Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31-10-2024 03:43
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe
Resource
win7-20241010-en
windows7-x64
11 signatures
150 seconds
General
-
Target
a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe
-
Size
1.3MB
-
MD5
dc43665b900f0f30bee8aca7505a4c08
-
SHA1
3e45224d1f0e65c09f741a83591633011b3c0ee0
-
SHA256
a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63
-
SHA512
76045c4d51dfe7d8755eec14e96dbabf97575e4bcff57747b82abb9a740662c1bfb35a59a96a9e55483d89c61f537c6590b6f23c03de5ff162812ff8a6e19115
-
SSDEEP
24576:cqDEvCTbMWu7rQYlBQcBiT6rprG8awE4lEyDH3gVyeqaGXtVVo:cTvC/MTQYxsWR7awoyDH3gselGXt/
Malware Config
Extracted
Family
formbook
Version
4.1
Campaign
ge07
Decoy
amyard.shop
eloshost.xyz
g18q11a.top
orensic-vendor-735524320.click
ithin-ksvodn.xyz
xhyx.top
elonix-traceglow.pro
cillascrewedsedroth.cfd
wner-nyquh.xyz
reyhazeusa.shop
esmellretaperetotal.cfd
hqm-during.xyz
pipagtxcorrelo.xyz
lray-civil.xyz
apybarameme.xyz
rbuds.shop
hild-fcudh.xyz
rkgexg.top
estwestcottwines.shop
giyztm.xyz
epehr.pics
lways-vhyrp.xyz
acifictechnologycctv.net
iscinddocenaemlynne.cfd
ridesmaidgiftsboutiqueki.shop
ubtleclothingco.fashion
hemicans.xyz
ebaoge318.top
zoc-marriage.xyz
ngeribe2.homes
oal-ahzgwo.xyz
eries-htii.xyz
ool-covers76.xyz
ecurityemployment.today
croom.net
f7y2i9fgm.xyz
earch-lawyer-consultation.today
066iwx2t.shop
ound-omagf.xyz
ivglass.xyz
fdyh-investment.xyz
yegle.net
eader-aaexvn.xyz
dvle-father.xyz
onsfskfsmpfssfpewqdsawqe.xyz
ffect-xedzl.xyz
ood-packaging-jobs-brasil.today
lasterdeals.shop
ehkd.top
pm-22-ns-2.click
ocockbowerlybrawer.cfd
ostcanadantpl.top
vrkof-point.xyz
lsader.app
nce-ystyx.xyz
azl.pro
ea-yogkkb.xyz
isit-txax.xyz
rowadservepros.net
6282.xyz
roduct-xgky.xyz
wner-nyquh.xyz
sfmoreservicesllc.lat
rasko.net
9net88.net
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2456-3-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2456-6-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/444-12-0x0000000000350000-0x000000000037F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exesvchost.exewlanext.exedescription pid Process procid_target PID 4384 set thread context of 2456 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 94 PID 2456 set thread context of 3488 2456 svchost.exe 56 PID 444 set thread context of 3488 444 wlanext.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exewlanext.execmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wlanext.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
svchost.exewlanext.exepid Process 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe 444 wlanext.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exesvchost.exewlanext.exepid Process 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 444 wlanext.exe 444 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
svchost.exewlanext.exedescription pid Process Token: SeDebugPrivilege 2456 svchost.exe Token: SeDebugPrivilege 444 wlanext.exe -
Suspicious use of FindShellTrayWindow 12 IoCs
Processes:
a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exepid Process 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exepid Process 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid Process 3488 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exeExplorer.EXEwlanext.exedescription pid Process procid_target PID 4384 wrote to memory of 2456 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 94 PID 4384 wrote to memory of 2456 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 94 PID 4384 wrote to memory of 2456 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 94 PID 4384 wrote to memory of 2456 4384 a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe 94 PID 3488 wrote to memory of 444 3488 Explorer.EXE 95 PID 3488 wrote to memory of 444 3488 Explorer.EXE 95 PID 3488 wrote to memory of 444 3488 Explorer.EXE 95 PID 444 wrote to memory of 4020 444 wlanext.exe 100 PID 444 wrote to memory of 4020 444 wlanext.exe 100 PID 444 wrote to memory of 4020 444 wlanext.exe 100
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe"C:\Users\Admin\AppData\Local\Temp\a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2456
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4020
-
-