Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15-12-2024 03:59
Static task
static1
Behavioral task
behavioral1
Sample
c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe
Resource
win7-20240708-en
General
-
Target
c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe
-
Size
715KB
-
MD5
303c96d28de2023a3358f8a1c4dca692
-
SHA1
4fb8a0435be969803b11d4775d9026f692c64445
-
SHA256
c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73
-
SHA512
178e895c18b1afecfaa4bc10c259bd369485ed5ff03c96d0fdd36eb429e407bf57a0fb1b47268328cb9751982bdea69383b0f5be3af6a7c2738397b96d43b568
-
SSDEEP
12288:ZC25usx+XtRIO/3YtvYwFA8wL6Ab5buKjGhKyPV0VlzYqrh+GkVc:LxyIFvULLpNyKj6KKVqhYqla
Malware Config
Extracted
formbook
4.1
bs84
ehuatang.quest
mart-healthcare.solutions
arehouse-inventory-59593.bond
rumpjokes.net
oonlightshadow.store
odernoob.website
sdmedia.net
0k21l6z.xyz
kwovenart.shop
chvb.bid
06ks28.buzz
grexvc.online
unnycdn02.shop
ettingitgonejunk.net
lubmango.store
ustjump.xyz
ofiveuss.store
aahasti-inter5.rest
etclcg.business
ai365.xyz
kaislotplay.shop
ombinedourefforts.net
skfa.info
024-fr-cruises.today
usiness-loans-au-5531141.fyi
xcavators-32553.bond
9xx30.xyz
allerbahisgiris.net
ostescanadre.xyz
undofelizpet.store
ojadobuscabusca.online
itstops.xyz
teamcomuunity.online
lcosta.shop
rabideen.online
aajaleh-nane4.rest
558844a0.shop
ive-glucofree.store
kf777.win
ecuronixds.xyz
0418.pizza
odgersfittedhats.shop
y6c46.pro
olfgalaxy.xyz
svural.store
lasses.tech
raphic-design-degree-15820.bond
ental-implants-60954.bond
lonazap.net
aconciergerie.xyz
arehouse-inventory-27582.bond
rofitways.pro
erangiral4dp.net
etenterey.one
0percentfailrate.biz
ristav.fun
uanqi.live
nline-advertising-98760.bond
anguage-courses-51973.bond
arehouse-inventory-44734.bond
ealthcare-trends-16618.bond
isab.cloud
oodydigital.tech
oetsgarden.art
partments-in-dubai-66339.bond
Signatures
-
Formbook family
-
Formbook payload 1 IoCs
resource yara_rule behavioral2/memory/4872-21-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1932 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2440 set thread context of 4872 2440 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 93 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4700 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1932 powershell.exe 4872 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 4872 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 1932 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1932 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2440 wrote to memory of 1932 2440 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 89 PID 2440 wrote to memory of 1932 2440 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 89 PID 2440 wrote to memory of 1932 2440 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 89 PID 2440 wrote to memory of 4700 2440 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 91 PID 2440 wrote to memory of 4700 2440 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 91 PID 2440 wrote to memory of 4700 2440 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 91 PID 2440 wrote to memory of 4872 2440 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 93 PID 2440 wrote to memory of 4872 2440 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 93 PID 2440 wrote to memory of 4872 2440 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 93 PID 2440 wrote to memory of 4872 2440 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 93 PID 2440 wrote to memory of 4872 2440 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 93 PID 2440 wrote to memory of 4872 2440 c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe"C:\Users\Admin\AppData\Local\Temp\c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ODwExtAZdSpo.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1932
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ODwExtAZdSpo" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7D5C.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4700
-
-
C:\Users\Admin\AppData\Local\Temp\c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe"C:\Users\Admin\AppData\Local\Temp\c1858ea28a880a9d789497986b541c29f79cb2d6de8aea568f09b309a7819c73.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4872
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD59b612cf01e23671bd7f620e1131bb8ce
SHA1f91ebc1ad9585b1c2112931d65cb23eb2462964b
SHA2562fee3d2ac6e1a2c38dc40e55a28bb7c3284feb9cfd8c05c31c1ac2cab283993d
SHA512413e7b4d77093ac7f851696108f56e63119013949569281f29f489df82b84e66ccbd6307ebb16bd474829de7a2a6f2864922cab575aadeaaeaa63d41c7e5d803