Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
13-12-2024 17:51
Static task
static1
Behavioral task
behavioral1
Sample
bb2a13c3f2f32551b00c4173f0cb5baf28cdadf76e4e6b531885a162f7c310c6.exe
Resource
win7-20241010-en
General
-
Target
bb2a13c3f2f32551b00c4173f0cb5baf28cdadf76e4e6b531885a162f7c310c6.exe
-
Size
711KB
-
MD5
edb164a751c9dd9defabe5b4912ffb12
-
SHA1
d79237920e7447a87082f1bbab77ee54e704479e
-
SHA256
bb2a13c3f2f32551b00c4173f0cb5baf28cdadf76e4e6b531885a162f7c310c6
-
SHA512
889f4858b07a2ee35895119e261d98b4bdc862f35cc9aee6500a4465eb3df790693532370cee9ea349a3226cd250a65836a3336cf6c47888f5240130df9af7fb
-
SSDEEP
12288:3p8XtgNO7LkxA22P4Qd9PbQ8BV5RdYH5cb0azdG9A2MatDX5FAMFfSm2cb54:ZePuA/ZJBlqaQaz89A2ttDX5tt
Malware Config
Extracted
formbook
4.1
gd04
f5u8utd50.icu
ob-offer-33304.bond
aaf.zone
hoppersrack.store
nline-gaming-33476.bond
isionaryvault.online
ilitary-jobs-88516.bond
iyxym.info
eyes.xyz
refle.xyz
kinsmonlkey.shop
oruu.shop
est2x2.online
nline-advertising-77889.bond
hepresspoolai.xyz
anilaberg.online
reimutigleben.store
anguage-courses-22450.bond
zzt.xyz
kfn.lat
jrxy.bid
ulfcoastnow.net
utomatedcrypto.world
sr961263m.vip
ondonessex.net
sychology-degree-20222.bond
3312.buzz
rumpaicto.vip
8791.pink
lashlightled.life
omalkhali.info
ompaz.xyz
arehouse-inventory-88625.bond
uktasalon.info
ruck-driver-jobs-90329.bond
pd40.online
ilmguru.net
ealthcare-trends-56730.bond
ngersolllockwood.life
zwtpe.info
ifeeasystore.shop
bthlcatgini.forum
anausimoveis.net
ashion-degree-38474.bond
ooth-pain-14.sbs
otagyrency.shop
oyfriendtv.fyi
atchy14.online
aahoma4.info
eddybalm.store
rinc.xyz
romthefarm.xyz
est-control-jobs-69594.bond
90880a27.buzz
msqdhbbb2.shop
ncantosgraitzline.lat
emi.wtf
fficecleaning717.xyz
b25.lat
usicone.xyz
nfluencer-marketing-19257.bond
utties.xyz
pioxc.xyz
dlxlxw848.vip
rendylittlediva.store
Signatures
-
Formbook family
-
Formbook payload 1 IoCs
resource yara_rule behavioral1/memory/2600-13-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1700 set thread context of 2600 1700 bb2a13c3f2f32551b00c4173f0cb5baf28cdadf76e4e6b531885a162f7c310c6.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bb2a13c3f2f32551b00c4173f0cb5baf28cdadf76e4e6b531885a162f7c310c6.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2600 bb2a13c3f2f32551b00c4173f0cb5baf28cdadf76e4e6b531885a162f7c310c6.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1700 wrote to memory of 2600 1700 bb2a13c3f2f32551b00c4173f0cb5baf28cdadf76e4e6b531885a162f7c310c6.exe 30 PID 1700 wrote to memory of 2600 1700 bb2a13c3f2f32551b00c4173f0cb5baf28cdadf76e4e6b531885a162f7c310c6.exe 30 PID 1700 wrote to memory of 2600 1700 bb2a13c3f2f32551b00c4173f0cb5baf28cdadf76e4e6b531885a162f7c310c6.exe 30 PID 1700 wrote to memory of 2600 1700 bb2a13c3f2f32551b00c4173f0cb5baf28cdadf76e4e6b531885a162f7c310c6.exe 30 PID 1700 wrote to memory of 2600 1700 bb2a13c3f2f32551b00c4173f0cb5baf28cdadf76e4e6b531885a162f7c310c6.exe 30 PID 1700 wrote to memory of 2600 1700 bb2a13c3f2f32551b00c4173f0cb5baf28cdadf76e4e6b531885a162f7c310c6.exe 30 PID 1700 wrote to memory of 2600 1700 bb2a13c3f2f32551b00c4173f0cb5baf28cdadf76e4e6b531885a162f7c310c6.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb2a13c3f2f32551b00c4173f0cb5baf28cdadf76e4e6b531885a162f7c310c6.exe"C:\Users\Admin\AppData\Local\Temp\bb2a13c3f2f32551b00c4173f0cb5baf28cdadf76e4e6b531885a162f7c310c6.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\bb2a13c3f2f32551b00c4173f0cb5baf28cdadf76e4e6b531885a162f7c310c6.exe"C:\Users\Admin\AppData\Local\Temp\bb2a13c3f2f32551b00c4173f0cb5baf28cdadf76e4e6b531885a162f7c310c6.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2600
-