Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
15-06-2024 12:15
Static task
static1
Behavioral task
behavioral1
Sample
206f17d8a641d884bba4bf29413d8c11ececdc220a22777455b23f1cad77dd9d.exe
Resource
win7-20240611-en
General
-
Target
206f17d8a641d884bba4bf29413d8c11ececdc220a22777455b23f1cad77dd9d.exe
-
Size
1.1MB
-
MD5
d345b1de15380a01c02ae2ba9c941a42
-
SHA1
77390e269cee60467364dedcdc4b5156e634d6a8
-
SHA256
206f17d8a641d884bba4bf29413d8c11ececdc220a22777455b23f1cad77dd9d
-
SHA512
4bbb55cd1666dfe1bc13dd315efda50dc3d475fdd942f90834c6c7a61a089cf2d3f39997f249ede6593acc49c4ab1102e555eebec093ab38a95c7b09569fd6f2
-
SSDEEP
24576:zAHnh+eWsN3skA4RV1Hom2KXMmHaungmQu7/d+gIM5:+h+ZkldoPK8Yaun3/d/f
Malware Config
Extracted
formbook
4.1
ss63
catpig.xyz
chatladyanzensei7.site
onewayonepaydroptaxi.com
bima188.lol
wealth-km.online
seepao27200.top
6c958u9.lol
fbyu57ytsd.shop
baranetentegre.com
webaichimie.com
h3k38q2.lol
abicomsrl.com
338kp.vip
rescuecube.com
bubatz-t.com
psgluxuryapartments.com
goodfellowlawfirm.com
bais141.com
imingchu.com
ekzeanjfolzaks.top
hanweixn.com
getwalkapp.com
pharm-resources.com
montessorigpt.com
novaprivatecare.com
3656444.com
h61u4oxx4sraqjm.buzz
vak888.life
q43n.top
sushiommen.com
wvinsiders.com
emran-tahhan.com
manipulatedalgorithms.com
presentiei.shop
juntospelors.com
j0a6doy1x8eyx.com
yexoiup.xyz
bricoarq.com
hnxymaritime.com
selllocaljet.com
h5left513.xyz
65yty.com
everymgs01.com
barbaraht.com
mx5cucs.xyz
checkscamsv.com
smpn1madangsuku2.store
mixefy.shop
gacordewa288.life
srisaiprintpack.com
gasdepo168.com
etancheite-ajaccio.com
slow-man.com
thewhitehorsepub.biz
bay6studio.com
djhtshrtshgrg.lol
xcxocez.shop
games.broker
nudkiss.com
ccconnectglobal.com
wifmilio.com
dpuntada.com
ads8562.shop
diferenciaes.com
fashionchc.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4420-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4420-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1996-19-0x0000000000800000-0x000000000082F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
206f17d8a641d884bba4bf29413d8c11ececdc220a22777455b23f1cad77dd9d.exesvchost.execscript.exedescription pid process target process PID 1508 set thread context of 4420 1508 206f17d8a641d884bba4bf29413d8c11ececdc220a22777455b23f1cad77dd9d.exe svchost.exe PID 4420 set thread context of 3484 4420 svchost.exe Explorer.EXE PID 1996 set thread context of 3484 1996 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
svchost.execscript.exepid process 4420 svchost.exe 4420 svchost.exe 4420 svchost.exe 4420 svchost.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe 1996 cscript.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
206f17d8a641d884bba4bf29413d8c11ececdc220a22777455b23f1cad77dd9d.exesvchost.execscript.exepid process 1508 206f17d8a641d884bba4bf29413d8c11ececdc220a22777455b23f1cad77dd9d.exe 4420 svchost.exe 4420 svchost.exe 4420 svchost.exe 1996 cscript.exe 1996 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
svchost.execscript.exedescription pid process Token: SeDebugPrivilege 4420 svchost.exe Token: SeDebugPrivilege 1996 cscript.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
206f17d8a641d884bba4bf29413d8c11ececdc220a22777455b23f1cad77dd9d.exepid process 1508 206f17d8a641d884bba4bf29413d8c11ececdc220a22777455b23f1cad77dd9d.exe 1508 206f17d8a641d884bba4bf29413d8c11ececdc220a22777455b23f1cad77dd9d.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
206f17d8a641d884bba4bf29413d8c11ececdc220a22777455b23f1cad77dd9d.exepid process 1508 206f17d8a641d884bba4bf29413d8c11ececdc220a22777455b23f1cad77dd9d.exe 1508 206f17d8a641d884bba4bf29413d8c11ececdc220a22777455b23f1cad77dd9d.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3484 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
206f17d8a641d884bba4bf29413d8c11ececdc220a22777455b23f1cad77dd9d.exeExplorer.EXEcscript.exedescription pid process target process PID 1508 wrote to memory of 4420 1508 206f17d8a641d884bba4bf29413d8c11ececdc220a22777455b23f1cad77dd9d.exe svchost.exe PID 1508 wrote to memory of 4420 1508 206f17d8a641d884bba4bf29413d8c11ececdc220a22777455b23f1cad77dd9d.exe svchost.exe PID 1508 wrote to memory of 4420 1508 206f17d8a641d884bba4bf29413d8c11ececdc220a22777455b23f1cad77dd9d.exe svchost.exe PID 1508 wrote to memory of 4420 1508 206f17d8a641d884bba4bf29413d8c11ececdc220a22777455b23f1cad77dd9d.exe svchost.exe PID 3484 wrote to memory of 1996 3484 Explorer.EXE cscript.exe PID 3484 wrote to memory of 1996 3484 Explorer.EXE cscript.exe PID 3484 wrote to memory of 1996 3484 Explorer.EXE cscript.exe PID 1996 wrote to memory of 780 1996 cscript.exe cmd.exe PID 1996 wrote to memory of 780 1996 cscript.exe cmd.exe PID 1996 wrote to memory of 780 1996 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\206f17d8a641d884bba4bf29413d8c11ececdc220a22777455b23f1cad77dd9d.exe"C:\Users\Admin\AppData\Local\Temp\206f17d8a641d884bba4bf29413d8c11ececdc220a22777455b23f1cad77dd9d.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\206f17d8a641d884bba4bf29413d8c11ececdc220a22777455b23f1cad77dd9d.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1508-10-0x0000000000E20000-0x0000000000E24000-memory.dmpFilesize
16KB
-
memory/1996-17-0x0000000000CE0000-0x0000000000D07000-memory.dmpFilesize
156KB
-
memory/1996-19-0x0000000000800000-0x000000000082F000-memory.dmpFilesize
188KB
-
memory/1996-18-0x0000000000CE0000-0x0000000000D07000-memory.dmpFilesize
156KB
-
memory/3484-21-0x0000000008510000-0x000000000864E000-memory.dmpFilesize
1.2MB
-
memory/3484-16-0x0000000008510000-0x000000000864E000-memory.dmpFilesize
1.2MB
-
memory/3484-24-0x000000000AB20000-0x000000000AC8A000-memory.dmpFilesize
1.4MB
-
memory/3484-25-0x000000000AB20000-0x000000000AC8A000-memory.dmpFilesize
1.4MB
-
memory/3484-28-0x000000000AB20000-0x000000000AC8A000-memory.dmpFilesize
1.4MB
-
memory/4420-14-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4420-15-0x0000000001F00000-0x0000000001F15000-memory.dmpFilesize
84KB
-
memory/4420-12-0x0000000001A00000-0x0000000001D4A000-memory.dmpFilesize
3.3MB
-
memory/4420-11-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB