Analysis
-
max time kernel
147s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
30-08-2024 08:25
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Etisalat Summary Bill for the Month of August.exe
Resource
win7-20240729-en
windows7-x64
11 signatures
150 seconds
General
-
Target
Etisalat Summary Bill for the Month of August.exe
-
Size
1.1MB
-
MD5
df6915639adaa48dad6b5cad220f1b73
-
SHA1
b7780024fb645196808de54fcb3d48a5581c026d
-
SHA256
a73dc341737a15724833932b844ce4444908158b2b6056386798e440235364db
-
SHA512
c6951e5781c2fe9211863d51872bd135bf9ca67bbc40c2e613642fb102103ad396167e2ab725055cdff6dcd6f2499a0b2a70ba3400602d29bcbcf0d5cabe269f
-
SSDEEP
24576:uqDEvCTbMWu7rQYlBQcBiT6rprG8aRo8Awaa:uTvC/MTQYxsWR7aRo8n
Malware Config
Extracted
Family
formbook
Version
4.1
Campaign
pt46
Decoy
twinportslocal.com
rovor.store
98169.club
mdywl.com
jrd3s.rest
aston1717.top
floridawoodworkingmachinery.com
17tk555t.com
ankitsho.shop
seclameh.com
realrecordlabel.com
trenchonbirmingham.com
af28.top
rtp1kenzototo.com
theselflovesite.com
promotegetpaid.info
strategiclogisticsagency.com
learneracademy.net
per-watch.com
betbox2341.com
22958.xyz
birthdaywishestexts.com
nihilculturamail.com
vasymaman.com
evriukpostaes.sbs
winkingbots.com
cb214.pro
osakanacreation.com
kingchuxing.com
dr-cotton.net
iiixc759q.xyz
eraplay88rtpgacor.lat
wguujb.com
dental-implants-89083.bond
liposuction-89237.bond
harbalmaizik.com
seoservicesdelhi.net
fakefox.xyz
wimetimephotos.com
healthsaveplus.com
wvufcw948o.top
dieselrockpartners.com
istchannelnet.com
123moviesonl.com
arlatwestern.shop
cloudproduction.cloud
gv3l1.vip
casino-x-zerkalo27pm.xyz
serverdayz.com
dvdripguides.com
vitalfitness.site
c21candacedevillier.com
gory12.online
0452frl.com
escpethemtrix.top
koumimi.tech
me29hs38g1.com
dreziuy.xyz
uddyen.shop
asia76s.xyz
melliccine.com
olxelang.com
paincareathome.com
sliveringaf.christmas
wheresthechocolateat.com
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/5064-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/5064-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2656-19-0x0000000001250000-0x000000000127F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3328 set thread context of 5064 3328 Etisalat Summary Bill for the Month of August.exe 88 PID 5064 set thread context of 3404 5064 svchost.exe 56 PID 2656 set thread context of 3404 2656 control.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Etisalat Summary Bill for the Month of August.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language control.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 5064 svchost.exe 5064 svchost.exe 5064 svchost.exe 5064 svchost.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe 2656 control.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 3328 Etisalat Summary Bill for the Month of August.exe 5064 svchost.exe 5064 svchost.exe 5064 svchost.exe 2656 control.exe 2656 control.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
description pid Process Token: SeDebugPrivilege 5064 svchost.exe Token: SeShutdownPrivilege 3404 Explorer.EXE Token: SeCreatePagefilePrivilege 3404 Explorer.EXE Token: SeShutdownPrivilege 3404 Explorer.EXE Token: SeCreatePagefilePrivilege 3404 Explorer.EXE Token: SeShutdownPrivilege 3404 Explorer.EXE Token: SeCreatePagefilePrivilege 3404 Explorer.EXE Token: SeShutdownPrivilege 3404 Explorer.EXE Token: SeCreatePagefilePrivilege 3404 Explorer.EXE Token: SeShutdownPrivilege 3404 Explorer.EXE Token: SeCreatePagefilePrivilege 3404 Explorer.EXE Token: SeShutdownPrivilege 3404 Explorer.EXE Token: SeCreatePagefilePrivilege 3404 Explorer.EXE Token: SeDebugPrivilege 2656 control.exe Token: SeShutdownPrivilege 3404 Explorer.EXE Token: SeCreatePagefilePrivilege 3404 Explorer.EXE Token: SeShutdownPrivilege 3404 Explorer.EXE Token: SeCreatePagefilePrivilege 3404 Explorer.EXE Token: SeShutdownPrivilege 3404 Explorer.EXE Token: SeCreatePagefilePrivilege 3404 Explorer.EXE Token: SeShutdownPrivilege 3404 Explorer.EXE Token: SeCreatePagefilePrivilege 3404 Explorer.EXE Token: SeShutdownPrivilege 3404 Explorer.EXE Token: SeCreatePagefilePrivilege 3404 Explorer.EXE Token: SeShutdownPrivilege 3404 Explorer.EXE Token: SeCreatePagefilePrivilege 3404 Explorer.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3328 Etisalat Summary Bill for the Month of August.exe 3328 Etisalat Summary Bill for the Month of August.exe 3404 Explorer.EXE 3404 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3328 Etisalat Summary Bill for the Month of August.exe 3328 Etisalat Summary Bill for the Month of August.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3404 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3328 wrote to memory of 5064 3328 Etisalat Summary Bill for the Month of August.exe 88 PID 3328 wrote to memory of 5064 3328 Etisalat Summary Bill for the Month of August.exe 88 PID 3328 wrote to memory of 5064 3328 Etisalat Summary Bill for the Month of August.exe 88 PID 3328 wrote to memory of 5064 3328 Etisalat Summary Bill for the Month of August.exe 88 PID 3404 wrote to memory of 2656 3404 Explorer.EXE 91 PID 3404 wrote to memory of 2656 3404 Explorer.EXE 91 PID 3404 wrote to memory of 2656 3404 Explorer.EXE 91 PID 2656 wrote to memory of 2144 2656 control.exe 97 PID 2656 wrote to memory of 2144 2656 control.exe 97 PID 2656 wrote to memory of 2144 2656 control.exe 97
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\Etisalat Summary Bill for the Month of August.exe"C:\Users\Admin\AppData\Local\Temp\Etisalat Summary Bill for the Month of August.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Etisalat Summary Bill for the Month of August.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:5064
-
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:4064
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:2704
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2144
-
-