Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
31-10-2024 01:01
Static task
static1
Behavioral task
behavioral1
Sample
b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff.exe
Resource
win7-20241023-en
General
-
Target
b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff.exe
-
Size
1.0MB
-
MD5
18aa3e958673ab344b5a1440c6c22415
-
SHA1
507cd39367debb2dd96b19393e38cfa1d1978f91
-
SHA256
b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff
-
SHA512
c6aafd8c858aa72778895e61840cedae7c66e3316b913d1cd80f44e7ceceae48f655955bc8bbe6b3bd53662d8654c46bad2523b8f663c57675a0545b7fc286ae
-
SSDEEP
24576:ffmMv6Ckr7Mny5QLqq/Set8hVp3Q7SS5lQ:f3v+7/5QL14VKS
Malware Config
Extracted
formbook
4.1
fh84
mtzyn.top
zfn-no-hsts.win
j10g.xyz
arehouse-inventory-60572.bond
nlineprodutooffer.shop
ar-deals-77764.bond
e3m2.xyz
cquisitive.group
unkusol.xyz
01307.xyz
uratedcelebrations.net
nfiniworkshop-thai.online
s-cmc.net
idney360.info
ipolar-treatment-us-311-ze.zone
entenstituleridernegi.biz
olombiaoutlet.shop
uradab.rest
qega.shop
73519.vip
legantea.net
tudyinaustraliamy.today
treetsofsanfrancisco.shop
asino-pinup-slots2.online
7yptkxx.forum
8745.net
15dm143lk.autos
ethalmine.xyz
races-dental-splints-52226.bond
angerouslyliberalkamala.info
roker.autos
w-br.online
afenorah.xyz
ell-phones-search-jp.today
affasnacks.info
asksksmsms.xyz
hopsoimod.online
hebespokebrief.info
acman.world
nfotrackptc.top
ecurity-apps-89277.bond
37pg-games.pro
pfzm.top
nalyticdata.xyz
uymetanail2.online
ohnpaulgetty.xyz
kewpura.cfd
mpg777.top
rendinghawaiianshirt.net
ldsoul.nyc
ai-paaab.buzz
anielpeninmasterclass.pro
fficialpromotion.shop
irconditionerjobs-2fb.click
etropixelshop.info
uy-smart-tv-ar.today
roperties-for-rent-39228.bond
t-m.xyz
nmnm.top
lsdao.xyz
ltacourierr.buzz
oin-mailer.app
ceanlovers.net
rozenservice.online
partments-for-rent-gurus.sbs
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2500-3-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2500-6-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1008-13-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff.exesvchost.exesystray.exedescription pid Process procid_target PID 2272 set thread context of 2500 2272 b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff.exe 30 PID 2500 set thread context of 1216 2500 svchost.exe 21 PID 1008 set thread context of 1216 1008 systray.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff.exesystray.execmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systray.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
svchost.exesystray.exepid Process 2500 svchost.exe 2500 svchost.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff.exesvchost.exesystray.exepid Process 2272 b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff.exe 2500 svchost.exe 2500 svchost.exe 2500 svchost.exe 1008 systray.exe 1008 systray.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
svchost.exesystray.exedescription pid Process Token: SeDebugPrivilege 2500 svchost.exe Token: SeDebugPrivilege 1008 systray.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff.exeExplorer.EXEpid Process 2272 b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff.exe 2272 b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff.exe 1216 Explorer.EXE 1216 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff.exepid Process 2272 b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff.exe 2272 b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff.exeExplorer.EXEsystray.exedescription pid Process procid_target PID 2272 wrote to memory of 2500 2272 b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff.exe 30 PID 2272 wrote to memory of 2500 2272 b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff.exe 30 PID 2272 wrote to memory of 2500 2272 b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff.exe 30 PID 2272 wrote to memory of 2500 2272 b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff.exe 30 PID 2272 wrote to memory of 2500 2272 b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff.exe 30 PID 1216 wrote to memory of 1008 1216 Explorer.EXE 31 PID 1216 wrote to memory of 1008 1216 Explorer.EXE 31 PID 1216 wrote to memory of 1008 1216 Explorer.EXE 31 PID 1216 wrote to memory of 1008 1216 Explorer.EXE 31 PID 1008 wrote to memory of 1404 1008 systray.exe 32 PID 1008 wrote to memory of 1404 1008 systray.exe 32 PID 1008 wrote to memory of 1404 1008 systray.exe 32 PID 1008 wrote to memory of 1404 1008 systray.exe 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff.exe"C:\Users\Admin\AppData\Local\Temp\b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1404
-
-