Analysis
-
max time kernel
300s -
max time network
292s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 09:35
Static task
static1
Behavioral task
behavioral1
Sample
RP N° UNDP-TGO-00034 TOGO.exe
Resource
win7-20240903-en
General
-
Target
RP N° UNDP-TGO-00034 TOGO.exe
-
Size
1.1MB
-
MD5
5c64f75360a7535d0098e24852069970
-
SHA1
462d562bf08435260c76d09b8d0e78c8c854f55f
-
SHA256
6ce7f8a8cbb441eb6ea7b37a9f8039142f6586311cdc6c0518c1265ecb78318a
-
SHA512
293ae523ddfae0e68729bcf363efee2bf29586e720bd715c5d15cafbc2d38b62c86a21873ee41157e3cfd065f2865db07aa61eae65e19e6b5d416793d76ea7e8
-
SSDEEP
24576:ZqDEvCTbMWu7rQYlBQcBiT6rprG8aQTZ1IaWE1c4+vrcJ:ZTvC/MTQYxsWR7aQTZWE1c4Crc
Malware Config
Extracted
formbook
4.1
at22
etween-us.online
sphaleia.net
ental-implants-78350.bond
q4a.lat
commerce-97292.bond
linds-curtains-38811.bond
gyptevoyages.net
landofigueroa-abogados.net
cuitis.xyz
hantom.city
yzk.online
afikabmedan.store
ome-remodeling-67289.bond
ebpage-klzdxrhnazi.shop
eject.lol
rismart.xyz
nfluencer-marketing-72407.bond
ksolotl.xyz
ebsbayrntilrmizin93.xyz
pps-75399.bond
larecompany.sbs
b-apps.net
onitoring-devices-50256.bond
asusuos.shop
87zy448d.shop
irportandart.net
15y.lat
fujo3jsj8.cyou
uyhaa.website
uihangditrungquoc.online
sphalt-jobs-32044.bond
hlexpress-add.cyou
essecurity.xyz
assysirens.store
hhomestore.online
arehouse-inventory-86457.bond
ezup.store
ymgjyj.info
cez.lat
ubconcern.shop
ct1portfolio.xyz
fficecleaning216.shop
arbontrust.xyz
simg.xyz
oya.fun
irwickstore.store
s-yatch-rentals-9n.today
1854.loan
ontent-marketing-31220.bond
atreal.kitchen
lucorecover.net
nline-mba-85097.bond
heusefulshopun.shop
etvigosurge.shop
otwire.store
ysportsbook.xyz
teelsections.net
zgrfi.info
xosoft.xyz
epression-test-67062.bond
soiuy.xyz
fx8l3vz2c.icu
exer.xyz
95zt370d.shop
olajosbetku.store
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/1800-7-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1800-10-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2336-16-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2436 set thread context of 1800 2436 RP N° UNDP-TGO-00034 TOGO.exe 31 PID 1800 set thread context of 1268 1800 svchost.exe 21 PID 2336 set thread context of 1268 2336 msdt.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RP N° UNDP-TGO-00034 TOGO.exe -
Suspicious behavior: EnumeratesProcesses 61 IoCs
pid Process 1800 svchost.exe 1800 svchost.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe 2336 msdt.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2436 RP N° UNDP-TGO-00034 TOGO.exe 1800 svchost.exe 1800 svchost.exe 1800 svchost.exe 2336 msdt.exe 2336 msdt.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1800 svchost.exe Token: SeDebugPrivilege 2336 msdt.exe Token: SeShutdownPrivilege 1268 Explorer.EXE -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 2436 RP N° UNDP-TGO-00034 TOGO.exe 2436 RP N° UNDP-TGO-00034 TOGO.exe 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2436 RP N° UNDP-TGO-00034 TOGO.exe 2436 RP N° UNDP-TGO-00034 TOGO.exe 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2436 wrote to memory of 1800 2436 RP N° UNDP-TGO-00034 TOGO.exe 31 PID 2436 wrote to memory of 1800 2436 RP N° UNDP-TGO-00034 TOGO.exe 31 PID 2436 wrote to memory of 1800 2436 RP N° UNDP-TGO-00034 TOGO.exe 31 PID 2436 wrote to memory of 1800 2436 RP N° UNDP-TGO-00034 TOGO.exe 31 PID 2436 wrote to memory of 1800 2436 RP N° UNDP-TGO-00034 TOGO.exe 31 PID 1268 wrote to memory of 2336 1268 Explorer.EXE 32 PID 1268 wrote to memory of 2336 1268 Explorer.EXE 32 PID 1268 wrote to memory of 2336 1268 Explorer.EXE 32 PID 1268 wrote to memory of 2336 1268 Explorer.EXE 32 PID 2336 wrote to memory of 2108 2336 msdt.exe 33 PID 2336 wrote to memory of 2108 2336 msdt.exe 33 PID 2336 wrote to memory of 2108 2336 msdt.exe 33 PID 2336 wrote to memory of 2108 2336 msdt.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\RP N° UNDP-TGO-00034 TOGO.exe"C:\Users\Admin\AppData\Local\Temp\RP N° UNDP-TGO-00034 TOGO.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\RP N° UNDP-TGO-00034 TOGO.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2108
-
-