Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15-12-2024 03:59
Static task
static1
Behavioral task
behavioral1
Sample
c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe
Resource
win7-20240708-en
General
-
Target
c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe
-
Size
715KB
-
MD5
303c96d28de2023a3358f8a1c4dca692
-
SHA1
4fb8a0435be969803b11d4775d9026f692c64445
-
SHA256
c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73
-
SHA512
178e895c18b1afecfaa4bc10c259bd369485ed5ff03c96d0fdd36eb429e407bf57a0fb1b47268328cb9751982bdea69383b0f5be3af6a7c2738397b96d43b568
-
SSDEEP
12288:ZC25usx+XtRIO/3YtvYwFA8wL6Ab5buKjGhKyPV0VlzYqrh+GkVc:LxyIFvULLpNyKj6KKVqhYqla
Malware Config
Extracted
formbook
4.1
bs84
ehuatang.quest
mart-healthcare.solutions
arehouse-inventory-59593.bond
rumpjokes.net
oonlightshadow.store
odernoob.website
sdmedia.net
0k21l6z.xyz
kwovenart.shop
chvb.bid
06ks28.buzz
grexvc.online
unnycdn02.shop
ettingitgonejunk.net
lubmango.store
ustjump.xyz
ofiveuss.store
aahasti-inter5.rest
etclcg.business
ai365.xyz
kaislotplay.shop
ombinedourefforts.net
skfa.info
024-fr-cruises.today
usiness-loans-au-5531141.fyi
xcavators-32553.bond
9xx30.xyz
allerbahisgiris.net
ostescanadre.xyz
undofelizpet.store
ojadobuscabusca.online
itstops.xyz
teamcomuunity.online
lcosta.shop
rabideen.online
aajaleh-nane4.rest
558844a0.shop
ive-glucofree.store
kf777.win
ecuronixds.xyz
0418.pizza
odgersfittedhats.shop
y6c46.pro
olfgalaxy.xyz
svural.store
lasses.tech
raphic-design-degree-15820.bond
ental-implants-60954.bond
lonazap.net
aconciergerie.xyz
arehouse-inventory-27582.bond
rofitways.pro
erangiral4dp.net
etenterey.one
0percentfailrate.biz
ristav.fun
uanqi.live
nline-advertising-98760.bond
anguage-courses-51973.bond
arehouse-inventory-44734.bond
ealthcare-trends-16618.bond
isab.cloud
oodydigital.tech
oetsgarden.art
partments-in-dubai-66339.bond
Signatures
-
Formbook family
-
Formbook payload 1 IoCs
resource yara_rule behavioral1/memory/2616-19-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2432 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1960 set thread context of 2616 1960 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2176 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2616 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 2432 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2432 powershell.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1960 wrote to memory of 2432 1960 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 30 PID 1960 wrote to memory of 2432 1960 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 30 PID 1960 wrote to memory of 2432 1960 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 30 PID 1960 wrote to memory of 2432 1960 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 30 PID 1960 wrote to memory of 2176 1960 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 32 PID 1960 wrote to memory of 2176 1960 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 32 PID 1960 wrote to memory of 2176 1960 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 32 PID 1960 wrote to memory of 2176 1960 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 32 PID 1960 wrote to memory of 2616 1960 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 34 PID 1960 wrote to memory of 2616 1960 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 34 PID 1960 wrote to memory of 2616 1960 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 34 PID 1960 wrote to memory of 2616 1960 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 34 PID 1960 wrote to memory of 2616 1960 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 34 PID 1960 wrote to memory of 2616 1960 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 34 PID 1960 wrote to memory of 2616 1960 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe"C:\Users\Admin\AppData\Local\Temp\c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ODwExtAZdSpo.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2432
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ODwExtAZdSpo" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAB5C.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2176
-
-
C:\Users\Admin\AppData\Local\Temp\c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe"C:\Users\Admin\AppData\Local\Temp\c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2616
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD535007a00717db87e887762356418c60a
SHA135417b5c97e8ea0da7690fd0990f05b5e89066ac
SHA256b41cc1c3030933f19f0131fc4733899b3876aacef894968dcbb04217b0316640
SHA512fe1f261fc6ba578921abcb3ba64b11c2f5b3da7af8cb194060df8237a9f718981d1a1d52c40d7d788f22fba456abf07721f2efa3ca07add37c1a3f97ea0d2318