Analysis
-
max time kernel
147s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
31-10-2024 18:05
Static task
static1
Behavioral task
behavioral1
Sample
Payment USD10655.69 - Kassim.exe
Resource
win7-20241010-en
General
-
Target
Payment USD10655.69 - Kassim.exe
-
Size
703KB
-
MD5
10a6749f5d629dd8a724bbab9e4ca18d
-
SHA1
51f9876f7f414adc7069569c1f034b96e32a1694
-
SHA256
a66fd780dafe112e8ee95dd63b7d6138fea1e5273b961b2774e3be95a677990d
-
SHA512
c5646e67585c20dda9f09d8deafa5c0dc7100e055df8e13ba2b2f81ac63b1eb8b8f751bd7630b5c7057953e915831d4dfc69b4b2f6e0e9ea0e6da9a34022e715
-
SSDEEP
12288:QvRrXQ9TZweIjcQ2nK7QjBj+ljRc6f/itos8NDiTThb+izH4cAXsq4nXZs78xLyf:qwIjdqJ+ljRdfKtos84TT1Pdq4nXZsBu
Malware Config
Extracted
formbook
4.1
md49
enithpro.shop
utozeed.agency
ornpicsbd.xyz
82yjj301.top
kphone.online
3ccha73hdl5.shop
seinow.online
usurrofest.info
2ads2s2.top
oritskul.net
etlivecasino.bet
erts.navy
anieubezpieczenia.online
dyhph1020pm.top
paceglide.space
ibmedia.net
arwyking.icu
soriaticarthritis101.today
earopia.shop
gctg2qt4h.top
bud.studio
vory.pet
likogames.top
igglyjellybean.buzz
enericotr.online
uid.wtf
uturefindsstudio.store
qq6f7.asia
000226.xyz
dmksnfkvnkamddddsss05.sbs
levateacri.shop
reativeplayfulness.xyz
uvy.site
tm.boutique
hequedhornyboob.sbs
kiustx.shop
oatsystem.online
obike.online
ome-care-21144.bond
ellnessboxfrance.shop
hecandidcollective.net
45408.vip
ytj.lat
nline-advertising-67741.bond
iseforce.info
lovxip.xyz
nz75.top
mn17563.info
v6-gpmtn.net
olo-bryle.info
edicalaesthetictreatment.net
exttohashtag.online
oloreklama.biz
5519.one
ayfinalizepagamento.site
udryashki.shop
kesportsap.shop
entalentspublishing.music
2072.vip
ettadrive.app
hecarpentersshopwj.shop
arehouse-inventory-92272.bond
majinesia.cloud
ardenglowliving.site
istorted.app
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2160-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2160-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2304-21-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid Process 2252 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Payment USD10655.69 - Kassim.exePayment USD10655.69 - Kassim.exewlanext.exedescription pid Process procid_target PID 1736 set thread context of 2160 1736 Payment USD10655.69 - Kassim.exe 30 PID 2160 set thread context of 1212 2160 Payment USD10655.69 - Kassim.exe 21 PID 2304 set thread context of 1212 2304 wlanext.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exePayment USD10655.69 - Kassim.exewlanext.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Payment USD10655.69 - Kassim.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wlanext.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
Payment USD10655.69 - Kassim.exewlanext.exepid Process 2160 Payment USD10655.69 - Kassim.exe 2160 Payment USD10655.69 - Kassim.exe 2304 wlanext.exe 2304 wlanext.exe 2304 wlanext.exe 2304 wlanext.exe 2304 wlanext.exe 2304 wlanext.exe 2304 wlanext.exe 2304 wlanext.exe 2304 wlanext.exe 2304 wlanext.exe 2304 wlanext.exe 2304 wlanext.exe 2304 wlanext.exe 2304 wlanext.exe 2304 wlanext.exe 2304 wlanext.exe 2304 wlanext.exe 2304 wlanext.exe 2304 wlanext.exe 2304 wlanext.exe 2304 wlanext.exe 2304 wlanext.exe 2304 wlanext.exe 2304 wlanext.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Payment USD10655.69 - Kassim.exewlanext.exepid Process 2160 Payment USD10655.69 - Kassim.exe 2160 Payment USD10655.69 - Kassim.exe 2160 Payment USD10655.69 - Kassim.exe 2304 wlanext.exe 2304 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Payment USD10655.69 - Kassim.exewlanext.exedescription pid Process Token: SeDebugPrivilege 2160 Payment USD10655.69 - Kassim.exe Token: SeDebugPrivilege 2304 wlanext.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Payment USD10655.69 - Kassim.exeExplorer.EXEwlanext.exedescription pid Process procid_target PID 1736 wrote to memory of 2160 1736 Payment USD10655.69 - Kassim.exe 30 PID 1736 wrote to memory of 2160 1736 Payment USD10655.69 - Kassim.exe 30 PID 1736 wrote to memory of 2160 1736 Payment USD10655.69 - Kassim.exe 30 PID 1736 wrote to memory of 2160 1736 Payment USD10655.69 - Kassim.exe 30 PID 1736 wrote to memory of 2160 1736 Payment USD10655.69 - Kassim.exe 30 PID 1736 wrote to memory of 2160 1736 Payment USD10655.69 - Kassim.exe 30 PID 1736 wrote to memory of 2160 1736 Payment USD10655.69 - Kassim.exe 30 PID 1212 wrote to memory of 2304 1212 Explorer.EXE 31 PID 1212 wrote to memory of 2304 1212 Explorer.EXE 31 PID 1212 wrote to memory of 2304 1212 Explorer.EXE 31 PID 1212 wrote to memory of 2304 1212 Explorer.EXE 31 PID 2304 wrote to memory of 2252 2304 wlanext.exe 32 PID 2304 wrote to memory of 2252 2304 wlanext.exe 32 PID 2304 wrote to memory of 2252 2304 wlanext.exe 32 PID 2304 wrote to memory of 2252 2304 wlanext.exe 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\Payment USD10655.69 - Kassim.exe"C:\Users\Admin\AppData\Local\Temp\Payment USD10655.69 - Kassim.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\Payment USD10655.69 - Kassim.exe"C:\Users\Admin\AppData\Local\Temp\Payment USD10655.69 - Kassim.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2160
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Payment USD10655.69 - Kassim.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2252
-
-