Analysis
- max time kernel
148s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20240910-en - resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system - submitted
21/09/2024, 01:29
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
9244e7f4c9184e0087ea02ee9ae60f70fce3dc9e049956e1a30bbff947bbfb35.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
General
- Target 9244e7f4c9184e0087ea02ee9ae60f70fce3dc9e049956e1a30bbff947bbfb35.exe
- Size 1.1MB
- Sample240921-bwd12ayfpr
- SHA256 9244e7f4c9184e0087ea02ee9ae60f70fce3dc9e049956e1a30bbff947bbfb35
- MD5 8b22b618c1532585a65a3cfe829018ab
- SHA1 1c86d17a59b3630829d579a5b7f2d365c0081a6a
- SHA512 cf2cdfcbeb20a63ca1c08cccb9ca154a0854b5835a41b206285feebe3a0bbbea52c0e604d1c4fec1219bfcbe3add48abbb6e228866416085bd04a84e59e813d7
- SSDEEP 24576:uRmJkcoQricOIQxiZY1iaCTb1lxlb5qUf48Gu4zEBr1+OZ:7JZoQrbTFZY1iaC7n5RvZJ+4
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
c24t
Decoy
-
ealthbridgeccs.online
-
ngelicais.art
-
uktuksu1.sbs
-
fapoker.asia
-
hecreature.tech
-
orenzoplaybest14.xyz
-
op-smartphones-deal.today
-
delark.click
-
7395.asia
-
otnews.cfd
-
j16e.xyz
-
oko.events
-
fscxb.top
-
roudtxliberals.vote
-
asas-br.bond
-
ourhealthyourlife.shop
-
fbpd.top
-
j9u9.xyz
-
uijiuw.top
-
aming-chair-37588.bond
-
uaweiharmony.top
-
458881233.men
-
ewancash.boats
-
mss-rb2.net
-
472.top
-
yhomeshop.online
-
j88.travel
-
02s-pest-control-us-ze.fun
-
oinl.club
-
ouseware.today
-
1385.net
-
eviewmadu.top
-
khizmetlergirisyapzzz2024.net
-
dcnn.net
-
aketrtpmvpslot88.info
-
hoys.club
-
ealerslot.net
-
consuyt.xyz
-
ilw.legal
-
aithful.events
-
est-life-insurance-2507.today
-
rvinsadeli.dev
-
sx9u.shop
-
23fd595ig.autos
-
yrhbt.shop
-
commerce-74302.bond
-
lc-driving-school.net
-
7y1ps.shop
-
earing-tests-69481.bond
-
amilablackwell.online
-
venir-bienne.info
-
024tengxun396.buzz
-
ocoani.shop
-
arage-door-repair-1.today
-
entista-esp.today
-
vto.stream
-
loud-computing-intl-3455364.fyi
-
9790.club
-
us-inbox-messages.online
-
aser-hair-removal-90284.bond
-
etangkhap99.lol
-
leaningjobs-cz.today
-
nline-courses-classes-lv-1.bond
-
essislotgoal14.xyz
-
ridges-freezers-56090.bond
Signatures
- Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/2920-3-0x0000000000420000-0x000000000044F000-memory.dmp formbook behavioral2/memory/2920-7-0x0000000000420000-0x000000000044F000-memory.dmp formbook behavioral2/memory/404-13-0x0000000000400000-0x000000000042F000-memory.dmp formbook - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3116-2-0x00000000043F0000-0x00000000047F0000-memory.dmp autoit_exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3116 set thread context of 2920 3116 9244e7f4c9184e0087ea02ee9ae60f70fce3dc9e049956e1a30bbff947bbfb35.exe 86 PID 2920 set thread context of 3444 2920 svchost.exe 56 PID 404 set thread context of 3444 404 rundll32.exe 56 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9244e7f4c9184e0087ea02ee9ae60f70fce3dc9e049956e1a30bbff947bbfb35.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 2920 svchost.exe 2920 svchost.exe 2920 svchost.exe 2920 svchost.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 3116 9244e7f4c9184e0087ea02ee9ae60f70fce3dc9e049956e1a30bbff947bbfb35.exe 3116 9244e7f4c9184e0087ea02ee9ae60f70fce3dc9e049956e1a30bbff947bbfb35.exe 2920 svchost.exe 2920 svchost.exe 2920 svchost.exe 404 rundll32.exe 404 rundll32.exe - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeDebugPrivilege 2920 svchost.exe Token: SeDebugPrivilege 404 rundll32.exe Token: SeShutdownPrivilege 3444 Explorer.EXE Token: SeCreatePagefilePrivilege 3444 Explorer.EXE Token: SeShutdownPrivilege 3444 Explorer.EXE Token: SeCreatePagefilePrivilege 3444 Explorer.EXE Token: SeShutdownPrivilege 3444 Explorer.EXE Token: SeCreatePagefilePrivilege 3444 Explorer.EXE Token: SeShutdownPrivilege 3444 Explorer.EXE Token: SeCreatePagefilePrivilege 3444 Explorer.EXE Token: SeShutdownPrivilege 3444 Explorer.EXE Token: SeCreatePagefilePrivilege 3444 Explorer.EXE Token: SeShutdownPrivilege 3444 Explorer.EXE Token: SeCreatePagefilePrivilege 3444 Explorer.EXE Token: SeShutdownPrivilege 3444 Explorer.EXE Token: SeCreatePagefilePrivilege 3444 Explorer.EXE Token: SeShutdownPrivilege 3444 Explorer.EXE Token: SeCreatePagefilePrivilege 3444 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3444 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3116 wrote to memory of 2920 3116 9244e7f4c9184e0087ea02ee9ae60f70fce3dc9e049956e1a30bbff947bbfb35.exe 86 PID 3116 wrote to memory of 2920 3116 9244e7f4c9184e0087ea02ee9ae60f70fce3dc9e049956e1a30bbff947bbfb35.exe 86 PID 3116 wrote to memory of 2920 3116 9244e7f4c9184e0087ea02ee9ae60f70fce3dc9e049956e1a30bbff947bbfb35.exe 86 PID 3116 wrote to memory of 2920 3116 9244e7f4c9184e0087ea02ee9ae60f70fce3dc9e049956e1a30bbff947bbfb35.exe 86 PID 3444 wrote to memory of 404 3444 Explorer.EXE 87 PID 3444 wrote to memory of 404 3444 Explorer.EXE 87 PID 3444 wrote to memory of 404 3444 Explorer.EXE 87 PID 404 wrote to memory of 2752 404 rundll32.exe 92 PID 404 wrote to memory of 2752 404 rundll32.exe 92 PID 404 wrote to memory of 2752 404 rundll32.exe 92
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\9244e7f4c9184e0087ea02ee9ae60f70fce3dc9e049956e1a30bbff947bbfb35.exe"C:\Users\Admin\AppData\Local\Temp\9244e7f4c9184e0087ea02ee9ae60f70fce3dc9e049956e1a30bbff947bbfb35.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\9244e7f4c9184e0087ea02ee9ae60f70fce3dc9e049956e1a30bbff947bbfb35.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2752
-
-