Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-12-2024 12:48
Static task
static1
Behavioral task
behavioral1
Sample
3aY3m96tqMSF6uX.exe
Resource
win7-20241010-en
General
-
Target
3aY3m96tqMSF6uX.exe
-
Size
713KB
-
MD5
e0e2345d91945b57353de7be04535f15
-
SHA1
2d5ac0274b741d19da82180264f5819ddfd11551
-
SHA256
863062f983aac165c04b1af4ce761865b4fd734b71de85e0aba00c112febac2b
-
SHA512
e78122530a09a9b874e5291584ffb4257e34fa1ea3b9f8f1dc54c5fa757de269566e2b07533ae3a7ba6212cd253c399949faaaab8f261ed8952c636d2146cf35
-
SSDEEP
12288:OC25usx+XtWhK/bACVDNdRBE6teRn6iB6/VN9hogN5AjJeuM5cifib7Qhk:yxg8ClrRa3Rn3BoP/AjO5cK
Malware Config
Extracted
formbook
4.1
ax19
nmarklun.biz
eadithere.net
oytromcm.net
6gu536d.shop
hysicsjunction.online
esistivitysensors.net
ealthcare-software-53940.bond
tupid-edsee.cyou
614.lat
agmart.store
lothesthesale.store
ranopen.info
c1v.lat
owflyingbugs.online
undumimmobilien.net
nline-advertising-57252.bond
orktyper.net
kten10.shop
sadeaguia.net
ouseofnormal.party
hypozhe.lol
ilerate.online
nline-advertising-99160.bond
nline-advertising-15828.bond
ourvisa.xyz
hronup.shop
dwing.xyz
njectionweightloss69.xyz
eography-lessons.pro
ealthcare-software-32022.bond
pps-57369.bond
itchen-design-44079.bond
aahoma-nane4.rest
pai-events.online
andlequeencandles.online
oftware-engineering-51273.bond
abio-lentini.live
hillinginghana.net
66by596d.shop
tockninja.sbs
etmail.shop
eurony.fun
nlybeans.net
carlettmone.berlin
ktualisieren.net
ramexot.live
olthubelectronics.store
rostitutkirostova61.net
rijggo.shop
raphic-design-degree-23646.bond
asabella.fun
ristav.fun
15gh827.skin
nline-advertising-77499.bond
ershian.chat
asc-nc.net
quiboost.sbs
om-instead.cyou
aoshang.sbs
olidayheaven.net
edditiptv.net
dnstudio95.store
atelso.xyz
yslagfhlp.online
eecshop.xyz
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/4264-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4264-21-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3028-67-0x0000000000FB0000-0x0000000000FDF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1960 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation 3aY3m96tqMSF6uX.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3772 set thread context of 4264 3772 3aY3m96tqMSF6uX.exe 91 PID 4264 set thread context of 3504 4264 3aY3m96tqMSF6uX.exe 56 PID 3028 set thread context of 3504 3028 help.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3aY3m96tqMSF6uX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language help.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 3772 3aY3m96tqMSF6uX.exe 3772 3aY3m96tqMSF6uX.exe 4264 3aY3m96tqMSF6uX.exe 4264 3aY3m96tqMSF6uX.exe 4264 3aY3m96tqMSF6uX.exe 4264 3aY3m96tqMSF6uX.exe 1960 powershell.exe 1960 powershell.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe 3028 help.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 4264 3aY3m96tqMSF6uX.exe 4264 3aY3m96tqMSF6uX.exe 4264 3aY3m96tqMSF6uX.exe 3028 help.exe 3028 help.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3772 3aY3m96tqMSF6uX.exe Token: SeDebugPrivilege 4264 3aY3m96tqMSF6uX.exe Token: SeDebugPrivilege 1960 powershell.exe Token: SeShutdownPrivilege 3504 Explorer.EXE Token: SeCreatePagefilePrivilege 3504 Explorer.EXE Token: SeDebugPrivilege 3028 help.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3772 wrote to memory of 1960 3772 3aY3m96tqMSF6uX.exe 89 PID 3772 wrote to memory of 1960 3772 3aY3m96tqMSF6uX.exe 89 PID 3772 wrote to memory of 1960 3772 3aY3m96tqMSF6uX.exe 89 PID 3772 wrote to memory of 4264 3772 3aY3m96tqMSF6uX.exe 91 PID 3772 wrote to memory of 4264 3772 3aY3m96tqMSF6uX.exe 91 PID 3772 wrote to memory of 4264 3772 3aY3m96tqMSF6uX.exe 91 PID 3772 wrote to memory of 4264 3772 3aY3m96tqMSF6uX.exe 91 PID 3772 wrote to memory of 4264 3772 3aY3m96tqMSF6uX.exe 91 PID 3772 wrote to memory of 4264 3772 3aY3m96tqMSF6uX.exe 91 PID 3504 wrote to memory of 3028 3504 Explorer.EXE 92 PID 3504 wrote to memory of 3028 3504 Explorer.EXE 92 PID 3504 wrote to memory of 3028 3504 Explorer.EXE 92 PID 3028 wrote to memory of 1432 3028 help.exe 93 PID 3028 wrote to memory of 1432 3028 help.exe 93 PID 3028 wrote to memory of 1432 3028 help.exe 93
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\3aY3m96tqMSF6uX.exe"C:\Users\Admin\AppData\Local\Temp\3aY3m96tqMSF6uX.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3aY3m96tqMSF6uX.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1960
-
-
C:\Users\Admin\AppData\Local\Temp\3aY3m96tqMSF6uX.exe"C:\Users\Admin\AppData\Local\Temp\3aY3m96tqMSF6uX.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4264
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\3aY3m96tqMSF6uX.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1432
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82