Analysis
-
max time kernel
148s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08-09-2024 08:29
Static task
static1
Behavioral task
behavioral1
Sample
TaM7bqgMSWHgB70.exe
Resource
win7-20240704-en
General
-
Target
TaM7bqgMSWHgB70.exe
-
Size
759KB
-
MD5
7964a64e6b4d057c5499ee8014065ca9
-
SHA1
2d35cd22d3c737deffa70a849b2532a611706bb4
-
SHA256
0689efc1f50248e1c54837bb7c19113fd293eb18623147113910df57017fe260
-
SHA512
3dc319baeee1fbc73931d56515898bfc9e84d7638185597fc0c71e503700dd664c12b1ce6dd46e8a2ab3e13ac49b7898497bd9067e198296b0f9d1752d832a2a
-
SSDEEP
12288:kREG1UoIG5MPUgo7CXeLZfWdmI5uX+KFejLbOPrAfrNuctl:6RUobyemifWdm+uX+FLb2iua
Malware Config
Extracted
formbook
4.1
he2a
070001606.xyz
jesuseascriancas.online
as-eltransport.xyz
bankditalia-company.online
linkedin-stijngraat.online
sportsbetd.xyz
spanish-classes-76893.bond
infonation.pro
nxwzbze.forum
rush-pay.biz
fulfillmissions.lat
infolungcancer.xyz
aqario.xyz
omepro.solar
jackmanmueshl.shop
amcart.store
ishanaudichya.xyz
sun4rk.shop
depression-test-74287.bond
chipit.shop
aulagaminggear.shop
bxc3465.top
credit-rapide-sans-refus.bond
securesavings.ltd
hasanbasriuzun.shop
apolo77meledak.fun
notbokin.online
ethost.biz
cicek-suslemeleri.shop
fashionistahaven.net
opentelemetry.shop
bunny-decor.shop
mersar.fun
send-me-your-feet.pics
intap.shop
supergeoet.best
security-apps-89466.bond
ldentityone.net
b9h.pro
farms-sophon.xyz
shadow-walker.online
jjkdd.vip
yrotf.top
influencer-marketing-47216.bond
dfbfanclub.shop
quarterdeck.cfd
mexico-vacations-packages.today
online-gaming-66785.bond
crowsecurity.online
fmi-lostdevice.live
protesisdentalfijaprecio.bond
tcfsi.info
memecoin.vote
walk-in-tubs-65827.bond
linkvin777.top
serenitymassage.top
hostmyworld.net
searchgpt.world
blankmedspa.gallery
mattress-17708.bond
sedanghokiorg.info
funzone365.shop
metacuore.net
coldzero.top
sdcollections.shop
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/2272-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2272-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2792-20-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
pid Process 2956 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2520 set thread context of 2272 2520 TaM7bqgMSWHgB70.exe 31 PID 2272 set thread context of 1212 2272 TaM7bqgMSWHgB70.exe 21 PID 2792 set thread context of 1212 2792 wlanext.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TaM7bqgMSWHgB70.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wlanext.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 2272 TaM7bqgMSWHgB70.exe 2272 TaM7bqgMSWHgB70.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe 2792 wlanext.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2272 TaM7bqgMSWHgB70.exe 2272 TaM7bqgMSWHgB70.exe 2272 TaM7bqgMSWHgB70.exe 2792 wlanext.exe 2792 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2272 TaM7bqgMSWHgB70.exe Token: SeDebugPrivilege 2792 wlanext.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2272 2520 TaM7bqgMSWHgB70.exe 31 PID 2520 wrote to memory of 2272 2520 TaM7bqgMSWHgB70.exe 31 PID 2520 wrote to memory of 2272 2520 TaM7bqgMSWHgB70.exe 31 PID 2520 wrote to memory of 2272 2520 TaM7bqgMSWHgB70.exe 31 PID 2520 wrote to memory of 2272 2520 TaM7bqgMSWHgB70.exe 31 PID 2520 wrote to memory of 2272 2520 TaM7bqgMSWHgB70.exe 31 PID 2520 wrote to memory of 2272 2520 TaM7bqgMSWHgB70.exe 31 PID 1212 wrote to memory of 2792 1212 Explorer.EXE 32 PID 1212 wrote to memory of 2792 1212 Explorer.EXE 32 PID 1212 wrote to memory of 2792 1212 Explorer.EXE 32 PID 1212 wrote to memory of 2792 1212 Explorer.EXE 32 PID 2792 wrote to memory of 2956 2792 wlanext.exe 33 PID 2792 wrote to memory of 2956 2792 wlanext.exe 33 PID 2792 wrote to memory of 2956 2792 wlanext.exe 33 PID 2792 wrote to memory of 2956 2792 wlanext.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\TaM7bqgMSWHgB70.exe"C:\Users\Admin\AppData\Local\Temp\TaM7bqgMSWHgB70.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\TaM7bqgMSWHgB70.exe"C:\Users\Admin\AppData\Local\Temp\TaM7bqgMSWHgB70.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2272
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\TaM7bqgMSWHgB70.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2956
-
-