Analysis
-
max time kernel
146s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
04-02-2025 04:34
Static task
static1
Behavioral task
behavioral1
Sample
d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe
Resource
win7-20240729-en
General
-
Target
d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe
-
Size
688KB
-
MD5
c662d081f4cd41e817cc9e246ca54633
-
SHA1
0d1383e23f4b4a9aec5b8a43725af2212a5bdc83
-
SHA256
d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d
-
SHA512
9230b6c03e706740dfd262dea4bf9848b87d92659a5e9431c97ee790c664f31bf20867feb98f6819f8bb24c300ba45e784c94e30f9961443362ff4f7e40b9ac0
-
SSDEEP
12288:vYN/Dswecl9h3/IWs0CFEhNnut872bdnP54UBBTFGLJmqHtJLfPDGlVFSl2p0f+p:bweO3/9/Cq/leTFGdm8tJL6l6AHVLn
Malware Config
Extracted
formbook
4.1
3nop
subur88wap.sbs
tyai1.top
skillbeast.site
kcclassiccars.net
lghomes.net
eijanno.cyou
work-in-usa-60100.bond
268chill.store
bharatwin.biz
cakjitu01.xyz
misafert.xyz
hiretemp.net
lvekz-onearmed.top
amanda-manopo.info
seo-companies22.online
casinowalletth.net
maynrson.monster
bewizi.com
thedronetechhub.shop
car-insurance-93947.bond
javabits.net
dzcodelab.xyz
adeelrao.online
amazing-cruise-pakages.today
wftoutsource.services
stormbeauty.online
a8dz7m5.com
875capehornrdjeffersonny.com
odadesign.site
reejunkremoval7.life
g59q18eq.top
wk0003.top
rtpradar138af.xyz
wnsyl11.vip
nexilis.rest
top-dubai-cruise-deals.today
zoril.lol
englishmaterials.net
uzumluescortg.xyz
dutchpay.net
visprintdesign.biz
kneepain661.shop
xuq-smart-fridge-uj0.rest
jam-nins.com
rentabay.shop
victoryvo2.info
i2c2.tech
wck37.top
refrigerators-69792.bond
abc1network.net
amilia-do-gil.net
806477628.xyz
luxdrive.vip
unika.lat
sculptify.today
winatwork.today
onlinegamehub.online
petnino.club
amtrade.icu
macular-degeneration-39252.bond
argastipster.click
1nvuti.fun
beautifyaura.com
savings-accounts-57645.bond
ok33r.shop
Signatures
-
Formbook family
-
Formbook payload 2 IoCs
resource yara_rule behavioral1/memory/2912-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2616-23-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2732 powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2896 set thread context of 2912 2896 d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe 34 PID 2912 set thread context of 1388 2912 RegSvcs.exe 21 PID 2616 set thread context of 1388 2616 cmmon32.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmmon32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2820 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2896 d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe 2896 d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe 2912 RegSvcs.exe 2912 RegSvcs.exe 2732 powershell.exe 2616 cmmon32.exe 2616 cmmon32.exe 2616 cmmon32.exe 2616 cmmon32.exe 2616 cmmon32.exe 2616 cmmon32.exe 2616 cmmon32.exe 2616 cmmon32.exe 2616 cmmon32.exe 2616 cmmon32.exe 2616 cmmon32.exe 2616 cmmon32.exe 2616 cmmon32.exe 2616 cmmon32.exe 2616 cmmon32.exe 2616 cmmon32.exe 2616 cmmon32.exe 2616 cmmon32.exe 2616 cmmon32.exe 2616 cmmon32.exe 2616 cmmon32.exe 2616 cmmon32.exe 2616 cmmon32.exe 2616 cmmon32.exe 2616 cmmon32.exe 2616 cmmon32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2912 RegSvcs.exe 2912 RegSvcs.exe 2912 RegSvcs.exe 2616 cmmon32.exe 2616 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2896 d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe Token: SeDebugPrivilege 2912 RegSvcs.exe Token: SeDebugPrivilege 2732 powershell.exe Token: SeDebugPrivilege 2616 cmmon32.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2896 wrote to memory of 2732 2896 d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe 30 PID 2896 wrote to memory of 2732 2896 d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe 30 PID 2896 wrote to memory of 2732 2896 d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe 30 PID 2896 wrote to memory of 2732 2896 d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe 30 PID 2896 wrote to memory of 2820 2896 d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe 31 PID 2896 wrote to memory of 2820 2896 d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe 31 PID 2896 wrote to memory of 2820 2896 d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe 31 PID 2896 wrote to memory of 2820 2896 d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe 31 PID 2896 wrote to memory of 2912 2896 d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe 34 PID 2896 wrote to memory of 2912 2896 d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe 34 PID 2896 wrote to memory of 2912 2896 d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe 34 PID 2896 wrote to memory of 2912 2896 d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe 34 PID 2896 wrote to memory of 2912 2896 d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe 34 PID 2896 wrote to memory of 2912 2896 d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe 34 PID 2896 wrote to memory of 2912 2896 d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe 34 PID 2896 wrote to memory of 2912 2896 d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe 34 PID 2896 wrote to memory of 2912 2896 d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe 34 PID 2896 wrote to memory of 2912 2896 d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe 34 PID 1388 wrote to memory of 2616 1388 Explorer.EXE 35 PID 1388 wrote to memory of 2616 1388 Explorer.EXE 35 PID 1388 wrote to memory of 2616 1388 Explorer.EXE 35 PID 1388 wrote to memory of 2616 1388 Explorer.EXE 35 PID 2616 wrote to memory of 1764 2616 cmmon32.exe 36 PID 2616 wrote to memory of 1764 2616 cmmon32.exe 36 PID 2616 wrote to memory of 1764 2616 cmmon32.exe 36 PID 2616 wrote to memory of 1764 2616 cmmon32.exe 36
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe"C:\Users\Admin\AppData\Local\Temp\d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GkYIbr.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GkYIbr" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE2F0.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2820
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2912
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1764
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59b79480cc51a02561a31e013e0644fd4
SHA18df29be30ea33c028be77d11961f1353de165468
SHA25666e2eb9676c79ac3d1ececf9510da16f853e60199ede43f5ffdf9cadd7b0a20d
SHA512d89b352f033b30b9cb97f36e76eb2308d49d045ab09d0db03e392670901f15b1ebb43463b4531800a6842ee411eeba48fe0b1f82839cd5215fb0981609037b2a