Analysis
-
max time kernel
146s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2024 02:37
Static task
static1
Behavioral task
behavioral1
Sample
7779dacfaf08385d377461ae4fe14557b8417c99247aac3c24eb9604c6b7f6e9.exe
Resource
win7-20240903-en
General
-
Target
7779dacfaf08385d377461ae4fe14557b8417c99247aac3c24eb9604c6b7f6e9.exe
-
Size
851KB
-
MD5
bfe783df476aa09db0b6a7b202a4ce22
-
SHA1
efd869b12f33a720c7894bd4683f652acd239399
-
SHA256
7779dacfaf08385d377461ae4fe14557b8417c99247aac3c24eb9604c6b7f6e9
-
SHA512
00f85a8ae9776cd129717c639f238be62ba563c62587eb22f995dadf431262ffe77f4b8a141292d4ab2eba048e50ed72df44834341ad47380b4b161db1cafb88
-
SSDEEP
12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QLZDhLweOBSHNDr9MI1Tzzy:ffmMv6Ckr7Mny5QLHLSaDr9/lzy
Malware Config
Extracted
formbook
4.1
cl21
0001.shop
earch-parttimejobs.today
are888.top
akanhaunthipped.shop
othing-heyu.xyz
cadvirsor.net
nclanalae.shop
lectric-cars-mexico.today
oxj-question.xyz
ersonalloanoffers.today
ersonalloans-fo54-fo37.click
verybody-ewfx.xyz
ercuremontauban.media
azilimdunyam.net
airs-clinicato.today
wiftsscend.click
ertainly-jbws.xyz
8xeng.app
damekadmitageable.cfd
ollapsedec.shop
mpldo.app
g18q29a.top
etaddiction.tech
lbatasalboinamoco.shop
eyyzj-medical.xyz
ote-lmeg.xyz
cellelukacs.shop
evinedesignz11.net
n217.vip
eimy.top
ellisimaa.shop
hjk-west.xyz
nline-dating-be-10.today
wocykmw.top
ytsxv.xyz
iding-lawn-mower.today
olarpergolasolutions.today
ainco.net
r86yd.top
ndrvb-stock.xyz
ing88vn.today
vez3.xyz
fg-am.pro
ultplanlz.click
ecurebet.click
fjng-court.xyz
rsenalatamanaxweed.shop
iaoyingtao16.vip
rime-kvsff.xyz
ufdd-interesting.xyz
qbdl-base.xyz
ushihq.xyz
400108pptddbo685.top
tself-gqemlq.xyz
uyher.shop
ffprintshoplv.shop
ushyniceneobaza.cfd
dmrroa.net
ar-deals-ca-8966160.live
ramx-jorv.top
ifw-less.xyz
hwisdom.net
xrjgq-prepare.xyz
rchertravel.click
ingledatings46.xyz
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/3228-6-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3228-9-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4240-15-0x0000000000A40000-0x0000000000A6F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2368 set thread context of 3228 2368 7779dacfaf08385d377461ae4fe14557b8417c99247aac3c24eb9604c6b7f6e9.exe 82 PID 3228 set thread context of 3464 3228 svchost.exe 54 PID 4240 set thread context of 3464 4240 raserver.exe 54 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7779dacfaf08385d377461ae4fe14557b8417c99247aac3c24eb9604c6b7f6e9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language raserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3228 svchost.exe 3228 svchost.exe 3228 svchost.exe 3228 svchost.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe 4240 raserver.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2368 7779dacfaf08385d377461ae4fe14557b8417c99247aac3c24eb9604c6b7f6e9.exe 3228 svchost.exe 3228 svchost.exe 3228 svchost.exe 4240 raserver.exe 4240 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3228 svchost.exe Token: SeDebugPrivilege 4240 raserver.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2368 7779dacfaf08385d377461ae4fe14557b8417c99247aac3c24eb9604c6b7f6e9.exe 2368 7779dacfaf08385d377461ae4fe14557b8417c99247aac3c24eb9604c6b7f6e9.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2368 7779dacfaf08385d377461ae4fe14557b8417c99247aac3c24eb9604c6b7f6e9.exe 2368 7779dacfaf08385d377461ae4fe14557b8417c99247aac3c24eb9604c6b7f6e9.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2368 wrote to memory of 3228 2368 7779dacfaf08385d377461ae4fe14557b8417c99247aac3c24eb9604c6b7f6e9.exe 82 PID 2368 wrote to memory of 3228 2368 7779dacfaf08385d377461ae4fe14557b8417c99247aac3c24eb9604c6b7f6e9.exe 82 PID 2368 wrote to memory of 3228 2368 7779dacfaf08385d377461ae4fe14557b8417c99247aac3c24eb9604c6b7f6e9.exe 82 PID 2368 wrote to memory of 3228 2368 7779dacfaf08385d377461ae4fe14557b8417c99247aac3c24eb9604c6b7f6e9.exe 82 PID 3464 wrote to memory of 4240 3464 Explorer.EXE 83 PID 3464 wrote to memory of 4240 3464 Explorer.EXE 83 PID 3464 wrote to memory of 4240 3464 Explorer.EXE 83 PID 4240 wrote to memory of 3408 4240 raserver.exe 86 PID 4240 wrote to memory of 3408 4240 raserver.exe 86 PID 4240 wrote to memory of 3408 4240 raserver.exe 86
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\7779dacfaf08385d377461ae4fe14557b8417c99247aac3c24eb9604c6b7f6e9.exe"C:\Users\Admin\AppData\Local\Temp\7779dacfaf08385d377461ae4fe14557b8417c99247aac3c24eb9604c6b7f6e9.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\7779dacfaf08385d377461ae4fe14557b8417c99247aac3c24eb9604c6b7f6e9.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3228
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3408
-
-
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request21.49.80.91.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request138.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request217.106.137.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request197.87.175.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request181.129.81.91.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestwww.ersonalloans-fo54-fo37.clickIN AResponse
-
Remote address:8.8.8.8:53Requestwww.ing88vn.todayIN AResponse
-
Remote address:8.8.8.8:53Request40.134.221.88.in-addr.arpaIN PTRResponse40.134.221.88.in-addr.arpaIN PTRa88-221-134-40deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requestwww.ultplanlz.clickIN AResponse
-
Remote address:8.8.8.8:53Request134.130.81.91.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request48.229.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestwww.oxj-question.xyzIN AResponse
-
Remote address:8.8.8.8:53Requestwww.are888.topIN AResponse
-
Remote address:8.8.8.8:53Requestwww.n217.vipIN AResponse
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
241.150.49.20.in-addr.arpa
-
70 B 145 B 1 1
DNS Request
21.49.80.91.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
138.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
97.17.167.52.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
217.106.137.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
197.87.175.4.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
72 B 147 B 1 1
DNS Request
181.129.81.91.in-addr.arpa
-
78 B 143 B 1 1
DNS Request
www.ersonalloans-fo54-fo37.click
-
63 B 131 B 1 1
DNS Request
www.ing88vn.today
-
72 B 137 B 1 1
DNS Request
40.134.221.88.in-addr.arpa
-
65 B 130 B 1 1
DNS Request
www.ultplanlz.click
-
72 B 147 B 1 1
DNS Request
134.130.81.91.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
48.229.111.52.in-addr.arpa
-
66 B 131 B 1 1
DNS Request
www.oxj-question.xyz
-
60 B 130 B 1 1
DNS Request
www.are888.top
-
58 B 119 B 1 1
DNS Request
www.n217.vip