Analysis
-
max time kernel
92s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
04-12-2024 02:53
Static task
static1
Behavioral task
behavioral1
Sample
86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exe
Resource
win7-20240729-en
General
-
Target
86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exe
-
Size
870KB
-
MD5
601b0892a95e423fa9e9ab2d95ce1085
-
SHA1
071f413d4af58e9db3f78a47033c36156f4c60ab
-
SHA256
86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161
-
SHA512
aa049f6350ef62e3d1539f5f4632b851c27acf188ec8557b2ed96282a94207cae8ba68986900b4fccd29d5987112e1f57f2ec91bbf5993a30747b0a7b17ebb8b
-
SSDEEP
12288:976/k8LlJL7kajr+olWltWKWkfLtJz9ermpg9A+g1x2lQe2es+HMLInIckR:iLfLjr+7f7WUjTpgeB32utMIr
Malware Config
Extracted
formbook
4.1
p25o
hrist-centered-soulcare.net
pacerpa.shop
hicandcurvy.shop
ocfamilyto.llc
9ds87666.men
sia918ku.shop
nvestment-broker-35141.bond
ltralicencas.shop
g1lmb.cyou
eyo.live
pupt.rest
indsetperfection.net
1duqqrzs65zxz.bond
eren138-pro2.click
leaning-products-35959.bond
oodea.online
hlbadienug.info
innivip.bio
funnygame.top
roperty-in-dubai-f.pro
ypdh9.digital
iving-artists.net
inimalkultur.net
estore.club
ensurix.xyz
obs-for-seniors-2507.xyz
anman.shop
rogramacaodozero.tech
rder0295.info
43su111as.autos
ideograms.net
erkalo-leono-tuyf.buzz
ryptotremp.xyz
amionnxuusjj25.sbs
oans-credits-bg-1.bond
rainstumper.info
obility-bed-12073.bond
oom188play.net
veriosg.xyz
fertaspuma.online
golv.info
akingcourse01.today
espie.stream
upa.dad
iriblog.xyz
ampobet-casino.net
ntheeventpc.xyz
88herowin.online
ental-implant-grantss.today
icycles-pl.today
eclan-paaaa.buzz
iyanoegitim.online
dunegocios.pro
mhy35444.sbs
light-ticket-deals-52731.bond
raphic-design-degree-65053.bond
power.services
onstruction-services-85205.bond
eiliao602.pro
izyj.info
p34.top
olar-panel-jobs-14611.bond
ideo-games-73460.bond
ubngonsale5sao.pro
agestore.online
Signatures
-
Formbook family
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2820-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exedescription pid Process procid_target PID 1112 set thread context of 2820 1112 86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exepowershell.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exepowershell.exepid Process 2820 86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exe 2804 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid Process Token: SeDebugPrivilege 2804 powershell.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exedescription pid Process procid_target PID 1112 wrote to memory of 2804 1112 86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exe 30 PID 1112 wrote to memory of 2804 1112 86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exe 30 PID 1112 wrote to memory of 2804 1112 86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exe 30 PID 1112 wrote to memory of 2804 1112 86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exe 30 PID 1112 wrote to memory of 2820 1112 86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exe 31 PID 1112 wrote to memory of 2820 1112 86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exe 31 PID 1112 wrote to memory of 2820 1112 86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exe 31 PID 1112 wrote to memory of 2820 1112 86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exe 31 PID 1112 wrote to memory of 2820 1112 86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exe 31 PID 1112 wrote to memory of 2820 1112 86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exe 31 PID 1112 wrote to memory of 2820 1112 86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exe"C:\Users\Admin\AppData\Local\Temp\86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
-
C:\Users\Admin\AppData\Local\Temp\86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exe"C:\Users\Admin\AppData\Local\Temp\86983eeb3231d8cc4eddbdec4b8b19194410f6adbee3265bbe68cd4a1ddcd161.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2820
-