Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2024, 12:08
Static task
static1
Behavioral task
behavioral1
Sample
E-dekont.exe
Resource
win7-20240729-en
General
-
Target
E-dekont.exe
-
Size
740KB
-
MD5
3eee9378f53abfa4a0f14bc2b21444f7
-
SHA1
1d9600e5889c31bd94eef88437d9b6adfcdef930
-
SHA256
4624ef5fa24a2459eb8c1504e9bdee4e61e762680ee5bc5f2f52c77f197648fe
-
SHA512
f9a1a943c8f9bde431302a81b4986cfa376ced72fd5510d7f330d653cc00e5523c993a82e774a01db956da7ee311142b4aadd142970ba9bddb10b2af4b934696
-
SSDEEP
12288:IgWVFxEViHEmbGqdI5UrPcD/YAp99IwxGoq2uYPnV7tqnZxaFYRwySnUKj:lWVFxEAkmNdImLKAA50oIYPnV7mTKySD
Malware Config
Extracted
formbook
4.1
m17o
kzqh72.top
arket-obybqq.xyz
afechoice.click
ote-knplpa.xyz
aqgpie.xyz
orker-ornp.xyz
he-beds321.today
ut-nlvv.xyz
31231827.xyz
milymariephotography.net
wquqo.click
veu-where.xyz
mjcpo-pick.xyz
yself-lpnbdl.xyz
austoowagosha.net
ive-wgag.xyz
lay-drift-palace.xyz
old-vubgv.xyz
ideo-shooting-courses.today
ntendsisaiasjazmin.shop
rangphimhay.net
ingsai.top
31231869.xyz
okue-least.xyz
actose-free-nutrition.click
ghu-yourself.xyz
umgi-paper.xyz
koj-themselves.xyz
wax-magazine.xyz
ncenseproln.shop
kpl-0166.top
lygww-box.xyz
espond-sspb.xyz
uniaslot77-azul.click
olisticuniversal.design
rawlstarsbrasil.shop
vvimy.top
igrct-itself.xyz
euauhugonisyallaer.shop
allout76microsoft.shop
oedavn.shop
ovie-vkgei.xyz
ssk-even.xyz
lc.mobi
nyoy-adult.xyz
killup2work.net
1684.app
xecutive-kutoax.xyz
eneration-vxej.xyz
-navi.net
elemqio-ojuu.top
xpl-yet.xyz
uthor-pfndoi.xyz
ecimalplace.net
yikb-vote.xyz
39581.top
ischi-waschi.jetzt
31232158.xyz
ucksvip.top
unstylingt.xyz
pike-volnix.click
5ddc2.xyz
2rbet.mobi
uivlio.xyz
oolgege.top
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/3108-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3108-16-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/556-64-0x0000000000800000-0x000000000082F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2672 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation E-dekont.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1744 set thread context of 3108 1744 E-dekont.exe 102 PID 3108 set thread context of 3500 3108 E-dekont.exe 56 PID 556 set thread context of 3500 556 explorer.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E-dekont.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 3108 E-dekont.exe 3108 E-dekont.exe 3108 E-dekont.exe 3108 E-dekont.exe 2672 powershell.exe 2672 powershell.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe 556 explorer.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3108 E-dekont.exe 3108 E-dekont.exe 3108 E-dekont.exe 556 explorer.exe 556 explorer.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3108 E-dekont.exe Token: SeDebugPrivilege 2672 powershell.exe Token: SeDebugPrivilege 556 explorer.exe Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3500 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1744 wrote to memory of 2672 1744 E-dekont.exe 100 PID 1744 wrote to memory of 2672 1744 E-dekont.exe 100 PID 1744 wrote to memory of 2672 1744 E-dekont.exe 100 PID 1744 wrote to memory of 3108 1744 E-dekont.exe 102 PID 1744 wrote to memory of 3108 1744 E-dekont.exe 102 PID 1744 wrote to memory of 3108 1744 E-dekont.exe 102 PID 1744 wrote to memory of 3108 1744 E-dekont.exe 102 PID 1744 wrote to memory of 3108 1744 E-dekont.exe 102 PID 1744 wrote to memory of 3108 1744 E-dekont.exe 102 PID 3500 wrote to memory of 556 3500 Explorer.EXE 104 PID 3500 wrote to memory of 556 3500 Explorer.EXE 104 PID 3500 wrote to memory of 556 3500 Explorer.EXE 104 PID 556 wrote to memory of 3796 556 explorer.exe 106 PID 556 wrote to memory of 3796 556 explorer.exe 106 PID 556 wrote to memory of 3796 556 explorer.exe 106
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\E-dekont.exe"C:\Users\Admin\AppData\Local\Temp\E-dekont.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\E-dekont.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
-
C:\Users\Admin\AppData\Local\Temp\E-dekont.exe"C:\Users\Admin\AppData\Local\Temp\E-dekont.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3108
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:1660
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\E-dekont.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3796
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82