Analysis
-
max time kernel
146s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
15-11-2024 07:54
Static task
static1
Behavioral task
behavioral1
Sample
Transfer of rights and privilege.exe
Resource
win7-20241023-en
General
-
Target
Transfer of rights and privilege.exe
-
Size
1.1MB
-
MD5
fa91a7463a9ea4918102bccaa035dac1
-
SHA1
eb1e162fc866d77e6ca4f68c464e4793a9013094
-
SHA256
e5eda013173004830010766af13273e9ee2b96c0c63628a531945e4e8c0da884
-
SHA512
a40959b205039c308f3bc396bd86d060da71938d1199b1000837fd1037e01dcd9a530ad7083ab4f66458c3772b64fe27cd372fcc747fa6e931ec4393a38d3cc4
-
SSDEEP
24576:Dtb20pkaCqT5TBWgNQ7ayLWZ2KbH1EhzJ9OPR7z6A:AVg5tQ7ayLWZ2KOJIRP5
Malware Config
Extracted
formbook
4.1
cl21
0001.shop
earch-parttimejobs.today
are888.top
akanhaunthipped.shop
othing-heyu.xyz
cadvirsor.net
nclanalae.shop
lectric-cars-mexico.today
oxj-question.xyz
ersonalloanoffers.today
ersonalloans-fo54-fo37.click
verybody-ewfx.xyz
ercuremontauban.media
azilimdunyam.net
airs-clinicato.today
wiftsscend.click
ertainly-jbws.xyz
8xeng.app
damekadmitageable.cfd
ollapsedec.shop
mpldo.app
g18q29a.top
etaddiction.tech
lbatasalboinamoco.shop
eyyzj-medical.xyz
ote-lmeg.xyz
cellelukacs.shop
evinedesignz11.net
n217.vip
eimy.top
ellisimaa.shop
hjk-west.xyz
nline-dating-be-10.today
wocykmw.top
ytsxv.xyz
iding-lawn-mower.today
olarpergolasolutions.today
ainco.net
r86yd.top
ndrvb-stock.xyz
ing88vn.today
vez3.xyz
fg-am.pro
ultplanlz.click
ecurebet.click
fjng-court.xyz
rsenalatamanaxweed.shop
iaoyingtao16.vip
rime-kvsff.xyz
ufdd-interesting.xyz
qbdl-base.xyz
ushihq.xyz
400108pptddbo685.top
tself-gqemlq.xyz
uyher.shop
ffprintshoplv.shop
ushyniceneobaza.cfd
dmrroa.net
ar-deals-ca-8966160.live
ramx-jorv.top
ifw-less.xyz
hwisdom.net
xrjgq-prepare.xyz
rchertravel.click
ingledatings46.xyz
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/2676-7-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2676-10-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1436-16-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1556 set thread context of 2676 1556 Transfer of rights and privilege.exe 30 PID 2676 set thread context of 1100 2676 svchost.exe 20 PID 1436 set thread context of 1100 1436 netsh.exe 20 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Transfer of rights and privilege.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2676 svchost.exe 2676 svchost.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe 1436 netsh.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1556 Transfer of rights and privilege.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 1436 netsh.exe 1436 netsh.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2676 svchost.exe Token: SeDebugPrivilege 1436 netsh.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1556 wrote to memory of 2676 1556 Transfer of rights and privilege.exe 30 PID 1556 wrote to memory of 2676 1556 Transfer of rights and privilege.exe 30 PID 1556 wrote to memory of 2676 1556 Transfer of rights and privilege.exe 30 PID 1556 wrote to memory of 2676 1556 Transfer of rights and privilege.exe 30 PID 1556 wrote to memory of 2676 1556 Transfer of rights and privilege.exe 30 PID 1100 wrote to memory of 1436 1100 Explorer.EXE 31 PID 1100 wrote to memory of 1436 1100 Explorer.EXE 31 PID 1100 wrote to memory of 1436 1100 Explorer.EXE 31 PID 1100 wrote to memory of 1436 1100 Explorer.EXE 31 PID 1436 wrote to memory of 2232 1436 netsh.exe 32 PID 1436 wrote to memory of 2232 1436 netsh.exe 32 PID 1436 wrote to memory of 2232 1436 netsh.exe 32 PID 1436 wrote to memory of 2232 1436 netsh.exe 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\Transfer of rights and privilege.exe"C:\Users\Admin\AppData\Local\Temp\Transfer of rights and privilege.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Transfer of rights and privilege.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2232
-
-