Analysis
-
max time kernel
146s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-11-2024 13:20
Static task
static1
Behavioral task
behavioral1
Sample
59ae2629ce8149b038cd46ad72a9e76de8678f8c0f284ff6182d642c05007939.exe
Resource
win7-20240903-en
General
-
Target
59ae2629ce8149b038cd46ad72a9e76de8678f8c0f284ff6182d642c05007939.exe
-
Size
1.1MB
-
MD5
96d3854d251ef67abcd64dd77d8e8f96
-
SHA1
67287638bb52465804179d38f522dfe782cfaec9
-
SHA256
59ae2629ce8149b038cd46ad72a9e76de8678f8c0f284ff6182d642c05007939
-
SHA512
9ef435c8d176fc5b87c32309ca1d3a6500f7692ef47627898445f4918b78be5b6f5f5eb8ddf0141dce4cb57f381329261c84bf3a3d7df0f250a91810daeb8deb
-
SSDEEP
24576:ffmMv6Ckr7Mny5QLkwtPiDovnB/ZcObUP1:f3v+7/5QLkwcDovn70P1
Malware Config
Extracted
formbook
4.1
ge07
mail-marketing2-9946168.live
ouwmijnweb.net
verythingmars.online
rgqhcy.shop
unter-saaaa.buzz
ox.bio
arkside.top
ransportationmmsktpro.top
lue-ocean-bar.group
lympiccat.xyz
onstruction-jobs-49170.bond
andon-saaab.buzz
fdmw.sbs
48430091.top
yuyh.boats
kyt968.shop
pismedical.shop
ocialmediafactory.xyz
inussofa.shop
ision.fit
himenote.shop
eto-gummies-01010.bond
ummpk.online
bx.mobi
werad-neumann.info
polo77meledak.fun
uel-fleet-cards-60697.bond
asaslotzeed.online
media.group
gfdsq.xyz
stralexploration.website
ltraslot.win
-16.net
hellalee-llc.xyz
cz9mi.digital
mea.tech
ools-59989.bond
y94nt6.vip
ubaimports.online
tlantishealth.online
athing-suits-78317.bond
uxembourgembassypakistan.shop
262jpdhkd.bond
38gk910gy.autos
q345.vip
attlesaber.net
alecell.net
blungit.xyz
anfrontier.net
obic.info
erman3d.shop
igxyuje.click
eartestqa.bond
ar-deals-77763.bond
dormy.click
oodchoicemall.net
otelmanagementdegree.info
ental-health-91275.bond
76jys301.top
asecore.net
oursocialbuzz.buzz
amuel-paaaa.buzz
ercadaoshop.shop
ome-care-37159.bond
ruisjob.today
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2512-3-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2512-6-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/3068-12-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
59ae2629ce8149b038cd46ad72a9e76de8678f8c0f284ff6182d642c05007939.exesvchost.exemstsc.exedescription pid Process procid_target PID 1992 set thread context of 2512 1992 59ae2629ce8149b038cd46ad72a9e76de8678f8c0f284ff6182d642c05007939.exe 30 PID 2512 set thread context of 1244 2512 svchost.exe 21 PID 3068 set thread context of 1244 3068 mstsc.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
59ae2629ce8149b038cd46ad72a9e76de8678f8c0f284ff6182d642c05007939.exemstsc.execmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59ae2629ce8149b038cd46ad72a9e76de8678f8c0f284ff6182d642c05007939.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
svchost.exemstsc.exepid Process 2512 svchost.exe 2512 svchost.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe 3068 mstsc.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
59ae2629ce8149b038cd46ad72a9e76de8678f8c0f284ff6182d642c05007939.exesvchost.exemstsc.exepid Process 1992 59ae2629ce8149b038cd46ad72a9e76de8678f8c0f284ff6182d642c05007939.exe 2512 svchost.exe 2512 svchost.exe 2512 svchost.exe 3068 mstsc.exe 3068 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
svchost.exemstsc.exedescription pid Process Token: SeDebugPrivilege 2512 svchost.exe Token: SeDebugPrivilege 3068 mstsc.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
59ae2629ce8149b038cd46ad72a9e76de8678f8c0f284ff6182d642c05007939.exeExplorer.EXEmstsc.exedescription pid Process procid_target PID 1992 wrote to memory of 2512 1992 59ae2629ce8149b038cd46ad72a9e76de8678f8c0f284ff6182d642c05007939.exe 30 PID 1992 wrote to memory of 2512 1992 59ae2629ce8149b038cd46ad72a9e76de8678f8c0f284ff6182d642c05007939.exe 30 PID 1992 wrote to memory of 2512 1992 59ae2629ce8149b038cd46ad72a9e76de8678f8c0f284ff6182d642c05007939.exe 30 PID 1992 wrote to memory of 2512 1992 59ae2629ce8149b038cd46ad72a9e76de8678f8c0f284ff6182d642c05007939.exe 30 PID 1992 wrote to memory of 2512 1992 59ae2629ce8149b038cd46ad72a9e76de8678f8c0f284ff6182d642c05007939.exe 30 PID 1244 wrote to memory of 3068 1244 Explorer.EXE 31 PID 1244 wrote to memory of 3068 1244 Explorer.EXE 31 PID 1244 wrote to memory of 3068 1244 Explorer.EXE 31 PID 1244 wrote to memory of 3068 1244 Explorer.EXE 31 PID 3068 wrote to memory of 2900 3068 mstsc.exe 32 PID 3068 wrote to memory of 2900 3068 mstsc.exe 32 PID 3068 wrote to memory of 2900 3068 mstsc.exe 32 PID 3068 wrote to memory of 2900 3068 mstsc.exe 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\59ae2629ce8149b038cd46ad72a9e76de8678f8c0f284ff6182d642c05007939.exe"C:\Users\Admin\AppData\Local\Temp\59ae2629ce8149b038cd46ad72a9e76de8678f8c0f284ff6182d642c05007939.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\59ae2629ce8149b038cd46ad72a9e76de8678f8c0f284ff6182d642c05007939.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2512
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2900
-
-