Analysis
-
max time kernel
149s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-12-2024 16:26
Static task
static1
Behavioral task
behavioral1
Sample
ff410475bb80926bc3933e68f5e84a7185292bb2b78294abe528cb647c78f637.exe
Resource
win7-20240903-en
General
-
Target
ff410475bb80926bc3933e68f5e84a7185292bb2b78294abe528cb647c78f637.exe
-
Size
1.1MB
-
MD5
5fa5f00b74bf9bb524687e6785027135
-
SHA1
4f41d3eddbf7844cc60f561c6fd92c44f7f4f282
-
SHA256
ff410475bb80926bc3933e68f5e84a7185292bb2b78294abe528cb647c78f637
-
SHA512
5bbd12cb28e0255a6773e11c2c096a94ec018228dd8dfae107efdd4bb193808463849872175f9798de27705fa5f9b5232bc10ef18c726ebee3c222aa3b2b3f9f
-
SSDEEP
24576:WfmMv6Ckr7Mny5QtEc7e74/SPFjc2+ZWKrs3bC+:W3v+7/5Qtl7k4/S1tGJaC+
Malware Config
Extracted
formbook
4.1
cu29
qidr.shop
usinessaviationconsulting.net
68716329.xyz
nd-los.net
ealthironcladguarantee.shop
oftware-download-69354.bond
48372305.top
omeownershub.top
mall-chilli.top
ajakgoid.online
ire-changer-53482.bond
rugsrx.shop
oyang123.info
azino-forum-pro.online
817715.rest
layman.vip
eb777.club
ovatonica.net
urgaslotvip.website
inn-paaaa.buzz
reativedreams.design
upremehomes.shop
ames-saaab.buzz
phonelock.xyz
ideandseekvacations.xyz
77179ksuhr.top
ental-bridges-87553.bond
7win2.bet
ainan.company
5mwhs.top
hopp9.top
65fhgejd3.xyz
olandopaintingllc.online
n-wee.buzz
reshcasinoinfo2.top
5734.party
qtbyj.live
gil.lat
siabgc4d.online
fios.top
sed-cars-89003.bond
nlineschools-2507-001-sap.click
upiloffatemotors.online
ordf.top
achhonglan.shop
irex.info
oursmile.vip
leachlondonstore.online
asukacro.online
panish-classes-64045.bond
apita.top
srtio.xyz
kdsclci.bond
ochacha.sbs
oldsteps.buzz
yzq0n.top
npostl.xyz
ladder-cancer-symptoms-mine.sbs
400725iimfyuj120.top
3589.photo
rasilhojenoticias.online
ependableequipment.online
itusbandar126.info
ohns.app
f6b-crxy.top
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/2660-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2660-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2708-23-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tabulations.vbs tabulations.exe -
Executes dropped EXE 1 IoCs
pid Process 1936 tabulations.exe -
Loads dropped DLL 1 IoCs
pid Process 2232 ff410475bb80926bc3933e68f5e84a7185292bb2b78294abe528cb647c78f637.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x000f000000018662-4.dat autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1936 set thread context of 2660 1936 tabulations.exe 32 PID 2660 set thread context of 1188 2660 svchost.exe 21 PID 2708 set thread context of 1188 2708 NETSTAT.EXE 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ff410475bb80926bc3933e68f5e84a7185292bb2b78294abe528cb647c78f637.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tabulations.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NETSTAT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2708 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2660 svchost.exe 2660 svchost.exe 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE 2708 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1936 tabulations.exe 2660 svchost.exe 2660 svchost.exe 2660 svchost.exe 2708 NETSTAT.EXE 2708 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2660 svchost.exe Token: SeDebugPrivilege 2708 NETSTAT.EXE -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 2232 ff410475bb80926bc3933e68f5e84a7185292bb2b78294abe528cb647c78f637.exe 2232 ff410475bb80926bc3933e68f5e84a7185292bb2b78294abe528cb647c78f637.exe 1936 tabulations.exe 1936 tabulations.exe 1188 Explorer.EXE 1188 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2232 ff410475bb80926bc3933e68f5e84a7185292bb2b78294abe528cb647c78f637.exe 2232 ff410475bb80926bc3933e68f5e84a7185292bb2b78294abe528cb647c78f637.exe 1936 tabulations.exe 1936 tabulations.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2232 wrote to memory of 1936 2232 ff410475bb80926bc3933e68f5e84a7185292bb2b78294abe528cb647c78f637.exe 31 PID 2232 wrote to memory of 1936 2232 ff410475bb80926bc3933e68f5e84a7185292bb2b78294abe528cb647c78f637.exe 31 PID 2232 wrote to memory of 1936 2232 ff410475bb80926bc3933e68f5e84a7185292bb2b78294abe528cb647c78f637.exe 31 PID 2232 wrote to memory of 1936 2232 ff410475bb80926bc3933e68f5e84a7185292bb2b78294abe528cb647c78f637.exe 31 PID 1936 wrote to memory of 2660 1936 tabulations.exe 32 PID 1936 wrote to memory of 2660 1936 tabulations.exe 32 PID 1936 wrote to memory of 2660 1936 tabulations.exe 32 PID 1936 wrote to memory of 2660 1936 tabulations.exe 32 PID 1936 wrote to memory of 2660 1936 tabulations.exe 32 PID 1188 wrote to memory of 2708 1188 Explorer.EXE 33 PID 1188 wrote to memory of 2708 1188 Explorer.EXE 33 PID 1188 wrote to memory of 2708 1188 Explorer.EXE 33 PID 1188 wrote to memory of 2708 1188 Explorer.EXE 33 PID 2708 wrote to memory of 2772 2708 NETSTAT.EXE 34 PID 2708 wrote to memory of 2772 2708 NETSTAT.EXE 34 PID 2708 wrote to memory of 2772 2708 NETSTAT.EXE 34 PID 2708 wrote to memory of 2772 2708 NETSTAT.EXE 34
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\ff410475bb80926bc3933e68f5e84a7185292bb2b78294abe528cb647c78f637.exe"C:\Users\Admin\AppData\Local\Temp\ff410475bb80926bc3933e68f5e84a7185292bb2b78294abe528cb647c78f637.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\piceous\tabulations.exe"C:\Users\Admin\AppData\Local\Temp\ff410475bb80926bc3933e68f5e84a7185292bb2b78294abe528cb647c78f637.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\ff410475bb80926bc3933e68f5e84a7185292bb2b78294abe528cb647c78f637.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2660
-
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2772
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD55fa5f00b74bf9bb524687e6785027135
SHA14f41d3eddbf7844cc60f561c6fd92c44f7f4f282
SHA256ff410475bb80926bc3933e68f5e84a7185292bb2b78294abe528cb647c78f637
SHA5125bbd12cb28e0255a6773e11c2c096a94ec018228dd8dfae107efdd4bb193808463849872175f9798de27705fa5f9b5232bc10ef18c726ebee3c222aa3b2b3f9f