Analysis
-
max time kernel
145s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
05-09-2024 11:48
Static task
static1
Behavioral task
behavioral1
Sample
SyncTextReader.exe
Resource
win7-20240729-en
General
-
Target
SyncTextReader.exe
-
Size
1.1MB
-
MD5
3a1133a31a67b64ec6165ac328098fdf
-
SHA1
43c43d1025925785a23ec4b160dfd566135266ca
-
SHA256
5f8719f381c3dbe465082297c7ce0d2af2954503f737592f19313ac19f9cd294
-
SHA512
4014477c4f2ab52fd54747891d14e5817ee7090fc2716c1837284f9887b67c58f697278c22a40c4ff30d9d40d16b0e43b907a2927272152b68b6fd4e4bd1db37
-
SSDEEP
24576:bU1zwrxR4lWzWzm1ejk7ZDsLCoFCS4/d8:40R4lEWzm1e47MCogH/K
Malware Config
Extracted
formbook
4.1
j7e
cefuoficial.com
luxmusicclub.com
getridofmyed.xyz
sports-plaza.com
peteropsomer.com
kemendi.com
divinciresolve.com
readtogrowup.com
hidex-corp.com
aladininternational.com
snesait.art
ezzpick.net
saveashow.com
eazyprintsplus.com
usadatesclub.com
rafaelraf.com
themiamadison.com
regarta.com
aiocitys.net
ahorn-invest.com
anajoiasrj.com
rozamail.com
mauriciosagastegui.com
cohorsetrails.com
alboxshop.com
jrqualityautodetailing.com
americanroofingnow.com
scszwl.com
poicol.xyz
primarybillserv.com
smallfinancials.com
rahpilates.info
workflowxray.com
clothapparels.com
cathycre8.co.uk
familiesstores.com
printbonn.com
manismas.com
krispykremesweetpeek.com
redgtc.com
uixsv.com
superiorvillage.com
fdgrenewables.com
appments.com
shanscorp.com
modelleftcoast.com
lookitlook.com
inijuslem.com
bjtqbxg.com
ontariolitigationlawyers.com
certificationroundtable.com
levelup-edu.com
muahangonl.com
lexingtonclarke.com
brapscallions.com
elti-stables.com
nivxros.com
diversifiededhospitality.com
lnstagramappealform.com
anushwirasinha.net
shopalife.xyz
mycryptotrading.net
gxsmrtwtch.icu
williamandholland.com
jzmbgjj.com
Signatures
-
Formbook payload 2 IoCs
resource yara_rule behavioral1/memory/1736-17-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1736-21-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Deletes itself 1 IoCs
pid Process 2796 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2412 set thread context of 1736 2412 SyncTextReader.exe 32 PID 1736 set thread context of 1180 1736 SyncTextReader.exe 21 PID 1260 set thread context of 1180 1260 control.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SyncTextReader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language control.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 324 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 1736 SyncTextReader.exe 1736 SyncTextReader.exe 1260 control.exe 1260 control.exe 1260 control.exe 1260 control.exe 1260 control.exe 1260 control.exe 1260 control.exe 1260 control.exe 1260 control.exe 1260 control.exe 1260 control.exe 1260 control.exe 1260 control.exe 1260 control.exe 1260 control.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1736 SyncTextReader.exe 1736 SyncTextReader.exe 1736 SyncTextReader.exe 1260 control.exe 1260 control.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1736 SyncTextReader.exe Token: SeDebugPrivilege 1260 control.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2412 wrote to memory of 324 2412 SyncTextReader.exe 30 PID 2412 wrote to memory of 324 2412 SyncTextReader.exe 30 PID 2412 wrote to memory of 324 2412 SyncTextReader.exe 30 PID 2412 wrote to memory of 324 2412 SyncTextReader.exe 30 PID 2412 wrote to memory of 1736 2412 SyncTextReader.exe 32 PID 2412 wrote to memory of 1736 2412 SyncTextReader.exe 32 PID 2412 wrote to memory of 1736 2412 SyncTextReader.exe 32 PID 2412 wrote to memory of 1736 2412 SyncTextReader.exe 32 PID 2412 wrote to memory of 1736 2412 SyncTextReader.exe 32 PID 2412 wrote to memory of 1736 2412 SyncTextReader.exe 32 PID 2412 wrote to memory of 1736 2412 SyncTextReader.exe 32 PID 1180 wrote to memory of 1260 1180 Explorer.EXE 34 PID 1180 wrote to memory of 1260 1180 Explorer.EXE 34 PID 1180 wrote to memory of 1260 1180 Explorer.EXE 34 PID 1180 wrote to memory of 1260 1180 Explorer.EXE 34 PID 1260 wrote to memory of 2796 1260 control.exe 35 PID 1260 wrote to memory of 2796 1260 control.exe 35 PID 1260 wrote to memory of 2796 1260 control.exe 35 PID 1260 wrote to memory of 2796 1260 control.exe 35
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\SyncTextReader.exe"C:\Users\Admin\AppData\Local\Temp\SyncTextReader.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NyHwxWSaYDxx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp338E.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:324
-
-
C:\Users\Admin\AppData\Local\Temp\SyncTextReader.exe"C:\Users\Admin\AppData\Local\Temp\SyncTextReader.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1736
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SyncTextReader.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2796
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59adf056ffa7961a3b4203ed9de1dd7ca
SHA1397c9124e1cc9b4953d3b2a940ab40083e44e251
SHA256ad71241f6c9b284aa476911d386cfb7f9b9ebad0d265fe1b3d1bf8413eabe1cd
SHA5128f5eb9f1f6bace21eb1b2439d5e64b6e53dab700864d3dfb76422fff9daace29d0d62d122361b38604c7798030d6946e1071e212e6d251b45e148428204ff15a