Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2024, 17:22 UTC

General

  • Target

    545f70314c72e3b34893811f991d96aa1cee2049f346419264e10f0ae44400bb.exe

  • Size

    785KB

  • MD5

    3f2f70a9664967fa7781a74d4b4bd4d3

  • SHA1

    b9c9060420bcda849c0457a2c85ae820ea17ac55

  • SHA256

    545f70314c72e3b34893811f991d96aa1cee2049f346419264e10f0ae44400bb

  • SHA512

    a664445abe416e36c5d4e6ea520781009fb49a27e93667772fe2e0af6a62f8efb4ecbc3e19fb208861a7e97ba5316b5d0b71d2484c235ddc9775310d185aa139

  • SSDEEP

    24576:dqIsQrVbCx3YNrSDnc+Q3409DRx0Dmlp:uQlCy2Dcj40tj0Dm

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

m25s

Decoy

araghospitality.net

cleans.xyz

olnacasinotcs14.top

pringhillinfos.net

erkakasrumah.online

orean-course-289113002.zone

yeloma-treatment-82106.bond

76iw543gw.autos

nline-shopping-56055.bond

enetik.xyz

ax-th-6011838.fyi

itygatehousing.app

23zy998jk.bond

pslag-hal-2.online

uykoii.shop

9supjub3p.buzz

tmgl.bond

actus-catering-creations.net

ntercashspace24.homes

ierra777.vip

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\545f70314c72e3b34893811f991d96aa1cee2049f346419264e10f0ae44400bb.exe
    "C:\Users\Admin\AppData\Local\Temp\545f70314c72e3b34893811f991d96aa1cee2049f346419264e10f0ae44400bb.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4696
    • C:\Users\Admin\AppData\Local\Temp\545f70314c72e3b34893811f991d96aa1cee2049f346419264e10f0ae44400bb.exe
      "C:\Users\Admin\AppData\Local\Temp\545f70314c72e3b34893811f991d96aa1cee2049f346419264e10f0ae44400bb.exe"
      2⤵
        PID:4388
      • C:\Users\Admin\AppData\Local\Temp\545f70314c72e3b34893811f991d96aa1cee2049f346419264e10f0ae44400bb.exe
        "C:\Users\Admin\AppData\Local\Temp\545f70314c72e3b34893811f991d96aa1cee2049f346419264e10f0ae44400bb.exe"
        2⤵
          PID:4704
        • C:\Users\Admin\AppData\Local\Temp\545f70314c72e3b34893811f991d96aa1cee2049f346419264e10f0ae44400bb.exe
          "C:\Users\Admin\AppData\Local\Temp\545f70314c72e3b34893811f991d96aa1cee2049f346419264e10f0ae44400bb.exe"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4576

      Network

      • flag-us
        DNS
        8.8.8.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        8.8.8.8.in-addr.arpa
        IN PTR
        Response
        8.8.8.8.in-addr.arpa
        IN PTR
        dnsgoogle
      • flag-us
        DNS
        232.168.11.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        232.168.11.51.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        83.210.23.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        83.210.23.2.in-addr.arpa
        IN PTR
        Response
        83.210.23.2.in-addr.arpa
        IN PTR
        a2-23-210-83deploystaticakamaitechnologiescom
      • flag-us
        DNS
        67.31.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        67.31.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        104.219.191.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        104.219.191.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        209.205.72.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        209.205.72.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        200.163.202.172.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        200.163.202.172.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        198.187.3.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        198.187.3.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        172.210.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.210.232.199.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        172.214.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.214.232.199.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        14.227.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        14.227.111.52.in-addr.arpa
        IN PTR
        Response
      No results found
      • 8.8.8.8:53
        8.8.8.8.in-addr.arpa
        dns
        66 B
        90 B
        1
        1

        DNS Request

        8.8.8.8.in-addr.arpa

      • 8.8.8.8:53
        232.168.11.51.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        232.168.11.51.in-addr.arpa

      • 8.8.8.8:53
        83.210.23.2.in-addr.arpa
        dns
        70 B
        133 B
        1
        1

        DNS Request

        83.210.23.2.in-addr.arpa

      • 8.8.8.8:53
        67.31.126.40.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        67.31.126.40.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
        144 B
        1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        104.219.191.52.in-addr.arpa
        dns
        73 B
        147 B
        1
        1

        DNS Request

        104.219.191.52.in-addr.arpa

      • 8.8.8.8:53
        209.205.72.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        209.205.72.20.in-addr.arpa

      • 8.8.8.8:53
        200.163.202.172.in-addr.arpa
        dns
        74 B
        160 B
        1
        1

        DNS Request

        200.163.202.172.in-addr.arpa

      • 8.8.8.8:53
        198.187.3.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        198.187.3.20.in-addr.arpa

      • 8.8.8.8:53
        172.210.232.199.in-addr.arpa
        dns
        74 B
        128 B
        1
        1

        DNS Request

        172.210.232.199.in-addr.arpa

      • 8.8.8.8:53
        172.214.232.199.in-addr.arpa
        dns
        74 B
        128 B
        1
        1

        DNS Request

        172.214.232.199.in-addr.arpa

      • 8.8.8.8:53
        14.227.111.52.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        14.227.111.52.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4576-11-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/4576-14-0x00000000018F0000-0x0000000001C3A000-memory.dmp

        Filesize

        3.3MB

      • memory/4696-6-0x0000000005A90000-0x0000000005B2C000-memory.dmp

        Filesize

        624KB

      • memory/4696-3-0x00000000057A0000-0x0000000005832000-memory.dmp

        Filesize

        584KB

      • memory/4696-4-0x0000000074690000-0x0000000074E40000-memory.dmp

        Filesize

        7.7MB

      • memory/4696-5-0x0000000005950000-0x000000000595A000-memory.dmp

        Filesize

        40KB

      • memory/4696-0-0x000000007469E000-0x000000007469F000-memory.dmp

        Filesize

        4KB

      • memory/4696-7-0x00000000059D0000-0x00000000059E2000-memory.dmp

        Filesize

        72KB

      • memory/4696-8-0x000000007469E000-0x000000007469F000-memory.dmp

        Filesize

        4KB

      • memory/4696-9-0x0000000074690000-0x0000000074E40000-memory.dmp

        Filesize

        7.7MB

      • memory/4696-10-0x0000000006E70000-0x0000000006EFA000-memory.dmp

        Filesize

        552KB

      • memory/4696-2-0x0000000005E10000-0x00000000063B4000-memory.dmp

        Filesize

        5.6MB

      • memory/4696-13-0x0000000074690000-0x0000000074E40000-memory.dmp

        Filesize

        7.7MB

      • memory/4696-1-0x0000000000CF0000-0x0000000000DBA000-memory.dmp

        Filesize

        808KB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.