Analysis
-
max time kernel
145s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 13:15
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT CONFIRMATION.exe
Resource
win7-20241010-en
General
-
Target
PAYMENT CONFIRMATION.exe
-
Size
1.0MB
-
MD5
8fdc4e20705ad4f83474fd664ba6b627
-
SHA1
29452d7daa56ceecf38fefb434ac78fadf494b3b
-
SHA256
9b250f96c8e383893d2c2f0ae940312d86e6aec8d0e27aadd9087dce67d17c46
-
SHA512
5aa6885ee2d16167ad65f5dabf45f78078f97f33aefcc2a9fe89eed6fd68b38eab07d8ac493c89f173f794c8e9aaf4edb09111c36f15a67244389bd752c70881
-
SSDEEP
12288:Ytb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgad7ouhgE/f4SeKq6o6A:Ytb20pkaCqT5TBWgNQ7axoCA5N6o6A
Malware Config
Extracted
formbook
4.1
ge07
amyard.shop
eloshost.xyz
g18q11a.top
orensic-vendor-735524320.click
ithin-ksvodn.xyz
xhyx.top
elonix-traceglow.pro
cillascrewedsedroth.cfd
wner-nyquh.xyz
reyhazeusa.shop
esmellretaperetotal.cfd
hqm-during.xyz
pipagtxcorrelo.xyz
lray-civil.xyz
apybarameme.xyz
rbuds.shop
hild-fcudh.xyz
rkgexg.top
estwestcottwines.shop
giyztm.xyz
epehr.pics
lways-vhyrp.xyz
acifictechnologycctv.net
iscinddocenaemlynne.cfd
ridesmaidgiftsboutiqueki.shop
ubtleclothingco.fashion
hemicans.xyz
ebaoge318.top
zoc-marriage.xyz
ngeribe2.homes
oal-ahzgwo.xyz
eries-htii.xyz
ool-covers76.xyz
ecurityemployment.today
croom.net
f7y2i9fgm.xyz
earch-lawyer-consultation.today
066iwx2t.shop
ound-omagf.xyz
ivglass.xyz
fdyh-investment.xyz
yegle.net
eader-aaexvn.xyz
dvle-father.xyz
onsfskfsmpfssfpewqdsawqe.xyz
ffect-xedzl.xyz
ood-packaging-jobs-brasil.today
lasterdeals.shop
ehkd.top
pm-22-ns-2.click
ocockbowerlybrawer.cfd
ostcanadantpl.top
vrkof-point.xyz
lsader.app
nce-ystyx.xyz
azl.pro
ea-yogkkb.xyz
isit-txax.xyz
rowadservepros.net
6282.xyz
roduct-xgky.xyz
wner-nyquh.xyz
sfmoreservicesllc.lat
rasko.net
9net88.net
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/4688-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4688-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3476-22-0x0000000000B90000-0x0000000000BBF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1716 set thread context of 4688 1716 PAYMENT CONFIRMATION.exe 86 PID 4688 set thread context of 3424 4688 svchost.exe 56 PID 3476 set thread context of 3424 3476 WWAHost.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PAYMENT CONFIRMATION.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WWAHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 4688 svchost.exe 4688 svchost.exe 4688 svchost.exe 4688 svchost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe 3476 WWAHost.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1716 PAYMENT CONFIRMATION.exe 4688 svchost.exe 4688 svchost.exe 4688 svchost.exe 3476 WWAHost.exe 3476 WWAHost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4688 svchost.exe Token: SeDebugPrivilege 3476 WWAHost.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3424 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1716 wrote to memory of 4688 1716 PAYMENT CONFIRMATION.exe 86 PID 1716 wrote to memory of 4688 1716 PAYMENT CONFIRMATION.exe 86 PID 1716 wrote to memory of 4688 1716 PAYMENT CONFIRMATION.exe 86 PID 1716 wrote to memory of 4688 1716 PAYMENT CONFIRMATION.exe 86 PID 3424 wrote to memory of 3476 3424 Explorer.EXE 87 PID 3424 wrote to memory of 3476 3424 Explorer.EXE 87 PID 3424 wrote to memory of 3476 3424 Explorer.EXE 87 PID 3476 wrote to memory of 2728 3476 WWAHost.exe 88 PID 3476 wrote to memory of 2728 3476 WWAHost.exe 88 PID 3476 wrote to memory of 2728 3476 WWAHost.exe 88
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\PAYMENT CONFIRMATION.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT CONFIRMATION.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT CONFIRMATION.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4688
-
-
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2728
-
-