Analysis
-
max time kernel
149s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
27-10-2024 17:07
Static task
static1
Behavioral task
behavioral1
Sample
Bank slip.exe
Resource
win7-20241010-en
General
-
Target
Bank slip.exe
-
Size
813KB
-
MD5
cd9e659d35f3995b5ab1760c10800ae2
-
SHA1
3376e44af32ceeac22323d41925f84eade837c81
-
SHA256
1afa322c6a3e0964c704f0d7aea78fe5d506c4bbff033f26f0fe6abc8f88c9cd
-
SHA512
db1158a6aaf1fe8d00f0fa9b3a4aeddf60b56cbc241e903f5cc7f74f6c311691eeb2e704c6297aefc51bf317fd96acab3ac927bb954a7ab4fbd836a36cd303d2
-
SSDEEP
12288:+t2iNtXWgGIJeQAIpel315kiev0r4Cu+9It6vcmLXfXS/XnLFZOqrM2zvIAnF:+t16gOmelFZuUkLXnWqo
Malware Config
Extracted
formbook
4.1
m25s
araghospitality.net
cleans.xyz
olnacasinotcs14.top
pringhillinfos.net
erkakasrumah.online
orean-course-289113002.zone
yeloma-treatment-82106.bond
76iw543gw.autos
nline-shopping-56055.bond
enetik.xyz
ax-th-6011838.fyi
itygatehousing.app
23zy998jk.bond
pslag-hal-2.online
uykoii.shop
9supjub3p.buzz
tmgl.bond
actus-catering-creations.net
ntercashspace24.homes
ierra777.vip
ental-health-69511.bond
newordforpurpose.info
roppsple.shop
edant.ltd
imitake.xyz
ransportationmwmptpro.top
roncrow.biz
armanshop.xyz
ealthy-life-products.online
raphic-design-degree-33148.bond
ildcraft.xyz
16-lawn-care.today
7732.club
vitor.live
uy-smart-tv-nl.today
sone.best
ellcli.net
52006.club
abelzshop.online
cctofi.cpa
alisu.xyz
roformance.shop
cskuvq.shop
anforexuytin.cfd
raceg.cyou
rimevest-global.info
ealthcare-trends-60670.bond
oo.bio
itodemo.click
ottah.studio
teamgame-mod.net
39474.club
yai11.top
onnorbell.design
dt5r.shop
6874.club
wistlnc.net
ntermoney24cad.homes
attoomasteracademy.online
3win4.cyou
xewaov.xyz
6uzh.digital
ransportationwlsltpro.top
oches-a-credito-es.bond
ehills.shop
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/2872-13-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2872-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2804-24-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
pid Process 2772 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2220 set thread context of 2872 2220 Bank slip.exe 29 PID 2872 set thread context of 1192 2872 Bank slip.exe 20 PID 2804 set thread context of 1192 2804 NAPSTAT.EXE 20 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bank slip.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NAPSTAT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2220 Bank slip.exe 2220 Bank slip.exe 2872 Bank slip.exe 2872 Bank slip.exe 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2872 Bank slip.exe 2872 Bank slip.exe 2872 Bank slip.exe 2804 NAPSTAT.EXE 2804 NAPSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2220 Bank slip.exe Token: SeDebugPrivilege 2872 Bank slip.exe Token: SeDebugPrivilege 2804 NAPSTAT.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2872 2220 Bank slip.exe 29 PID 2220 wrote to memory of 2872 2220 Bank slip.exe 29 PID 2220 wrote to memory of 2872 2220 Bank slip.exe 29 PID 2220 wrote to memory of 2872 2220 Bank slip.exe 29 PID 2220 wrote to memory of 2872 2220 Bank slip.exe 29 PID 2220 wrote to memory of 2872 2220 Bank slip.exe 29 PID 2220 wrote to memory of 2872 2220 Bank slip.exe 29 PID 1192 wrote to memory of 2804 1192 Explorer.EXE 30 PID 1192 wrote to memory of 2804 1192 Explorer.EXE 30 PID 1192 wrote to memory of 2804 1192 Explorer.EXE 30 PID 1192 wrote to memory of 2804 1192 Explorer.EXE 30 PID 2804 wrote to memory of 2772 2804 NAPSTAT.EXE 31 PID 2804 wrote to memory of 2772 2804 NAPSTAT.EXE 31 PID 2804 wrote to memory of 2772 2804 NAPSTAT.EXE 31 PID 2804 wrote to memory of 2772 2804 NAPSTAT.EXE 31
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\Bank slip.exe"C:\Users\Admin\AppData\Local\Temp\Bank slip.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\Bank slip.exe"C:\Users\Admin\AppData\Local\Temp\Bank slip.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2872
-
-
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Bank slip.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2772
-
-