Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12-09-2024 07:44
Static task
static1
Behavioral task
behavioral1
Sample
a87b700c19104816959afda09a7673d758a21261d417c14d20a208280ee3385f.exe
Resource
win7-20240708-en
General
-
Target
a87b700c19104816959afda09a7673d758a21261d417c14d20a208280ee3385f.exe
-
Size
615KB
-
MD5
52f47f35616ad4633470e06b3faf9e60
-
SHA1
fdf4d0243984fd21f9b6e119d65d42daa105b3a7
-
SHA256
a87b700c19104816959afda09a7673d758a21261d417c14d20a208280ee3385f
-
SHA512
ec6d26fde44e77e08c53169c88b887ebdf3e3745ac386ae7234639671a6b09d8f62beafaf875df6e90ca6f6bc3254bd4fa2b6b17c5e6db7fb7340583b7a5e059
-
SSDEEP
12288:2p7kvDoQSUCHgdLdHi7UaYdREb2WJCXudsrlkVZBqIgikrwGK:2poe9HgdLsUaYdREyWMXudOlk75gtr
Malware Config
Extracted
formbook
4.1
d16h
iki-graphy.online
l8z8c.vip
1709.asia
inematography-course-72246.bond
pis3noe2e.sbs
wernv.xyz
ovepepe.xyz
ama-online.world
ookmouse.fun
harkclothingdesigns.xyz
bbvvjuiqew.bond
sed-cars-93620.bond
esgateeganhe.shop
cekmeledak.info
ebulahorizon.buzz
peakers-92991.bond
essislotgoal16.top
hafi.biz
ichunyang.club
lrica.net
eslgnpro.shop
nvlqmm.biz
ophiola.shop
eet-new-people-11795.bond
q4ehy.digital
emdchocolate.xyz
amilablackwell.online
yakkojeans.shop
ujairahtenniscountry.club
rtplaris4d.xyz
omotech-dz.net
nvesting-courses-71217.bond
uyamiclearnow.online
asymobiledna.net
uvidorias.online
xthjd.shop
atiser.shop
cjinni.buzz
ome-renovation-now.bond
aima.today
ianipulsa.live
est-phones-deals-today.today
dult-diapers-75243.bond
migosdotocantins.online
q1nv9tr.skin
iwh.asia
inematography-course-43930.bond
omeerakhtar.shop
onstruction-jobs-27145.bond
02183.club
ookoutcapstone.xyz
raham-saaae.buzz
pringhillinfos.net
dworld.shop
usionfair.online
averickmedical.online
ingerie-36230.bond
etirement-plans-76931.bond
ipi.digital
exacore.click
ishivka.pro
es47857843.shop
75yyq301.top
yougouaaggyy.top
972.studio
Signatures
-
Formbook payload 1 IoCs
resource yara_rule behavioral1/memory/2004-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2700 set thread context of 2004 2700 a87b700c19104816959afda09a7673d758a21261d417c14d20a208280ee3385f.exe 30 -
Program crash 1 IoCs
pid pid_target Process procid_target 2208 2004 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a87b700c19104816959afda09a7673d758a21261d417c14d20a208280ee3385f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a87b700c19104816959afda09a7673d758a21261d417c14d20a208280ee3385f.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2700 wrote to memory of 2004 2700 a87b700c19104816959afda09a7673d758a21261d417c14d20a208280ee3385f.exe 30 PID 2700 wrote to memory of 2004 2700 a87b700c19104816959afda09a7673d758a21261d417c14d20a208280ee3385f.exe 30 PID 2700 wrote to memory of 2004 2700 a87b700c19104816959afda09a7673d758a21261d417c14d20a208280ee3385f.exe 30 PID 2700 wrote to memory of 2004 2700 a87b700c19104816959afda09a7673d758a21261d417c14d20a208280ee3385f.exe 30 PID 2700 wrote to memory of 2004 2700 a87b700c19104816959afda09a7673d758a21261d417c14d20a208280ee3385f.exe 30 PID 2700 wrote to memory of 2004 2700 a87b700c19104816959afda09a7673d758a21261d417c14d20a208280ee3385f.exe 30 PID 2700 wrote to memory of 2004 2700 a87b700c19104816959afda09a7673d758a21261d417c14d20a208280ee3385f.exe 30 PID 2004 wrote to memory of 2208 2004 a87b700c19104816959afda09a7673d758a21261d417c14d20a208280ee3385f.exe 31 PID 2004 wrote to memory of 2208 2004 a87b700c19104816959afda09a7673d758a21261d417c14d20a208280ee3385f.exe 31 PID 2004 wrote to memory of 2208 2004 a87b700c19104816959afda09a7673d758a21261d417c14d20a208280ee3385f.exe 31 PID 2004 wrote to memory of 2208 2004 a87b700c19104816959afda09a7673d758a21261d417c14d20a208280ee3385f.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\a87b700c19104816959afda09a7673d758a21261d417c14d20a208280ee3385f.exe"C:\Users\Admin\AppData\Local\Temp\a87b700c19104816959afda09a7673d758a21261d417c14d20a208280ee3385f.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\a87b700c19104816959afda09a7673d758a21261d417c14d20a208280ee3385f.exe"C:\Users\Admin\AppData\Local\Temp\a87b700c19104816959afda09a7673d758a21261d417c14d20a208280ee3385f.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 363⤵
- Program crash
PID:2208
-
-