Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 13:31
Static task
static1
Behavioral task
behavioral1
Sample
27e7a04ff10f55514ec5f1851dbce76573c6c82b139543fc4d30e96b9d6d1fde.exe
Resource
win7-20240903-en
General
-
Target
27e7a04ff10f55514ec5f1851dbce76573c6c82b139543fc4d30e96b9d6d1fde.exe
-
Size
755KB
-
MD5
7d9340092193b9d012d4a691bb25985c
-
SHA1
46a8edaa531903925a73c3973081ef679497d5e4
-
SHA256
27e7a04ff10f55514ec5f1851dbce76573c6c82b139543fc4d30e96b9d6d1fde
-
SHA512
bfc6baea7fd3a7805259cb4859c87559f4874f097fc7c93a111c8510e0a4f016ae4bed114c514070f98034386a706a493fc7c27d8ed546e09bf880d2aaaf41d9
-
SSDEEP
12288:it3+Pfj4wtDTmilHq1QBU9t/7okRdiaer727e3qBuR88TMjGJUeB:iUjhtDTmitq1QBE9oQd9e/nqBuRZW81B
Malware Config
Extracted
formbook
4.1
t2y7
x1marina.com
567livevni.biz
itneedednottobehidden.com
chemdh.com
joelbigaignon.com
thanhtam.info
mayiladuthuraitaxi.com
quantumsystem-cz.icu
jwjhs.com
jrfglobalmy.com
mandarinoteloriental.com
osscoincurrency.com
jameshenrycfa.com
gunpowderhill.com
madamchai.com
jaymeeyuen.com
opplapp.space
throatbloodletting.com
wu6aaxa1tatw.xyz
randybuyshousesfast.com
wghapt050.xyz
ronelab.com
iebigdata.com
ca-ms.com
2hyezonlww.com
limitkart.com
edb-hrm.com
hi021.info
nelsonmandelaawards.com
fanneling.xyz
thesaltypaddleaz.com
q22cs.xyz
theheartreno.com
fxklrg.com
vigilanti.online
leeslawncareservicesonline.com
agenmpo88.com
hi5u2yn.xyz
moonflower.xyz
attlgcms.com
luyuanscl.com
dirr-wood-art-craft.com
pleasantmc.xyz
passthehesi.com
lixodruj.xyz
godrejambivali-riviera.com
modulacontracting.com
drolby.com
goodyouare.com
cryptocurrencywedding.com
mankatsu-note.com
taavonsomerville.com
collabcribnft.com
datashieldlabs.com
pacancelit.com
concoursdevente.com
nazarovas.com
senioretmoi.com
xn--12c8b7au6ct7ec8eza.com
peachgray.xyz
lodown.xyz
capitalrenovation.net
cappamaniatour.xyz
arvizufamilyprovisions.net
epiluxe-store.com
Signatures
-
Formbook family
-
Formbook payload 1 IoCs
resource yara_rule behavioral2/memory/4172-13-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2012 set thread context of 4172 2012 27e7a04ff10f55514ec5f1851dbce76573c6c82b139543fc4d30e96b9d6d1fde.exe 99 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27e7a04ff10f55514ec5f1851dbce76573c6c82b139543fc4d30e96b9d6d1fde.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4172 27e7a04ff10f55514ec5f1851dbce76573c6c82b139543fc4d30e96b9d6d1fde.exe 4172 27e7a04ff10f55514ec5f1851dbce76573c6c82b139543fc4d30e96b9d6d1fde.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2012 wrote to memory of 4172 2012 27e7a04ff10f55514ec5f1851dbce76573c6c82b139543fc4d30e96b9d6d1fde.exe 99 PID 2012 wrote to memory of 4172 2012 27e7a04ff10f55514ec5f1851dbce76573c6c82b139543fc4d30e96b9d6d1fde.exe 99 PID 2012 wrote to memory of 4172 2012 27e7a04ff10f55514ec5f1851dbce76573c6c82b139543fc4d30e96b9d6d1fde.exe 99 PID 2012 wrote to memory of 4172 2012 27e7a04ff10f55514ec5f1851dbce76573c6c82b139543fc4d30e96b9d6d1fde.exe 99 PID 2012 wrote to memory of 4172 2012 27e7a04ff10f55514ec5f1851dbce76573c6c82b139543fc4d30e96b9d6d1fde.exe 99 PID 2012 wrote to memory of 4172 2012 27e7a04ff10f55514ec5f1851dbce76573c6c82b139543fc4d30e96b9d6d1fde.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\27e7a04ff10f55514ec5f1851dbce76573c6c82b139543fc4d30e96b9d6d1fde.exe"C:\Users\Admin\AppData\Local\Temp\27e7a04ff10f55514ec5f1851dbce76573c6c82b139543fc4d30e96b9d6d1fde.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\27e7a04ff10f55514ec5f1851dbce76573c6c82b139543fc4d30e96b9d6d1fde.exe"C:\Users\Admin\AppData\Local\Temp\27e7a04ff10f55514ec5f1851dbce76573c6c82b139543fc4d30e96b9d6d1fde.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4172
-