Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
15/01/2025, 22:25
Static task
static1
Behavioral task
behavioral1
Sample
59e8de29b4c037daed8c68ea9cdd7eac9531bdac170e7967ed84e38bd62327c2N.exe
Resource
win7-20241010-en
General
-
Target
59e8de29b4c037daed8c68ea9cdd7eac9531bdac170e7967ed84e38bd62327c2N.exe
-
Size
1.3MB
-
MD5
6e978a92fe81679e6a7a46eb8f5a5480
-
SHA1
8f2f6114ed14e429fa4e0f1db262adfee67cef3d
-
SHA256
59e8de29b4c037daed8c68ea9cdd7eac9531bdac170e7967ed84e38bd62327c2
-
SHA512
38e79b3960cb6c97afa25c8190f054242a1dfd0824afe96974d9746022b95201ca37159af3edeecc0e287d520f16bca0c73173d96195b9fc45491817d6e079fe
-
SSDEEP
24576:/qDEvCTbMWu7rQYlBQcBiT6rprG8anXU3+JBbD0i+46+wzxH:/TvC/MTQYxsWR7anE3Qd6
Malware Config
Extracted
formbook
4.1
nw03
eniorshousing22.life
kinbar.club
ontovna.fun
endeepro.info
ouchesbaby.online
andscaping-jobs-23499.bond
kylinerental.net
ealthcare-software-62251.bond
arehouse-inventory-48722.bond
gghjcb.bid
pinhere.online
vintekstil.xyz
evitco.store
fcws.xyz
fdifg.icu
utomotivejobs.today
entalveneerscanada504883.icu
d5t.lat
yyl.uno
iffort.shop
40el946d.shop
usiness-funding-44141.bond
fuera.xyz
ucrandofacil.shop
andova.shop
insure.xyz
73653.xyz
ardivedyskines1a.today
luxhaven.store
9kct.xyz
qb530706n.vip
vfdou.xyz
lackheads-treatment-68407.bond
ingdomdetailing.services
amayartelevision.online
91681337.xyz
emimi42.net
ezainfaz.net
lantz.xyz
quaticplants.net
tagehd.online
rystalvibes.online
ndie.quest
ronde.xyz
omputernerd.xyz
nline-advertising-15387.bond
8cy.sbs
irasawa.email
ouse-cleaning-5.sbs
1mybm0-unlockacc0unt.info
ugi.xyz
zposv-nzv.xyz
heheadline.xyz
ovrusia9.shop
adanindo4dpools.net
obospa.shop
apsolutions.xyz
lobo.legal
ilmguru.net
cloud.icu
rbalia.net
i4nsrci7k.bio
lackheads-treatment-98308.bond
hzyil.tech
nline-advertising-98166.bond
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/2888-3-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2888-6-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/3048-11-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2816 set thread context of 2888 2816 59e8de29b4c037daed8c68ea9cdd7eac9531bdac170e7967ed84e38bd62327c2N.exe 30 PID 2888 set thread context of 1212 2888 svchost.exe 21 PID 3048 set thread context of 1212 3048 explorer.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59e8de29b4c037daed8c68ea9cdd7eac9531bdac170e7967ed84e38bd62327c2N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 2888 svchost.exe 2888 svchost.exe 3048 explorer.exe 3048 explorer.exe 3048 explorer.exe 3048 explorer.exe 3048 explorer.exe 3048 explorer.exe 3048 explorer.exe 3048 explorer.exe 3048 explorer.exe 3048 explorer.exe 3048 explorer.exe 3048 explorer.exe 3048 explorer.exe 3048 explorer.exe 3048 explorer.exe 3048 explorer.exe 3048 explorer.exe 3048 explorer.exe 3048 explorer.exe 3048 explorer.exe 3048 explorer.exe 3048 explorer.exe 3048 explorer.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2816 59e8de29b4c037daed8c68ea9cdd7eac9531bdac170e7967ed84e38bd62327c2N.exe 2888 svchost.exe 2888 svchost.exe 2888 svchost.exe 3048 explorer.exe 3048 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2888 svchost.exe Token: SeDebugPrivilege 3048 explorer.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 2816 59e8de29b4c037daed8c68ea9cdd7eac9531bdac170e7967ed84e38bd62327c2N.exe 2816 59e8de29b4c037daed8c68ea9cdd7eac9531bdac170e7967ed84e38bd62327c2N.exe 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2816 59e8de29b4c037daed8c68ea9cdd7eac9531bdac170e7967ed84e38bd62327c2N.exe 2816 59e8de29b4c037daed8c68ea9cdd7eac9531bdac170e7967ed84e38bd62327c2N.exe 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2816 wrote to memory of 2888 2816 59e8de29b4c037daed8c68ea9cdd7eac9531bdac170e7967ed84e38bd62327c2N.exe 30 PID 2816 wrote to memory of 2888 2816 59e8de29b4c037daed8c68ea9cdd7eac9531bdac170e7967ed84e38bd62327c2N.exe 30 PID 2816 wrote to memory of 2888 2816 59e8de29b4c037daed8c68ea9cdd7eac9531bdac170e7967ed84e38bd62327c2N.exe 30 PID 2816 wrote to memory of 2888 2816 59e8de29b4c037daed8c68ea9cdd7eac9531bdac170e7967ed84e38bd62327c2N.exe 30 PID 2816 wrote to memory of 2888 2816 59e8de29b4c037daed8c68ea9cdd7eac9531bdac170e7967ed84e38bd62327c2N.exe 30 PID 1212 wrote to memory of 3048 1212 Explorer.EXE 31 PID 1212 wrote to memory of 3048 1212 Explorer.EXE 31 PID 1212 wrote to memory of 3048 1212 Explorer.EXE 31 PID 1212 wrote to memory of 3048 1212 Explorer.EXE 31 PID 3048 wrote to memory of 2912 3048 explorer.exe 32 PID 3048 wrote to memory of 2912 3048 explorer.exe 32 PID 3048 wrote to memory of 2912 3048 explorer.exe 32 PID 3048 wrote to memory of 2912 3048 explorer.exe 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\59e8de29b4c037daed8c68ea9cdd7eac9531bdac170e7967ed84e38bd62327c2N.exe"C:\Users\Admin\AppData\Local\Temp\59e8de29b4c037daed8c68ea9cdd7eac9531bdac170e7967ed84e38bd62327c2N.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\59e8de29b4c037daed8c68ea9cdd7eac9531bdac170e7967ed84e38bd62327c2N.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2912
-
-