Analysis
-
max time kernel
295s -
max time network
300s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24-09-2024 12:47
Behavioral task
behavioral1
Sample
Signed Contract.exe
Resource
win7-20240903-en
General
-
Target
Signed Contract.exe
-
Size
764KB
-
MD5
c29c35fdd0cb6fb2a67ebe5e66d031bf
-
SHA1
8069a08c89042bf1bff896e9d8a68f05db5af316
-
SHA256
7d99c8ec073617681fc7dca3714bce08da1e6a9920aa39b57af734238d5d685f
-
SHA512
f6dd09aae40a4aa6291d0d384f5b5d4fe94770df93585b235fed994f2dbbeb214550b0a3c55bb479f4c5b316520748d2ccec01b1b85e965fb0c51948d7a229b1
-
SSDEEP
12288:v6Wq4aaE6KwyF5L0Y2D1PqLXkK+rLst81zQw+h5GATMnNTXXe53V:tthEVaPqL059QhtTMNTXel
Malware Config
Extracted
formbook
4.1
c89p
ftersaleb.top
dcustomdesgins.net
ostbet2024.live
rhgtrdjdjytkyhretrdjfytd.buzz
atauniversity.tech
idoctor365.net
x-design-courses-29670.bond
ellowold-pc.top
ransportationmmsytpro.top
areerfest.xyz
artiresbah-in.today
ijie.pro
torehousestudio.info
69-11-luxury-watches.shop
earing-tests-44243.bond
hits.shop
hzl9.bond
lood-test-jp-1.bond
livialiving.online
usymomsmakingmoney.online
olar-systems-panels-61747.bond
hinawinner.top
oldensky10.xyz
oginsuperking777.click
oviepicker.net
partment-rental05.online
ldkp.net
sofaerb.shop
ydh5.beauty
aston-saaaa.buzz
acuum-cleaner-84018.bond
usiness-printer-37559.bond
dindadisini12.click
j7zd12m.xyz
plesacv.xyz
trustcapital247.online
asapembuatanpatung.online
ent-all.xyz
r64mh1.vip
aser-cap-hair-growth.today
amattva.company
herightfits.top
uickautoquote.net
ctu36ojboz6w2cl.asia
oursmile.vip
astysavor.website
iam-saaab.buzz
igmoto.info
itchellcohen.net
un-sea.fun
steticavonixx.shop
arklife.shop
bsboffchatrussummsa.online
iuxing.asia
okenexchange.art
llhealthreview.online
refabricated-homes-53685.bond
atercraze.net
osmits.net
rail.cruises
utanginamo.sbs
hapanda.fun
arehouse-inventory-29693.bond
innivip.bio
aycare-service-99683.bond
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/1892-4-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1892-9-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/116-15-0x0000000000530000-0x000000000055F000-memory.dmp formbook -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2600-6-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2600 set thread context of 1892 2600 Signed Contract.exe 82 PID 1892 set thread context of 3532 1892 svchost.exe 56 PID 116 set thread context of 3532 116 wlanext.exe 56 -
resource yara_rule behavioral2/memory/2600-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2600-6-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Signed Contract.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wlanext.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1892 svchost.exe 1892 svchost.exe 1892 svchost.exe 1892 svchost.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe 116 wlanext.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2600 Signed Contract.exe 1892 svchost.exe 1892 svchost.exe 1892 svchost.exe 116 wlanext.exe 116 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1892 svchost.exe Token: SeDebugPrivilege 116 wlanext.exe Token: SeShutdownPrivilege 3532 Explorer.EXE Token: SeCreatePagefilePrivilege 3532 Explorer.EXE -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 2600 Signed Contract.exe 2600 Signed Contract.exe 2600 Signed Contract.exe 2600 Signed Contract.exe 2600 Signed Contract.exe 3532 Explorer.EXE 3532 Explorer.EXE 3532 Explorer.EXE -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 2600 Signed Contract.exe 2600 Signed Contract.exe 2600 Signed Contract.exe 2600 Signed Contract.exe 2600 Signed Contract.exe 3532 Explorer.EXE 3532 Explorer.EXE 3532 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2600 wrote to memory of 1892 2600 Signed Contract.exe 82 PID 2600 wrote to memory of 1892 2600 Signed Contract.exe 82 PID 2600 wrote to memory of 1892 2600 Signed Contract.exe 82 PID 2600 wrote to memory of 1892 2600 Signed Contract.exe 82 PID 3532 wrote to memory of 116 3532 Explorer.EXE 83 PID 3532 wrote to memory of 116 3532 Explorer.EXE 83 PID 3532 wrote to memory of 116 3532 Explorer.EXE 83 PID 116 wrote to memory of 220 116 wlanext.exe 84 PID 116 wrote to memory of 220 116 wlanext.exe 84 PID 116 wrote to memory of 220 116 wlanext.exe 84
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\Signed Contract.exe"C:\Users\Admin\AppData\Local\Temp\Signed Contract.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Signed Contract.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1892
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:220
-
-