Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-12-2024 09:01
Static task
static1
Behavioral task
behavioral1
Sample
SKMBT100020241312000.exe
Resource
win7-20240903-en
General
-
Target
SKMBT100020241312000.exe
-
Size
742KB
-
MD5
25369cacd15fd28391f08b48ad5fdf4d
-
SHA1
f091fd2f772d7c566bcce4c046323ef02808f2da
-
SHA256
b54b6ef71478646451ca1905b93c380141b4df637d73cb796af0a391ba47f43e
-
SHA512
e13b6e32e1106f93f6a9fdf8a1871d4a60ca015d8c68a72ca557990dedb82da81c722a36a0a862f564b0809bd092da4bf2dfa9a809febc81b19413d534581598
-
SSDEEP
12288:ZjlIpHtMPku+l0CPPlzYUDbl3H7WZiga3jtuAEzY69hbnrF65FO28EYT/0:ZjlIhSPd+plzYu3+UuAEzY0h3FfxECs
Malware Config
Extracted
formbook
4.1
gd04
f5u8utd50.icu
ob-offer-33304.bond
aaf.zone
hoppersrack.store
nline-gaming-33476.bond
isionaryvault.online
ilitary-jobs-88516.bond
iyxym.info
eyes.xyz
refle.xyz
kinsmonlkey.shop
oruu.shop
est2x2.online
nline-advertising-77889.bond
hepresspoolai.xyz
anilaberg.online
reimutigleben.store
anguage-courses-22450.bond
zzt.xyz
kfn.lat
jrxy.bid
ulfcoastnow.net
utomatedcrypto.world
sr961263m.vip
ondonessex.net
sychology-degree-20222.bond
3312.buzz
rumpaicto.vip
8791.pink
lashlightled.life
omalkhali.info
ompaz.xyz
arehouse-inventory-88625.bond
uktasalon.info
ruck-driver-jobs-90329.bond
pd40.online
ilmguru.net
ealthcare-trends-56730.bond
ngersolllockwood.life
zwtpe.info
ifeeasystore.shop
bthlcatgini.forum
anausimoveis.net
ashion-degree-38474.bond
ooth-pain-14.sbs
otagyrency.shop
oyfriendtv.fyi
atchy14.online
aahoma4.info
eddybalm.store
rinc.xyz
romthefarm.xyz
est-control-jobs-69594.bond
90880a27.buzz
msqdhbbb2.shop
ncantosgraitzline.lat
emi.wtf
fficecleaning717.xyz
b25.lat
usicone.xyz
nfluencer-marketing-19257.bond
utties.xyz
pioxc.xyz
dlxlxw848.vip
rendylittlediva.store
Signatures
-
Formbook family
-
Formbook payload 1 IoCs
resource yara_rule behavioral1/memory/2652-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2196 set thread context of 2652 2196 SKMBT100020241312000.exe 30 -
Program crash 1 IoCs
pid pid_target Process procid_target 2868 2652 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SKMBT100020241312000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SKMBT100020241312000.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2652 2196 SKMBT100020241312000.exe 30 PID 2196 wrote to memory of 2652 2196 SKMBT100020241312000.exe 30 PID 2196 wrote to memory of 2652 2196 SKMBT100020241312000.exe 30 PID 2196 wrote to memory of 2652 2196 SKMBT100020241312000.exe 30 PID 2196 wrote to memory of 2652 2196 SKMBT100020241312000.exe 30 PID 2196 wrote to memory of 2652 2196 SKMBT100020241312000.exe 30 PID 2196 wrote to memory of 2652 2196 SKMBT100020241312000.exe 30 PID 2652 wrote to memory of 2868 2652 SKMBT100020241312000.exe 31 PID 2652 wrote to memory of 2868 2652 SKMBT100020241312000.exe 31 PID 2652 wrote to memory of 2868 2652 SKMBT100020241312000.exe 31 PID 2652 wrote to memory of 2868 2652 SKMBT100020241312000.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\SKMBT100020241312000.exe"C:\Users\Admin\AppData\Local\Temp\SKMBT100020241312000.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\SKMBT100020241312000.exe"C:\Users\Admin\AppData\Local\Temp\SKMBT100020241312000.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 363⤵
- Program crash
PID:2868
-
-