Analysis
-
max time kernel
145s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
14-12-2024 12:51
Static task
static1
Behavioral task
behavioral1
Sample
3aY3m96tqMSF6uX.exe
Resource
win7-20241010-en
General
-
Target
3aY3m96tqMSF6uX.exe
-
Size
713KB
-
MD5
e0e2345d91945b57353de7be04535f15
-
SHA1
2d5ac0274b741d19da82180264f5819ddfd11551
-
SHA256
863062f983aac165c04b1af4ce761865b4fd734b71de85e0aba00c112febac2b
-
SHA512
e78122530a09a9b874e5291584ffb4257e34fa1ea3b9f8f1dc54c5fa757de269566e2b07533ae3a7ba6212cd253c399949faaaab8f261ed8952c636d2146cf35
-
SSDEEP
12288:OC25usx+XtWhK/bACVDNdRBE6teRn6iB6/VN9hogN5AjJeuM5cifib7Qhk:yxg8ClrRa3Rn3BoP/AjO5cK
Malware Config
Extracted
formbook
4.1
ax19
nmarklun.biz
eadithere.net
oytromcm.net
6gu536d.shop
hysicsjunction.online
esistivitysensors.net
ealthcare-software-53940.bond
tupid-edsee.cyou
614.lat
agmart.store
lothesthesale.store
ranopen.info
c1v.lat
owflyingbugs.online
undumimmobilien.net
nline-advertising-57252.bond
orktyper.net
kten10.shop
sadeaguia.net
ouseofnormal.party
hypozhe.lol
ilerate.online
nline-advertising-99160.bond
nline-advertising-15828.bond
ourvisa.xyz
hronup.shop
dwing.xyz
njectionweightloss69.xyz
eography-lessons.pro
ealthcare-software-32022.bond
pps-57369.bond
itchen-design-44079.bond
aahoma-nane4.rest
pai-events.online
andlequeencandles.online
oftware-engineering-51273.bond
abio-lentini.live
hillinginghana.net
66by596d.shop
tockninja.sbs
etmail.shop
eurony.fun
nlybeans.net
carlettmone.berlin
ktualisieren.net
ramexot.live
olthubelectronics.store
rostitutkirostova61.net
rijggo.shop
raphic-design-degree-23646.bond
asabella.fun
ristav.fun
15gh827.skin
nline-advertising-77499.bond
ershian.chat
asc-nc.net
quiboost.sbs
om-instead.cyou
aoshang.sbs
olidayheaven.net
edditiptv.net
dnstudio95.store
atelso.xyz
yslagfhlp.online
eecshop.xyz
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/1784-13-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1784-21-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1852-22-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2932 powershell.exe -
Deletes itself 1 IoCs
pid Process 756 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2728 set thread context of 1784 2728 3aY3m96tqMSF6uX.exe 32 PID 1784 set thread context of 1204 1784 3aY3m96tqMSF6uX.exe 21 PID 1852 set thread context of 1204 1852 cmd.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3aY3m96tqMSF6uX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 2728 3aY3m96tqMSF6uX.exe 2728 3aY3m96tqMSF6uX.exe 1784 3aY3m96tqMSF6uX.exe 1784 3aY3m96tqMSF6uX.exe 2932 powershell.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1784 3aY3m96tqMSF6uX.exe 1784 3aY3m96tqMSF6uX.exe 1784 3aY3m96tqMSF6uX.exe 1852 cmd.exe 1852 cmd.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2728 3aY3m96tqMSF6uX.exe Token: SeDebugPrivilege 1784 3aY3m96tqMSF6uX.exe Token: SeDebugPrivilege 2932 powershell.exe Token: SeDebugPrivilege 1852 cmd.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2728 wrote to memory of 2932 2728 3aY3m96tqMSF6uX.exe 30 PID 2728 wrote to memory of 2932 2728 3aY3m96tqMSF6uX.exe 30 PID 2728 wrote to memory of 2932 2728 3aY3m96tqMSF6uX.exe 30 PID 2728 wrote to memory of 2932 2728 3aY3m96tqMSF6uX.exe 30 PID 2728 wrote to memory of 1784 2728 3aY3m96tqMSF6uX.exe 32 PID 2728 wrote to memory of 1784 2728 3aY3m96tqMSF6uX.exe 32 PID 2728 wrote to memory of 1784 2728 3aY3m96tqMSF6uX.exe 32 PID 2728 wrote to memory of 1784 2728 3aY3m96tqMSF6uX.exe 32 PID 2728 wrote to memory of 1784 2728 3aY3m96tqMSF6uX.exe 32 PID 2728 wrote to memory of 1784 2728 3aY3m96tqMSF6uX.exe 32 PID 2728 wrote to memory of 1784 2728 3aY3m96tqMSF6uX.exe 32 PID 1204 wrote to memory of 1852 1204 Explorer.EXE 34 PID 1204 wrote to memory of 1852 1204 Explorer.EXE 34 PID 1204 wrote to memory of 1852 1204 Explorer.EXE 34 PID 1204 wrote to memory of 1852 1204 Explorer.EXE 34 PID 1852 wrote to memory of 756 1852 cmd.exe 35 PID 1852 wrote to memory of 756 1852 cmd.exe 35 PID 1852 wrote to memory of 756 1852 cmd.exe 35 PID 1852 wrote to memory of 756 1852 cmd.exe 35
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\3aY3m96tqMSF6uX.exe"C:\Users\Admin\AppData\Local\Temp\3aY3m96tqMSF6uX.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3aY3m96tqMSF6uX.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2932
-
-
C:\Users\Admin\AppData\Local\Temp\3aY3m96tqMSF6uX.exe"C:\Users\Admin\AppData\Local\Temp\3aY3m96tqMSF6uX.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:2604
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\3aY3m96tqMSF6uX.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:756
-
-