Analysis
-
max time kernel
147s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
14-12-2024 12:48
Static task
static1
Behavioral task
behavioral1
Sample
3aY3m96tqMSF6uX.exe
Resource
win7-20241010-en
General
-
Target
3aY3m96tqMSF6uX.exe
-
Size
713KB
-
MD5
e0e2345d91945b57353de7be04535f15
-
SHA1
2d5ac0274b741d19da82180264f5819ddfd11551
-
SHA256
863062f983aac165c04b1af4ce761865b4fd734b71de85e0aba00c112febac2b
-
SHA512
e78122530a09a9b874e5291584ffb4257e34fa1ea3b9f8f1dc54c5fa757de269566e2b07533ae3a7ba6212cd253c399949faaaab8f261ed8952c636d2146cf35
-
SSDEEP
12288:OC25usx+XtWhK/bACVDNdRBE6teRn6iB6/VN9hogN5AjJeuM5cifib7Qhk:yxg8ClrRa3Rn3BoP/AjO5cK
Malware Config
Extracted
formbook
4.1
ax19
nmarklun.biz
eadithere.net
oytromcm.net
6gu536d.shop
hysicsjunction.online
esistivitysensors.net
ealthcare-software-53940.bond
tupid-edsee.cyou
614.lat
agmart.store
lothesthesale.store
ranopen.info
c1v.lat
owflyingbugs.online
undumimmobilien.net
nline-advertising-57252.bond
orktyper.net
kten10.shop
sadeaguia.net
ouseofnormal.party
hypozhe.lol
ilerate.online
nline-advertising-99160.bond
nline-advertising-15828.bond
ourvisa.xyz
hronup.shop
dwing.xyz
njectionweightloss69.xyz
eography-lessons.pro
ealthcare-software-32022.bond
pps-57369.bond
itchen-design-44079.bond
aahoma-nane4.rest
pai-events.online
andlequeencandles.online
oftware-engineering-51273.bond
abio-lentini.live
hillinginghana.net
66by596d.shop
tockninja.sbs
etmail.shop
eurony.fun
nlybeans.net
carlettmone.berlin
ktualisieren.net
ramexot.live
olthubelectronics.store
rostitutkirostova61.net
rijggo.shop
raphic-design-degree-23646.bond
asabella.fun
ristav.fun
15gh827.skin
nline-advertising-77499.bond
ershian.chat
asc-nc.net
quiboost.sbs
om-instead.cyou
aoshang.sbs
olidayheaven.net
edditiptv.net
dnstudio95.store
atelso.xyz
yslagfhlp.online
eecshop.xyz
Signatures
-
Formbook family
-
Formbook payload 4 IoCs
resource yara_rule behavioral1/memory/2964-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2964-18-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2964-20-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2020-22-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1600 powershell.exe -
Deletes itself 1 IoCs
pid Process 2656 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2580 set thread context of 2964 2580 3aY3m96tqMSF6uX.exe 32 PID 2964 set thread context of 1180 2964 3aY3m96tqMSF6uX.exe 21 PID 2964 set thread context of 1180 2964 3aY3m96tqMSF6uX.exe 21 PID 2020 set thread context of 1180 2020 colorcpl.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3aY3m96tqMSF6uX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3aY3m96tqMSF6uX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language colorcpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2580 3aY3m96tqMSF6uX.exe 2580 3aY3m96tqMSF6uX.exe 2964 3aY3m96tqMSF6uX.exe 2964 3aY3m96tqMSF6uX.exe 1600 powershell.exe 2964 3aY3m96tqMSF6uX.exe 2020 colorcpl.exe 2020 colorcpl.exe 2020 colorcpl.exe 2020 colorcpl.exe 2020 colorcpl.exe 2020 colorcpl.exe 2020 colorcpl.exe 2020 colorcpl.exe 2020 colorcpl.exe 2020 colorcpl.exe 2020 colorcpl.exe 2020 colorcpl.exe 2020 colorcpl.exe 2020 colorcpl.exe 2020 colorcpl.exe 2020 colorcpl.exe 2020 colorcpl.exe 2020 colorcpl.exe 2020 colorcpl.exe 2020 colorcpl.exe 2020 colorcpl.exe 2020 colorcpl.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2964 3aY3m96tqMSF6uX.exe 2964 3aY3m96tqMSF6uX.exe 2964 3aY3m96tqMSF6uX.exe 2964 3aY3m96tqMSF6uX.exe 2020 colorcpl.exe 2020 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2580 3aY3m96tqMSF6uX.exe Token: SeDebugPrivilege 2964 3aY3m96tqMSF6uX.exe Token: SeDebugPrivilege 1600 powershell.exe Token: SeDebugPrivilege 2020 colorcpl.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2580 wrote to memory of 1600 2580 3aY3m96tqMSF6uX.exe 30 PID 2580 wrote to memory of 1600 2580 3aY3m96tqMSF6uX.exe 30 PID 2580 wrote to memory of 1600 2580 3aY3m96tqMSF6uX.exe 30 PID 2580 wrote to memory of 1600 2580 3aY3m96tqMSF6uX.exe 30 PID 2580 wrote to memory of 2964 2580 3aY3m96tqMSF6uX.exe 32 PID 2580 wrote to memory of 2964 2580 3aY3m96tqMSF6uX.exe 32 PID 2580 wrote to memory of 2964 2580 3aY3m96tqMSF6uX.exe 32 PID 2580 wrote to memory of 2964 2580 3aY3m96tqMSF6uX.exe 32 PID 2580 wrote to memory of 2964 2580 3aY3m96tqMSF6uX.exe 32 PID 2580 wrote to memory of 2964 2580 3aY3m96tqMSF6uX.exe 32 PID 2580 wrote to memory of 2964 2580 3aY3m96tqMSF6uX.exe 32 PID 2964 wrote to memory of 2020 2964 3aY3m96tqMSF6uX.exe 33 PID 2964 wrote to memory of 2020 2964 3aY3m96tqMSF6uX.exe 33 PID 2964 wrote to memory of 2020 2964 3aY3m96tqMSF6uX.exe 33 PID 2964 wrote to memory of 2020 2964 3aY3m96tqMSF6uX.exe 33 PID 2020 wrote to memory of 2656 2020 colorcpl.exe 34 PID 2020 wrote to memory of 2656 2020 colorcpl.exe 34 PID 2020 wrote to memory of 2656 2020 colorcpl.exe 34 PID 2020 wrote to memory of 2656 2020 colorcpl.exe 34
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\3aY3m96tqMSF6uX.exe"C:\Users\Admin\AppData\Local\Temp\3aY3m96tqMSF6uX.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3aY3m96tqMSF6uX.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1600
-
-
C:\Users\Admin\AppData\Local\Temp\3aY3m96tqMSF6uX.exe"C:\Users\Admin\AppData\Local\Temp\3aY3m96tqMSF6uX.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"4⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\3aY3m96tqMSF6uX.exe"5⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2656
-
-
-
-