Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
01-11-2024 05:38
Static task
static1
Behavioral task
behavioral1
Sample
cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exe
Resource
win7-20241023-en
General
-
Target
cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exe
-
Size
683KB
-
MD5
6321255a413b5aaaf750317b0cc911f1
-
SHA1
7a02f0345d494a686a9b1c02cfbdc277af3add3a
-
SHA256
cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5
-
SHA512
0e625dbcc154d3b7c487fbc2021265761e19a7a8a87504c570579c1331d550e4384b4b482d9b51e5b8f1e95a85abae64a21b1276f1de169423a17a19b93b7133
-
SSDEEP
12288:f2Z00lxDGuP5bc/puml1cIZulFZ4NVPad3AbTWFZnmEpCQxh4vi:u5agecIZuheVPakTW7pZxei
Malware Config
Extracted
formbook
4.1
md49
enithpro.shop
utozeed.agency
ornpicsbd.xyz
82yjj301.top
kphone.online
3ccha73hdl5.shop
seinow.online
usurrofest.info
2ads2s2.top
oritskul.net
etlivecasino.bet
erts.navy
anieubezpieczenia.online
dyhph1020pm.top
paceglide.space
ibmedia.net
arwyking.icu
soriaticarthritis101.today
earopia.shop
gctg2qt4h.top
bud.studio
vory.pet
likogames.top
igglyjellybean.buzz
enericotr.online
uid.wtf
uturefindsstudio.store
qq6f7.asia
000226.xyz
dmksnfkvnkamddddsss05.sbs
levateacri.shop
reativeplayfulness.xyz
uvy.site
tm.boutique
hequedhornyboob.sbs
kiustx.shop
oatsystem.online
obike.online
ome-care-21144.bond
ellnessboxfrance.shop
hecandidcollective.net
45408.vip
ytj.lat
nline-advertising-67741.bond
iseforce.info
lovxip.xyz
nz75.top
mn17563.info
v6-gpmtn.net
olo-bryle.info
edicalaesthetictreatment.net
exttohashtag.online
oloreklama.biz
5519.one
ayfinalizepagamento.site
udryashki.shop
kesportsap.shop
entalentspublishing.music
2072.vip
ettadrive.app
hecarpentersshopwj.shop
arehouse-inventory-92272.bond
majinesia.cloud
ardenglowliving.site
istorted.app
Signatures
-
Formbook family
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2080-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2080-17-0x0000000000890000-0x0000000000B93000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exedescription pid Process procid_target PID 3068 set thread context of 2080 3068 cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.execf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exepid Process 3068 cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exe 3068 cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exe 3068 cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exe 2080 cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exedescription pid Process Token: SeDebugPrivilege 3068 cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exedescription pid Process procid_target PID 3068 wrote to memory of 2080 3068 cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exe 31 PID 3068 wrote to memory of 2080 3068 cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exe 31 PID 3068 wrote to memory of 2080 3068 cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exe 31 PID 3068 wrote to memory of 2080 3068 cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exe 31 PID 3068 wrote to memory of 2080 3068 cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exe 31 PID 3068 wrote to memory of 2080 3068 cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exe 31 PID 3068 wrote to memory of 2080 3068 cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exe"C:\Users\Admin\AppData\Local\Temp\cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exe"C:\Users\Admin\AppData\Local\Temp\cf18af34e360f0f773f774ce7231f28f6b471fa1b1739e91df0d4cfb943774e5.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2080
-