Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
04-12-2024 02:12
Static task
static1
Behavioral task
behavioral1
Sample
1dc4c4881f138a6f1ffae6b406e696a46a89f3a0d1265a5ec6ed3d80dc40ea32.exe
Resource
win7-20240729-en
General
-
Target
1dc4c4881f138a6f1ffae6b406e696a46a89f3a0d1265a5ec6ed3d80dc40ea32.exe
-
Size
658KB
-
MD5
99f1e4f537b786a0e979d08b99c67d48
-
SHA1
b13c55efae4a15d80fbf3ec1291b75064d45f8b9
-
SHA256
1dc4c4881f138a6f1ffae6b406e696a46a89f3a0d1265a5ec6ed3d80dc40ea32
-
SHA512
9904e01c2bb8c915df986cade936475ff6ed79d0ba98800719ca0ac4548725541d0a0253b17b531795184fae59ecb432688759327344fa3ebe47b6fdaf148b11
-
SSDEEP
12288:1cir1S2IoOAc6/5rZGmy4vD1Zno/1o3idNSel2YhdUdqXn21BDunP+m+5Wmmn2TO:3D19o96id0KiXr9mzmmn2IR60
Malware Config
Extracted
formbook
4.1
c89p
ftersaleb.top
dcustomdesgins.net
ostbet2024.live
rhgtrdjdjytkyhretrdjfytd.buzz
atauniversity.tech
idoctor365.net
x-design-courses-29670.bond
ellowold-pc.top
ransportationmmsytpro.top
areerfest.xyz
artiresbah-in.today
ijie.pro
torehousestudio.info
69-11-luxury-watches.shop
earing-tests-44243.bond
hits.shop
hzl9.bond
lood-test-jp-1.bond
livialiving.online
usymomsmakingmoney.online
olar-systems-panels-61747.bond
hinawinner.top
oldensky10.xyz
oginsuperking777.click
oviepicker.net
partment-rental05.online
ldkp.net
sofaerb.shop
ydh5.beauty
aston-saaaa.buzz
acuum-cleaner-84018.bond
usiness-printer-37559.bond
dindadisini12.click
j7zd12m.xyz
plesacv.xyz
trustcapital247.online
asapembuatanpatung.online
ent-all.xyz
r64mh1.vip
aser-cap-hair-growth.today
amattva.company
herightfits.top
uickautoquote.net
ctu36ojboz6w2cl.asia
oursmile.vip
astysavor.website
iam-saaab.buzz
igmoto.info
itchellcohen.net
un-sea.fun
steticavonixx.shop
arklife.shop
bsboffchatrussummsa.online
iuxing.asia
okenexchange.art
llhealthreview.online
refabricated-homes-53685.bond
atercraze.net
osmits.net
rail.cruises
utanginamo.sbs
hapanda.fun
arehouse-inventory-29693.bond
innivip.bio
aycare-service-99683.bond
Signatures
-
Formbook family
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2796-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1dc4c4881f138a6f1ffae6b406e696a46a89f3a0d1265a5ec6ed3d80dc40ea32.exedescription pid Process procid_target PID 2084 set thread context of 2796 2084 1dc4c4881f138a6f1ffae6b406e696a46a89f3a0d1265a5ec6ed3d80dc40ea32.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
1dc4c4881f138a6f1ffae6b406e696a46a89f3a0d1265a5ec6ed3d80dc40ea32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dc4c4881f138a6f1ffae6b406e696a46a89f3a0d1265a5ec6ed3d80dc40ea32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
1dc4c4881f138a6f1ffae6b406e696a46a89f3a0d1265a5ec6ed3d80dc40ea32.exepid Process 2796 1dc4c4881f138a6f1ffae6b406e696a46a89f3a0d1265a5ec6ed3d80dc40ea32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
1dc4c4881f138a6f1ffae6b406e696a46a89f3a0d1265a5ec6ed3d80dc40ea32.exedescription pid Process procid_target PID 2084 wrote to memory of 2796 2084 1dc4c4881f138a6f1ffae6b406e696a46a89f3a0d1265a5ec6ed3d80dc40ea32.exe 30 PID 2084 wrote to memory of 2796 2084 1dc4c4881f138a6f1ffae6b406e696a46a89f3a0d1265a5ec6ed3d80dc40ea32.exe 30 PID 2084 wrote to memory of 2796 2084 1dc4c4881f138a6f1ffae6b406e696a46a89f3a0d1265a5ec6ed3d80dc40ea32.exe 30 PID 2084 wrote to memory of 2796 2084 1dc4c4881f138a6f1ffae6b406e696a46a89f3a0d1265a5ec6ed3d80dc40ea32.exe 30 PID 2084 wrote to memory of 2796 2084 1dc4c4881f138a6f1ffae6b406e696a46a89f3a0d1265a5ec6ed3d80dc40ea32.exe 30 PID 2084 wrote to memory of 2796 2084 1dc4c4881f138a6f1ffae6b406e696a46a89f3a0d1265a5ec6ed3d80dc40ea32.exe 30 PID 2084 wrote to memory of 2796 2084 1dc4c4881f138a6f1ffae6b406e696a46a89f3a0d1265a5ec6ed3d80dc40ea32.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dc4c4881f138a6f1ffae6b406e696a46a89f3a0d1265a5ec6ed3d80dc40ea32.exe"C:\Users\Admin\AppData\Local\Temp\1dc4c4881f138a6f1ffae6b406e696a46a89f3a0d1265a5ec6ed3d80dc40ea32.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\1dc4c4881f138a6f1ffae6b406e696a46a89f3a0d1265a5ec6ed3d80dc40ea32.exe"C:\Users\Admin\AppData\Local\Temp\1dc4c4881f138a6f1ffae6b406e696a46a89f3a0d1265a5ec6ed3d80dc40ea32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2796
-