Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 06:30
Static task
static1
Behavioral task
behavioral1
Sample
bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a.exe
Resource
win7-20240903-en
General
-
Target
bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a.exe
-
Size
743KB
-
MD5
96e86e405d7562e778fa380a07ff8ff7
-
SHA1
c5f9c54d9bc639e7f84447e8d0b79323ef128b02
-
SHA256
bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a
-
SHA512
ae7ad2150f8c9b0037372af0092570d9557cbff7e6a5b260407211410c4457b105416a10a2c30b8ceeccf90ab6cf5e5970b1c53a5861af90e859c8924c1a8c51
-
SSDEEP
12288:uU8f2uE1zDMjwPCBchAASH2gDkPN0IJzI/4yoKAaKKiq08f2:uUu2uOUjw2chAAXgYmIJzI/4yoKAL60Z
Malware Config
Extracted
formbook
4.1
k49s
ufberyrubiest.shop
tpanekatotosite.top
esona805158762.xyz
earing-tests-15487.bond
rediksitiraitoto.xyz
tore-playstore.online
mpresarialpx38.online
ufxusa.net
reativedesigns.lat
leaning-services-47614.bond
959725nptklnq923.top
treziop.xyz
eubel-bestseller.online
uynewcars.xyz
all-panels-74750.bond
erviceninjas.vip
arectoroffice.xyz
oviesgpt.app
ractors-22059.bond
rakenfitness.info
qatn10.shop
r-dresses-comments-25j.today
ejao.online
iningtruckszone.today
573132.top
cn5u.digital
qatn10.shop
56tm74ah.autos
urkiyekahvecisi.xyz
zincloud.shop
asuraplay77.info
ementia-treatment-40095.bond
lianzatrading.online
otive.app
imba69luckyspin.sbs
ainlamphumidifier.shop
martfile.app
at-casino-sh.buzz
uluthtradingsale.club
my755h.top
eflexive.asia
aboresdemexico.shop
nvestorsinbox.net
tp-turbobet77.live
vcxcvfwe22.shop
nlineredirect.cloud
ueyunlaihong.top
uperfastservic.online
itetalk.net
5940.club
oftware-avast.top
articuli.cloud
atin-dating-52735.bond
taticsitescanary.net
tr77.bet
ift-chairs-17834.bond
viviendapro.online
w165.top
martct.info
odiacdigitaltwin.cloud
ires-66750.bond
xtaapp.fun
63719.vip
in-up-casino-skf2.top
ir-condition-81494.bond
Signatures
-
Formbook family
-
Formbook payload 1 IoCs
resource yara_rule behavioral1/memory/2868-13-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2788 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2664 set thread context of 2868 2664 bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2868 bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a.exe 2788 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2788 powershell.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2664 wrote to memory of 2788 2664 bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a.exe 31 PID 2664 wrote to memory of 2788 2664 bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a.exe 31 PID 2664 wrote to memory of 2788 2664 bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a.exe 31 PID 2664 wrote to memory of 2788 2664 bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a.exe 31 PID 2664 wrote to memory of 2868 2664 bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a.exe 33 PID 2664 wrote to memory of 2868 2664 bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a.exe 33 PID 2664 wrote to memory of 2868 2664 bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a.exe 33 PID 2664 wrote to memory of 2868 2664 bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a.exe 33 PID 2664 wrote to memory of 2868 2664 bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a.exe 33 PID 2664 wrote to memory of 2868 2664 bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a.exe 33 PID 2664 wrote to memory of 2868 2664 bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a.exe"C:\Users\Admin\AppData\Local\Temp\bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2788
-
-
C:\Users\Admin\AppData\Local\Temp\bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a.exe"C:\Users\Admin\AppData\Local\Temp\bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2868
-