b36faa5d2b99faf22703a21d53.exe
- Size 1.2MB
- Sample240823-k6hawayaml
- SHA256 14b0d4325eaa7ad618ebbd5484993f0439ca78b36faa5d2b99faf22703a21d53
- MD5 861892f267f889518f3789ce0fcb0cf2
- SHA1 876802cd29fe8b258c6bdb94d66729ab7d28be36
- SHA512 e1f8f1bb11783ed6b653b792fe9562115e2f69d54932da7086105f92cc0fc11123a1513de17de4c6e7b28bd41089450bed84d9cfbee621034dd526e262d85ccf
- SSDEEP 24576:wqDEvCTbMWu7rQYlBQcBiT6rprG8aBHZ2woL3B6yr2MX7FJ:wTvC/MTQYxsWR7aBTEBpSm
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
ot96
Decoy
-
yclingbear.studio
-
sxuio.xyz
-
eon-official-bk-o57v.buzz
-
teel.management
-
rusjitu.sbs
-
ighwald-holdings.info
-
ummitfinancal.vip
-
layvalleyconstruction.online
-
pp-games-efficsecuspon.xyz
-
ouh.shop
-
mgltd.services
-
gshsjwhgsg.fun
-
eidotijolo.online
-
yifg.sbs
-
nline-gaming-ox-mx.xyz
-
ux-money.info
-
inergiputraborneo.dev
-
panish-classes-67016.bond
-
reightrading.info
-
23bet.xyz
-
lg158.cfd
-
ecas-para-usted.xyz
-
rinklefree.xyz
-
deptkajsa.cfd
-
dqrw.info
-
watio-staging-internal.app
-
audyluxevintageboutique.shop
-
ruise-jobs-90138.bond
-
amuel-paaae.buzz
-
vf-treatment-near-me-my.today
-
olarsystemssa.today
-
aniel-saaae.buzz
-
25ks-ls72510.cyou
-
onstruction-services-98555.bond
-
saauiiqew.bond
-
antsell.xyz
-
v43ni4t.xyz
-
eight-loss-0725.today
-
ridgenextdigital.online
-
ver.exchange
-
mazoncarbon.shop
-
ugbin.xyz
-
ousecleaning-vort-p1-bob-3.shop
-
onnenkollektor-de.today
-
c369kj.buzz
-
pfrt-22-mb.click
-
opcornrobot.online
-
hecashflowcatalog.net
-
j-slot88gacor.bond
-
rhtf.buzz
-
otitemmarket.net
-
ercedesemrotomotiv.shop
-
yantech.online
-
entalslab.net
-
gowelcomeflingofswish.homes
-
martdata.sbs
-
martbedin02.today
-
nnovativeind.xyz
-
99577-sj.top
-
umanoid.exchange
-
omputercourses123.live
-
oncreterepairjob-4fb.click
-
piiice.net
-
ersinakilliev.online
-
etirementconundrum.live
Signatures
- Formbook payload 4 IoCs
resource yara_rule behavioral2/memory/324-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/324-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/324-19-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4032-26-0x0000000000560000-0x000000000058F000-memory.dmp formbook - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1740 set thread context of 324 1740 14b0d4325eaa7ad618ebbd5484993f0439ca78b36faa5d2b99faf22703a21d53.exe 87 PID 324 set thread context of 3476 324 svchost.exe 56 PID 324 set thread context of 3476 324 svchost.exe 56 PID 4032 set thread context of 3476 4032 raserver.exe 56 - Program crash 1 IoCs
pid pid_target Process procid_target 3792 1740 WerFault.exe 83 - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14b0d4325eaa7ad618ebbd5484993f0439ca78b36faa5d2b99faf22703a21d53.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language raserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 324 svchost.exe 324 svchost.exe 324 svchost.exe 324 svchost.exe 324 svchost.exe 324 svchost.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe 4032 raserver.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1740 14b0d4325eaa7ad618ebbd5484993f0439ca78b36faa5d2b99faf22703a21d53.exe 324 svchost.exe 324 svchost.exe 324 svchost.exe 324 svchost.exe 4032 raserver.exe 4032 raserver.exe - Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeDebugPrivilege 324 svchost.exe Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeDebugPrivilege 4032 raserver.exe Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1740 14b0d4325eaa7ad618ebbd5484993f0439ca78b36faa5d2b99faf22703a21d53.exe 1740 14b0d4325eaa7ad618ebbd5484993f0439ca78b36faa5d2b99faf22703a21d53.exe 3476 Explorer.EXE 3476 Explorer.EXE - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1740 14b0d4325eaa7ad618ebbd5484993f0439ca78b36faa5d2b99faf22703a21d53.exe 1740 14b0d4325eaa7ad618ebbd5484993f0439ca78b36faa5d2b99faf22703a21d53.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3476 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1740 wrote to memory of 324 1740 14b0d4325eaa7ad618ebbd5484993f0439ca78b36faa5d2b99faf22703a21d53.exe 87 PID 1740 wrote to memory of 324 1740 14b0d4325eaa7ad618ebbd5484993f0439ca78b36faa5d2b99faf22703a21d53.exe 87 PID 1740 wrote to memory of 324 1740 14b0d4325eaa7ad618ebbd5484993f0439ca78b36faa5d2b99faf22703a21d53.exe 87 PID 1740 wrote to memory of 324 1740 14b0d4325eaa7ad618ebbd5484993f0439ca78b36faa5d2b99faf22703a21d53.exe 87 PID 3476 wrote to memory of 4032 3476 Explorer.EXE 97 PID 3476 wrote to memory of 4032 3476 Explorer.EXE 97 PID 3476 wrote to memory of 4032 3476 Explorer.EXE 97 PID 4032 wrote to memory of 3764 4032 raserver.exe 100 PID 4032 wrote to memory of 3764 4032 raserver.exe 100 PID 4032 wrote to memory of 3764 4032 raserver.exe 100
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\14b0d4325eaa7ad618ebbd5484993f0439ca78b36faa5d2b99faf22703a21d53.exe"C:\Users\Admin\AppData\Local\Temp\14b0d4325eaa7ad618ebbd5484993f0439ca78b36faa5d2b99faf22703a21d53.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\14b0d4325eaa7ad618ebbd5484993f0439ca78b36faa5d2b99faf22703a21d53.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 6963⤵
- Program crash
PID:3792
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3764
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1740 -ip 17401⤵PID:4676