Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27-10-2024 17:12
Static task
static1
Behavioral task
behavioral1
Sample
Bank slip.exe
Resource
win7-20241010-en
General
-
Target
Bank slip.exe
-
Size
813KB
-
MD5
cd9e659d35f3995b5ab1760c10800ae2
-
SHA1
3376e44af32ceeac22323d41925f84eade837c81
-
SHA256
1afa322c6a3e0964c704f0d7aea78fe5d506c4bbff033f26f0fe6abc8f88c9cd
-
SHA512
db1158a6aaf1fe8d00f0fa9b3a4aeddf60b56cbc241e903f5cc7f74f6c311691eeb2e704c6297aefc51bf317fd96acab3ac927bb954a7ab4fbd836a36cd303d2
-
SSDEEP
12288:+t2iNtXWgGIJeQAIpel315kiev0r4Cu+9It6vcmLXfXS/XnLFZOqrM2zvIAnF:+t16gOmelFZuUkLXnWqo
Malware Config
Extracted
formbook
4.1
m25s
araghospitality.net
cleans.xyz
olnacasinotcs14.top
pringhillinfos.net
erkakasrumah.online
orean-course-289113002.zone
yeloma-treatment-82106.bond
76iw543gw.autos
nline-shopping-56055.bond
enetik.xyz
ax-th-6011838.fyi
itygatehousing.app
23zy998jk.bond
pslag-hal-2.online
uykoii.shop
9supjub3p.buzz
tmgl.bond
actus-catering-creations.net
ntercashspace24.homes
ierra777.vip
ental-health-69511.bond
newordforpurpose.info
roppsple.shop
edant.ltd
imitake.xyz
ransportationmwmptpro.top
roncrow.biz
armanshop.xyz
ealthy-life-products.online
raphic-design-degree-33148.bond
ildcraft.xyz
16-lawn-care.today
7732.club
vitor.live
uy-smart-tv-nl.today
sone.best
ellcli.net
52006.club
abelzshop.online
cctofi.cpa
alisu.xyz
roformance.shop
cskuvq.shop
anforexuytin.cfd
raceg.cyou
rimevest-global.info
ealthcare-trends-60670.bond
oo.bio
itodemo.click
ottah.studio
teamgame-mod.net
39474.club
yai11.top
onnorbell.design
dt5r.shop
6874.club
wistlnc.net
ntermoney24cad.homes
attoomasteracademy.online
3win4.cyou
xewaov.xyz
6uzh.digital
ransportationwlsltpro.top
oches-a-credito-es.bond
ehills.shop
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/1800-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1800-16-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2400-23-0x0000000000D70000-0x0000000000D9F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 980 set thread context of 1800 980 Bank slip.exe 95 PID 1800 set thread context of 3488 1800 Bank slip.exe 56 PID 2400 set thread context of 3488 2400 svchost.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bank slip.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 59 IoCs
pid Process 980 Bank slip.exe 980 Bank slip.exe 980 Bank slip.exe 1800 Bank slip.exe 1800 Bank slip.exe 1800 Bank slip.exe 1800 Bank slip.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe 2400 svchost.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1800 Bank slip.exe 1800 Bank slip.exe 1800 Bank slip.exe 2400 svchost.exe 2400 svchost.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 980 Bank slip.exe Token: SeDebugPrivilege 1800 Bank slip.exe Token: SeDebugPrivilege 2400 svchost.exe Token: SeShutdownPrivilege 3488 Explorer.EXE Token: SeCreatePagefilePrivilege 3488 Explorer.EXE Token: SeShutdownPrivilege 3488 Explorer.EXE Token: SeCreatePagefilePrivilege 3488 Explorer.EXE Token: SeShutdownPrivilege 3488 Explorer.EXE Token: SeCreatePagefilePrivilege 3488 Explorer.EXE Token: SeShutdownPrivilege 3488 Explorer.EXE Token: SeCreatePagefilePrivilege 3488 Explorer.EXE Token: SeShutdownPrivilege 3488 Explorer.EXE Token: SeCreatePagefilePrivilege 3488 Explorer.EXE Token: SeShutdownPrivilege 3488 Explorer.EXE Token: SeCreatePagefilePrivilege 3488 Explorer.EXE Token: SeShutdownPrivilege 3488 Explorer.EXE Token: SeCreatePagefilePrivilege 3488 Explorer.EXE Token: SeShutdownPrivilege 3488 Explorer.EXE Token: SeCreatePagefilePrivilege 3488 Explorer.EXE Token: SeShutdownPrivilege 3488 Explorer.EXE Token: SeCreatePagefilePrivilege 3488 Explorer.EXE Token: SeShutdownPrivilege 3488 Explorer.EXE Token: SeCreatePagefilePrivilege 3488 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3488 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 980 wrote to memory of 1800 980 Bank slip.exe 95 PID 980 wrote to memory of 1800 980 Bank slip.exe 95 PID 980 wrote to memory of 1800 980 Bank slip.exe 95 PID 980 wrote to memory of 1800 980 Bank slip.exe 95 PID 980 wrote to memory of 1800 980 Bank slip.exe 95 PID 980 wrote to memory of 1800 980 Bank slip.exe 95 PID 3488 wrote to memory of 2400 3488 Explorer.EXE 96 PID 3488 wrote to memory of 2400 3488 Explorer.EXE 96 PID 3488 wrote to memory of 2400 3488 Explorer.EXE 96 PID 2400 wrote to memory of 2864 2400 svchost.exe 97 PID 2400 wrote to memory of 2864 2400 svchost.exe 97 PID 2400 wrote to memory of 2864 2400 svchost.exe 97
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\Bank slip.exe"C:\Users\Admin\AppData\Local\Temp\Bank slip.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\Bank slip.exe"C:\Users\Admin\AppData\Local\Temp\Bank slip.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Bank slip.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2864
-
-