Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27-10-2024 17:07
Static task
static1
Behavioral task
behavioral1
Sample
Bank slip.exe
Resource
win7-20241010-en
General
-
Target
Bank slip.exe
-
Size
813KB
-
MD5
cd9e659d35f3995b5ab1760c10800ae2
-
SHA1
3376e44af32ceeac22323d41925f84eade837c81
-
SHA256
1afa322c6a3e0964c704f0d7aea78fe5d506c4bbff033f26f0fe6abc8f88c9cd
-
SHA512
db1158a6aaf1fe8d00f0fa9b3a4aeddf60b56cbc241e903f5cc7f74f6c311691eeb2e704c6297aefc51bf317fd96acab3ac927bb954a7ab4fbd836a36cd303d2
-
SSDEEP
12288:+t2iNtXWgGIJeQAIpel315kiev0r4Cu+9It6vcmLXfXS/XnLFZOqrM2zvIAnF:+t16gOmelFZuUkLXnWqo
Malware Config
Extracted
formbook
4.1
m25s
araghospitality.net
cleans.xyz
olnacasinotcs14.top
pringhillinfos.net
erkakasrumah.online
orean-course-289113002.zone
yeloma-treatment-82106.bond
76iw543gw.autos
nline-shopping-56055.bond
enetik.xyz
ax-th-6011838.fyi
itygatehousing.app
23zy998jk.bond
pslag-hal-2.online
uykoii.shop
9supjub3p.buzz
tmgl.bond
actus-catering-creations.net
ntercashspace24.homes
ierra777.vip
ental-health-69511.bond
newordforpurpose.info
roppsple.shop
edant.ltd
imitake.xyz
ransportationmwmptpro.top
roncrow.biz
armanshop.xyz
ealthy-life-products.online
raphic-design-degree-33148.bond
ildcraft.xyz
16-lawn-care.today
7732.club
vitor.live
uy-smart-tv-nl.today
sone.best
ellcli.net
52006.club
abelzshop.online
cctofi.cpa
alisu.xyz
roformance.shop
cskuvq.shop
anforexuytin.cfd
raceg.cyou
rimevest-global.info
ealthcare-trends-60670.bond
oo.bio
itodemo.click
ottah.studio
teamgame-mod.net
39474.club
yai11.top
onnorbell.design
dt5r.shop
6874.club
wistlnc.net
ntermoney24cad.homes
attoomasteracademy.online
3win4.cyou
xewaov.xyz
6uzh.digital
ransportationwlsltpro.top
oches-a-credito-es.bond
ehills.shop
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/2284-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2284-16-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/5020-22-0x00000000008E0000-0x000000000090F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1360 set thread context of 2284 1360 Bank slip.exe 94 PID 2284 set thread context of 3404 2284 Bank slip.exe 56 PID 5020 set thread context of 3404 5020 svchost.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bank slip.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 59 IoCs
pid Process 1360 Bank slip.exe 1360 Bank slip.exe 1360 Bank slip.exe 2284 Bank slip.exe 2284 Bank slip.exe 2284 Bank slip.exe 2284 Bank slip.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe 5020 svchost.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2284 Bank slip.exe 2284 Bank slip.exe 2284 Bank slip.exe 5020 svchost.exe 5020 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1360 Bank slip.exe Token: SeDebugPrivilege 2284 Bank slip.exe Token: SeDebugPrivilege 5020 svchost.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3404 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1360 wrote to memory of 2284 1360 Bank slip.exe 94 PID 1360 wrote to memory of 2284 1360 Bank slip.exe 94 PID 1360 wrote to memory of 2284 1360 Bank slip.exe 94 PID 1360 wrote to memory of 2284 1360 Bank slip.exe 94 PID 1360 wrote to memory of 2284 1360 Bank slip.exe 94 PID 1360 wrote to memory of 2284 1360 Bank slip.exe 94 PID 3404 wrote to memory of 5020 3404 Explorer.EXE 95 PID 3404 wrote to memory of 5020 3404 Explorer.EXE 95 PID 3404 wrote to memory of 5020 3404 Explorer.EXE 95 PID 5020 wrote to memory of 3600 5020 svchost.exe 96 PID 5020 wrote to memory of 3600 5020 svchost.exe 96 PID 5020 wrote to memory of 3600 5020 svchost.exe 96
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\Bank slip.exe"C:\Users\Admin\AppData\Local\Temp\Bank slip.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\Bank slip.exe"C:\Users\Admin\AppData\Local\Temp\Bank slip.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Bank slip.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3600
-
-