Analysis
-
max time kernel
146s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 03:44
Static task
static1
Behavioral task
behavioral1
Sample
519678c24f6036d935bdd915090f07ad1fea068dc2491861648c6b00698de514.exe
Resource
win7-20240903-en
General
-
Target
519678c24f6036d935bdd915090f07ad1fea068dc2491861648c6b00698de514.exe
-
Size
1.4MB
-
MD5
b96e6785937bd52b1281fb98f0abcf25
-
SHA1
d27572ada589769bfdb99dabbd485556e39010ba
-
SHA256
519678c24f6036d935bdd915090f07ad1fea068dc2491861648c6b00698de514
-
SHA512
39aadf908dcbb16588e5a93f7c633224d3ba7aa3bed54ae96e3fb9320fc080b6da7987b8d66d279266045b1aaafc1788b47bb72558ff42371acd55e8f768304d
-
SSDEEP
24576:Gtb20pkaCqT5TBWgNQ7aMhKG+mrh1JPUc9g56A:zVg5tQ7aMhKG+mrPVD9k5
Malware Config
Extracted
formbook
4.1
hwu6
lf758.vip
locerin-hair.shop
vytech.net
pet-insurance-intl-7990489.live
thepolithat.buzz
d66dr114gl.bond
suv-deals-49508.bond
job-offer-53922.bond
drstone1.click
lebahsemesta57.click
olmanihousel.shop
piedmontcsb.info
trisula888x.top
66sodovna.net
dental-implants-83810.bond
imxtld.club
frozenpines.net
ffgzgbl.xyz
tlc7z.rest
alexismuller.design
6vay.boats
moocatinght.top
hafwje.bond
edmaker.online
simo1simo001.click
vbsdconsultant.click
ux-design-courses-53497.bond
victory88-pay.xyz
suarahati7.xyz
otzen.info
hair-transplantation-65829.bond
gequiltdesins.shop
inefity.cloud
jeeinsight.online
86339.xyz
stairr-lift-find.today
wdgb20.top
91uvq.pro
energyecosystem.app
8e5lr5i9zu.buzz
migraine-treatment-36101.bond
eternityzon.shop
43mjqdyetv.sbs
healthcare-software-74448.bond
bethlark.top
dangdut4dselalu.pro
04506.club
rider.vision
health-insurance-cake.world
apoppynote.com
11817e.com
hiefmotelkeokuk.top
sugatoken.xyz
aragamand.business
alifewithoutlimits.info
vibrantsoul.xyz
olarpanels-outlet.info
ozzd86fih4.online
skbdicat.xyz
cloggedpipes.net
ilsgroup.net
ptcnl.info
backstretch.store
maheshg.xyz
7b5846.online
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/1260-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1260-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2328-21-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2536 set thread context of 1260 2536 519678c24f6036d935bdd915090f07ad1fea068dc2491861648c6b00698de514.exe 30 PID 1260 set thread context of 1180 1260 svchost.exe 21 PID 2328 set thread context of 1180 2328 NETSTAT.EXE 21 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 519678c24f6036d935bdd915090f07ad1fea068dc2491861648c6b00698de514.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NETSTAT.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2328 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 1260 svchost.exe 1260 svchost.exe 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE 2328 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2536 519678c24f6036d935bdd915090f07ad1fea068dc2491861648c6b00698de514.exe 1260 svchost.exe 1260 svchost.exe 1260 svchost.exe 2328 NETSTAT.EXE 2328 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1260 svchost.exe Token: SeDebugPrivilege 2328 NETSTAT.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2536 519678c24f6036d935bdd915090f07ad1fea068dc2491861648c6b00698de514.exe 2536 519678c24f6036d935bdd915090f07ad1fea068dc2491861648c6b00698de514.exe 1180 Explorer.EXE 1180 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2536 519678c24f6036d935bdd915090f07ad1fea068dc2491861648c6b00698de514.exe 2536 519678c24f6036d935bdd915090f07ad1fea068dc2491861648c6b00698de514.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2536 wrote to memory of 1260 2536 519678c24f6036d935bdd915090f07ad1fea068dc2491861648c6b00698de514.exe 30 PID 2536 wrote to memory of 1260 2536 519678c24f6036d935bdd915090f07ad1fea068dc2491861648c6b00698de514.exe 30 PID 2536 wrote to memory of 1260 2536 519678c24f6036d935bdd915090f07ad1fea068dc2491861648c6b00698de514.exe 30 PID 2536 wrote to memory of 1260 2536 519678c24f6036d935bdd915090f07ad1fea068dc2491861648c6b00698de514.exe 30 PID 2536 wrote to memory of 1260 2536 519678c24f6036d935bdd915090f07ad1fea068dc2491861648c6b00698de514.exe 30 PID 1180 wrote to memory of 2328 1180 Explorer.EXE 31 PID 1180 wrote to memory of 2328 1180 Explorer.EXE 31 PID 1180 wrote to memory of 2328 1180 Explorer.EXE 31 PID 1180 wrote to memory of 2328 1180 Explorer.EXE 31 PID 2328 wrote to memory of 1852 2328 NETSTAT.EXE 32 PID 2328 wrote to memory of 1852 2328 NETSTAT.EXE 32 PID 2328 wrote to memory of 1852 2328 NETSTAT.EXE 32 PID 2328 wrote to memory of 1852 2328 NETSTAT.EXE 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\519678c24f6036d935bdd915090f07ad1fea068dc2491861648c6b00698de514.exe"C:\Users\Admin\AppData\Local\Temp\519678c24f6036d935bdd915090f07ad1fea068dc2491861648c6b00698de514.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\519678c24f6036d935bdd915090f07ad1fea068dc2491861648c6b00698de514.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1260
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1852
-
-