Analysis
-
max time kernel
94s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2024 03:13
Static task
static1
Behavioral task
behavioral1
Sample
bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe
Resource
win7-20240729-en
General
-
Target
bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe
-
Size
586KB
-
MD5
0d02d3493e4b372c0a1e3e9db2ea8577
-
SHA1
5e4f4684b03d984611ddfbd2a28e6cdfadb731cd
-
SHA256
bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328
-
SHA512
036e517d4d0fc8aca476de0f96e33520a8ad6801a7294341aeb3b4fece87fe6e39707ba306205743f4ca8ad895c4ab8c42a7326fee0c36af5800d4e67b77d8fe
-
SSDEEP
12288:h+MlmjxCKoK9oLK9YIzq3Z2EaWmPwe13zAVIEsX3BWqp4P:hKFCD+9YIzq3Zja5F138eU04P
Malware Config
Extracted
formbook
4.1
cu29
qidr.shop
usinessaviationconsulting.net
68716329.xyz
nd-los.net
ealthironcladguarantee.shop
oftware-download-69354.bond
48372305.top
omeownershub.top
mall-chilli.top
ajakgoid.online
ire-changer-53482.bond
rugsrx.shop
oyang123.info
azino-forum-pro.online
817715.rest
layman.vip
eb777.club
ovatonica.net
urgaslotvip.website
inn-paaaa.buzz
reativedreams.design
upremehomes.shop
ames-saaab.buzz
phonelock.xyz
ideandseekvacations.xyz
77179ksuhr.top
ental-bridges-87553.bond
7win2.bet
ainan.company
5mwhs.top
hopp9.top
65fhgejd3.xyz
olandopaintingllc.online
n-wee.buzz
reshcasinoinfo2.top
5734.party
qtbyj.live
gil.lat
siabgc4d.online
fios.top
sed-cars-89003.bond
nlineschools-2507-001-sap.click
upiloffatemotors.online
ordf.top
achhonglan.shop
irex.info
oursmile.vip
leachlondonstore.online
asukacro.online
panish-classes-64045.bond
apita.top
srtio.xyz
kdsclci.bond
ochacha.sbs
oldsteps.buzz
yzq0n.top
npostl.xyz
ladder-cancer-symptoms-mine.sbs
400725iimfyuj120.top
3589.photo
rasilhojenoticias.online
ependableequipment.online
itusbandar126.info
ohns.app
f6b-crxy.top
Signatures
-
Formbook family
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2376-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exedescription pid Process procid_target PID 4924 set thread context of 2376 4924 bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe 98 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exepid Process 2376 bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe 2376 bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exedescription pid Process procid_target PID 4924 wrote to memory of 2376 4924 bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe 98 PID 4924 wrote to memory of 2376 4924 bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe 98 PID 4924 wrote to memory of 2376 4924 bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe 98 PID 4924 wrote to memory of 2376 4924 bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe 98 PID 4924 wrote to memory of 2376 4924 bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe 98 PID 4924 wrote to memory of 2376 4924 bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe"C:\Users\Admin\AppData\Local\Temp\bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe"C:\Users\Admin\AppData\Local\Temp\bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2376
-