Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-12-2024 02:20
Static task
static1
Behavioral task
behavioral1
Sample
1ddd6b7f64ff57668ca9087e77362e4d11fda7c3c07aebe6c1f48b560aea038e.exe
Resource
win7-20241010-en
General
-
Target
1ddd6b7f64ff57668ca9087e77362e4d11fda7c3c07aebe6c1f48b560aea038e.exe
-
Size
1.0MB
-
MD5
58923ab5edc1d65d3f0fb3c71ee2af64
-
SHA1
5de29822b230043708b6725b3fe0e9f2eb1ad21a
-
SHA256
1ddd6b7f64ff57668ca9087e77362e4d11fda7c3c07aebe6c1f48b560aea038e
-
SHA512
d8c28559e79783cccbb9b2fac8c3a2b29471b87035c326be203ab486c62df8a6b7a59c4ecffe87cea6e201fc825274faa6b3befe7a3a735f154d567abbb09b32
-
SSDEEP
24576:mu6J33O0c+JY5UZ+XC0kGso6FatnXQN8TyT1soHDWY:ou0c++OCvkGs9FatgaTusoiY
Malware Config
Extracted
formbook
4.1
at22
etween-us.online
sphaleia.net
ental-implants-78350.bond
q4a.lat
commerce-97292.bond
linds-curtains-38811.bond
gyptevoyages.net
landofigueroa-abogados.net
cuitis.xyz
hantom.city
yzk.online
afikabmedan.store
ome-remodeling-67289.bond
ebpage-klzdxrhnazi.shop
eject.lol
rismart.xyz
nfluencer-marketing-72407.bond
ksolotl.xyz
ebsbayrntilrmizin93.xyz
pps-75399.bond
larecompany.sbs
b-apps.net
onitoring-devices-50256.bond
asusuos.shop
87zy448d.shop
irportandart.net
15y.lat
fujo3jsj8.cyou
uyhaa.website
uihangditrungquoc.online
sphalt-jobs-32044.bond
hlexpress-add.cyou
essecurity.xyz
assysirens.store
hhomestore.online
arehouse-inventory-86457.bond
ezup.store
ymgjyj.info
cez.lat
ubconcern.shop
ct1portfolio.xyz
fficecleaning216.shop
arbontrust.xyz
simg.xyz
oya.fun
irwickstore.store
s-yatch-rentals-9n.today
1854.loan
ontent-marketing-31220.bond
atreal.kitchen
lucorecover.net
nline-mba-85097.bond
heusefulshopun.shop
etvigosurge.shop
otwire.store
ysportsbook.xyz
teelsections.net
zgrfi.info
xosoft.xyz
epression-test-67062.bond
soiuy.xyz
fx8l3vz2c.icu
exer.xyz
95zt370d.shop
olajosbetku.store
Signatures
-
Formbook family
-
Formbook payload 4 IoCs
resource yara_rule behavioral2/memory/2692-7-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2692-10-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2692-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1484-20-0x0000000000F00000-0x0000000000F2F000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1600 set thread context of 2692 1600 1ddd6b7f64ff57668ca9087e77362e4d11fda7c3c07aebe6c1f48b560aea038e.exe 83 PID 2692 set thread context of 3444 2692 svchost.exe 56 PID 2692 set thread context of 3444 2692 svchost.exe 56 PID 1484 set thread context of 3444 1484 NETSTAT.EXE 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddd6b7f64ff57668ca9087e77362e4d11fda7c3c07aebe6c1f48b560aea038e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NETSTAT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 1484 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 2692 svchost.exe 2692 svchost.exe 2692 svchost.exe 2692 svchost.exe 2692 svchost.exe 2692 svchost.exe 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE 1484 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1600 1ddd6b7f64ff57668ca9087e77362e4d11fda7c3c07aebe6c1f48b560aea038e.exe 2692 svchost.exe 2692 svchost.exe 2692 svchost.exe 2692 svchost.exe 1484 NETSTAT.EXE 1484 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2692 svchost.exe Token: SeDebugPrivilege 1484 NETSTAT.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1600 1ddd6b7f64ff57668ca9087e77362e4d11fda7c3c07aebe6c1f48b560aea038e.exe 1600 1ddd6b7f64ff57668ca9087e77362e4d11fda7c3c07aebe6c1f48b560aea038e.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1600 1ddd6b7f64ff57668ca9087e77362e4d11fda7c3c07aebe6c1f48b560aea038e.exe 1600 1ddd6b7f64ff57668ca9087e77362e4d11fda7c3c07aebe6c1f48b560aea038e.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1600 wrote to memory of 2692 1600 1ddd6b7f64ff57668ca9087e77362e4d11fda7c3c07aebe6c1f48b560aea038e.exe 83 PID 1600 wrote to memory of 2692 1600 1ddd6b7f64ff57668ca9087e77362e4d11fda7c3c07aebe6c1f48b560aea038e.exe 83 PID 1600 wrote to memory of 2692 1600 1ddd6b7f64ff57668ca9087e77362e4d11fda7c3c07aebe6c1f48b560aea038e.exe 83 PID 1600 wrote to memory of 2692 1600 1ddd6b7f64ff57668ca9087e77362e4d11fda7c3c07aebe6c1f48b560aea038e.exe 83 PID 3444 wrote to memory of 1484 3444 Explorer.EXE 85 PID 3444 wrote to memory of 1484 3444 Explorer.EXE 85 PID 3444 wrote to memory of 1484 3444 Explorer.EXE 85 PID 1484 wrote to memory of 1900 1484 NETSTAT.EXE 86 PID 1484 wrote to memory of 1900 1484 NETSTAT.EXE 86 PID 1484 wrote to memory of 1900 1484 NETSTAT.EXE 86
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\1ddd6b7f64ff57668ca9087e77362e4d11fda7c3c07aebe6c1f48b560aea038e.exe"C:\Users\Admin\AppData\Local\Temp\1ddd6b7f64ff57668ca9087e77362e4d11fda7c3c07aebe6c1f48b560aea038e.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\1ddd6b7f64ff57668ca9087e77362e4d11fda7c3c07aebe6c1f48b560aea038e.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2692
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1900
-
-