Analysis
-
max time kernel
146s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 13:14
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.AutoIt.AQ.gen.Eldorado.22424.9102.exe
Resource
win7-20240903-en
General
-
Target
SecuriteInfo.com.W32.AutoIt.AQ.gen.Eldorado.22424.9102.exe
-
Size
1.1MB
-
MD5
853411ef6f70669a8333b503c2709c15
-
SHA1
da98ef73c0f864862a93482ce19f86ceff91ac1b
-
SHA256
6a1ff3a9d7b6cbba06c46cbe04433eacbffb7f62d20bdcb38ad7d50fc6d6fab6
-
SHA512
e9863dfe2b40f8284843c725161b5c0f63fd3559a4fe69398deb3e4d1a87e9fa9d121e63ea1787151d703ee1f87fb202b8fd3fd5ae68e70556240a676033b4ea
-
SSDEEP
24576:uRmJkcoQricOIQxiZY1iaCErHiF0WHKgUytHxfMuxANhAQpAu:7JZoQrbTFZY1iaCyHq0eUoHRxAXAu
Malware Config
Extracted
formbook
4.1
k94g
nstandgoz.xyz
dhd-treatment-37310.bond
13s-braces-us-ze.fun
umdona.shop
96ph803ql.bond
kka9max.net
corporate-10.xyz
edicalassistance869840.online
lobalresources-bh.xyz
3145978.xyz
ovdaawebsite.online
etting-thailand.net
icloud.xyz
poxk.shop
25ks-ls72510.cyou
women.info
iwyrfbfvhv9.asia
luratu.xyz
ffordable-power-charger.today
edanuryilmaz.xyz
spsbcu.info
kidaman12.click
uringx.top
tockportflat.earth
efafi.fun
alamfestival.online
3mg.pro
epression-treatment-61078.bond
uvs-in-au.today
adeinindonesia.shop
antarcim.xyz
taffguest.net
ystoresc.top
andtools-ml-us.xyz
uoldid.shop
yougouafive.sbs
bitdadenetim.xyz
osmetologysschool7.today
appyeveryday.shop
oof-replacement-38157.bond
ominic-paaaa.buzz
olar-panel-jobs-81246.bond
emlockgolfcourse.shop
tdljo.shop
heoryinteractive.net
lasscraftdesigns.lol
j2i.xyz
itchen-deals-94653.bond
amuel-saaad.buzz
ennettsassociates.net
lectriciansnearme.ltd
yler-paaae.buzz
ruises-67637.bond
lickshopper.shop
louddriver.xyz
ental-bridges-86496.bond
uturemedia.live
48312354.top
ome-loans-16952.bond
anteng777.info
ugold-ss2.net
hmyphoto.click
70872.club
lossqdetailing.net
octurnalaurora.buzz
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/2324-3-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2324-6-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4692-12-0x0000000000E40000-0x0000000000E6F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2036 set thread context of 2324 2036 SecuriteInfo.com.W32.AutoIt.AQ.gen.Eldorado.22424.9102.exe 83 PID 2324 set thread context of 3448 2324 svchost.exe 56 PID 4692 set thread context of 3448 4692 svchost.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SecuriteInfo.com.W32.AutoIt.AQ.gen.Eldorado.22424.9102.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe 4692 svchost.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2036 SecuriteInfo.com.W32.AutoIt.AQ.gen.Eldorado.22424.9102.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 4692 svchost.exe 4692 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2324 svchost.exe Token: SeDebugPrivilege 4692 svchost.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2324 2036 SecuriteInfo.com.W32.AutoIt.AQ.gen.Eldorado.22424.9102.exe 83 PID 2036 wrote to memory of 2324 2036 SecuriteInfo.com.W32.AutoIt.AQ.gen.Eldorado.22424.9102.exe 83 PID 2036 wrote to memory of 2324 2036 SecuriteInfo.com.W32.AutoIt.AQ.gen.Eldorado.22424.9102.exe 83 PID 2036 wrote to memory of 2324 2036 SecuriteInfo.com.W32.AutoIt.AQ.gen.Eldorado.22424.9102.exe 83 PID 3448 wrote to memory of 4692 3448 Explorer.EXE 84 PID 3448 wrote to memory of 4692 3448 Explorer.EXE 84 PID 3448 wrote to memory of 4692 3448 Explorer.EXE 84 PID 4692 wrote to memory of 3344 4692 svchost.exe 89 PID 4692 wrote to memory of 3344 4692 svchost.exe 89 PID 4692 wrote to memory of 3344 4692 svchost.exe 89
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AutoIt.AQ.gen.Eldorado.22424.9102.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AutoIt.AQ.gen.Eldorado.22424.9102.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AutoIt.AQ.gen.Eldorado.22424.9102.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2324
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3344
-
-