Analysis
-
max time kernel
688s -
max time network
616s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13-12-2024 12:08
Static task
static1
Behavioral task
behavioral1
Sample
VBshqUbZtSxUibM.exe
Resource
win7-20240708-en
General
-
Target
VBshqUbZtSxUibM.exe
-
Size
605KB
-
MD5
5219b5632bdd4d2bf00ca0405660a8cd
-
SHA1
118b516281a7f9d07e23014611e3a0c5148ba2d6
-
SHA256
6ce77c20aa2bb6bd48fe6255c91a4167fd81215ed4f4fec78c7387ef2247ae7b
-
SHA512
998748303f20e88d0239cb7cf5fe8ce055c64c27085d129f174f10705bb9ce2cb838b59da7bed922fe069e03624dffb7306f482966e5bdb2df6481f6c7b6746f
-
SSDEEP
12288:lkjnD7Oh7Ch0pUCxtrqeZx1Kufvye6vvc3JZgPeAp0:anD7OhM0nx1t/KufvyeOwgb
Malware Config
Extracted
formbook
4.1
sx01
r-salessolutions.xyz
jdh1.info
olar-panel-jobs-93084.bond
aebrasil.shop
oshua-xaaaa.buzz
xzkm.shop
nitedviplumbing.net
nnevateknoloji.xyz
rg-a.biz
indow-replacement-34091.bond
uyersagent3percent.net
ostbag.net
ibosolv.net
ahve.today
ophotshotjobs.today
emoreez.art
ift-chairs-94905.bond
okerdom-e.best
stagr.fun
irtyf-ingrancher.info
isviral.xyz
000rtp10.lat
tonomushotel.tech
26kd.shop
tarrypath.click
athroomremodeling-au.bond
ruthu.art
reatindiagame.net
oyroom.top
imusol.xyz
acuum-cleaner-36278.bond
psantennas.center
d1ot18.top
ybird.click
reenwitchery.shop
verythingtoys.net
j6t.xyz
surionatt.info
ronzon.tech
0240725pay.vip
ressfitting.info
itchen-deals-68231.bond
unvcxt.shop
hances.pro
ar-deals-15908.bond
xana.shop
onfirme-5.online
augdfgi.pro
romocionesguajaraz.info
etry.tech
bckorea.net
zcase.online
kksoyuz.online
sychology-degree-49198.bond
resdai.xyz
-bot-pasha01.buzz
aleemtips.online
allnyy8.shop
elso.app
onacat.online
gowelcomeflingofswish.homes
agamentospolo.online
24bm205er.autos
ulinary-schools-68403.bond
aggiemonroe.net
Signatures
-
Formbook family
-
Formbook payload 4 IoCs
resource yara_rule behavioral1/memory/2848-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2848-16-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2848-22-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/3020-25-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2584 powershell.exe -
Deletes itself 1 IoCs
pid Process 1652 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1508 set thread context of 2848 1508 VBshqUbZtSxUibM.exe 32 PID 2848 set thread context of 1236 2848 VBshqUbZtSxUibM.exe 21 PID 2848 set thread context of 1236 2848 VBshqUbZtSxUibM.exe 21 PID 3020 set thread context of 1236 3020 wuapp.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBshqUbZtSxUibM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBshqUbZtSxUibM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuapp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2848 VBshqUbZtSxUibM.exe 2848 VBshqUbZtSxUibM.exe 2584 powershell.exe 2848 VBshqUbZtSxUibM.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe 3020 wuapp.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2848 VBshqUbZtSxUibM.exe 2848 VBshqUbZtSxUibM.exe 2848 VBshqUbZtSxUibM.exe 2848 VBshqUbZtSxUibM.exe 3020 wuapp.exe 3020 wuapp.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2848 VBshqUbZtSxUibM.exe Token: SeDebugPrivilege 2584 powershell.exe Token: SeDebugPrivilege 3020 wuapp.exe Token: SeShutdownPrivilege 1236 Explorer.EXE Token: SeShutdownPrivilege 1236 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1508 wrote to memory of 2584 1508 VBshqUbZtSxUibM.exe 30 PID 1508 wrote to memory of 2584 1508 VBshqUbZtSxUibM.exe 30 PID 1508 wrote to memory of 2584 1508 VBshqUbZtSxUibM.exe 30 PID 1508 wrote to memory of 2584 1508 VBshqUbZtSxUibM.exe 30 PID 1508 wrote to memory of 2848 1508 VBshqUbZtSxUibM.exe 32 PID 1508 wrote to memory of 2848 1508 VBshqUbZtSxUibM.exe 32 PID 1508 wrote to memory of 2848 1508 VBshqUbZtSxUibM.exe 32 PID 1508 wrote to memory of 2848 1508 VBshqUbZtSxUibM.exe 32 PID 1508 wrote to memory of 2848 1508 VBshqUbZtSxUibM.exe 32 PID 1508 wrote to memory of 2848 1508 VBshqUbZtSxUibM.exe 32 PID 1508 wrote to memory of 2848 1508 VBshqUbZtSxUibM.exe 32 PID 2848 wrote to memory of 3020 2848 VBshqUbZtSxUibM.exe 33 PID 2848 wrote to memory of 3020 2848 VBshqUbZtSxUibM.exe 33 PID 2848 wrote to memory of 3020 2848 VBshqUbZtSxUibM.exe 33 PID 2848 wrote to memory of 3020 2848 VBshqUbZtSxUibM.exe 33 PID 2848 wrote to memory of 3020 2848 VBshqUbZtSxUibM.exe 33 PID 2848 wrote to memory of 3020 2848 VBshqUbZtSxUibM.exe 33 PID 2848 wrote to memory of 3020 2848 VBshqUbZtSxUibM.exe 33 PID 3020 wrote to memory of 1652 3020 wuapp.exe 34 PID 3020 wrote to memory of 1652 3020 wuapp.exe 34 PID 3020 wrote to memory of 1652 3020 wuapp.exe 34 PID 3020 wrote to memory of 1652 3020 wuapp.exe 34
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\VBshqUbZtSxUibM.exe"C:\Users\Admin\AppData\Local\Temp\VBshqUbZtSxUibM.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\VBshqUbZtSxUibM.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2584
-
-
C:\Users\Admin\AppData\Local\Temp\VBshqUbZtSxUibM.exe"C:\Users\Admin\AppData\Local\Temp\VBshqUbZtSxUibM.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"4⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\VBshqUbZtSxUibM.exe"5⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:1652
-
-
-
-