Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 10:56
Static task
static1
Behavioral task
behavioral1
Sample
4bc87fbfe1c5bc22f4b002a8299d8ca46b8978ce2ca4b6ddaed51234099468a0.exe
Resource
win7-20240508-en
General
-
Target
4bc87fbfe1c5bc22f4b002a8299d8ca46b8978ce2ca4b6ddaed51234099468a0.exe
-
Size
1.1MB
-
MD5
db70135e8dbccf549d724c7c78506a10
-
SHA1
e03021cd4c55f6a3df845611dcafcb9310453c62
-
SHA256
4bc87fbfe1c5bc22f4b002a8299d8ca46b8978ce2ca4b6ddaed51234099468a0
-
SHA512
e3762b27bcd8078606583b041d0407e516e0cf9ef351a77db97ad5d1da39c2f6b52d49960d5d249592aab74171104b602fe8a97e1fb1962b27d0aafc961a4f2e
-
SSDEEP
24576:gAHnh+eWsN3skA4RV1Hom2KXMmHa2pQDQG4aoZcXlj5:Xh+ZkldoPK8Ya2GfRacXv
Malware Config
Extracted
formbook
4.1
ss63
catpig.xyz
chatladyanzensei7.site
onewayonepaydroptaxi.com
bima188.lol
wealth-km.online
seepao27200.top
6c958u9.lol
fbyu57ytsd.shop
baranetentegre.com
webaichimie.com
h3k38q2.lol
abicomsrl.com
338kp.vip
rescuecube.com
bubatz-t.com
psgluxuryapartments.com
goodfellowlawfirm.com
bais141.com
imingchu.com
ekzeanjfolzaks.top
hanweixn.com
getwalkapp.com
pharm-resources.com
montessorigpt.com
novaprivatecare.com
3656444.com
h61u4oxx4sraqjm.buzz
vak888.life
q43n.top
sushiommen.com
wvinsiders.com
emran-tahhan.com
manipulatedalgorithms.com
presentiei.shop
juntospelors.com
j0a6doy1x8eyx.com
yexoiup.xyz
bricoarq.com
hnxymaritime.com
selllocaljet.com
h5left513.xyz
65yty.com
everymgs01.com
barbaraht.com
mx5cucs.xyz
checkscamsv.com
smpn1madangsuku2.store
mixefy.shop
gacordewa288.life
srisaiprintpack.com
gasdepo168.com
etancheite-ajaccio.com
slow-man.com
thewhitehorsepub.biz
bay6studio.com
djhtshrtshgrg.lol
xcxocez.shop
games.broker
nudkiss.com
ccconnectglobal.com
wifmilio.com
dpuntada.com
ads8562.shop
diferenciaes.com
fashionchc.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2460-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2460-16-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1972-20-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
4bc87fbfe1c5bc22f4b002a8299d8ca46b8978ce2ca4b6ddaed51234099468a0.exesvchost.exechkdsk.exedescription pid process target process PID 1708 set thread context of 2460 1708 4bc87fbfe1c5bc22f4b002a8299d8ca46b8978ce2ca4b6ddaed51234099468a0.exe svchost.exe PID 2460 set thread context of 1216 2460 svchost.exe Explorer.EXE PID 1972 set thread context of 1216 1972 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
svchost.exechkdsk.exepid process 2460 svchost.exe 2460 svchost.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe 1972 chkdsk.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
4bc87fbfe1c5bc22f4b002a8299d8ca46b8978ce2ca4b6ddaed51234099468a0.exesvchost.exechkdsk.exepid process 1708 4bc87fbfe1c5bc22f4b002a8299d8ca46b8978ce2ca4b6ddaed51234099468a0.exe 2460 svchost.exe 2460 svchost.exe 2460 svchost.exe 1972 chkdsk.exe 1972 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
svchost.exechkdsk.exedescription pid process Token: SeDebugPrivilege 2460 svchost.exe Token: SeDebugPrivilege 1972 chkdsk.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
4bc87fbfe1c5bc22f4b002a8299d8ca46b8978ce2ca4b6ddaed51234099468a0.exeExplorer.EXEpid process 1708 4bc87fbfe1c5bc22f4b002a8299d8ca46b8978ce2ca4b6ddaed51234099468a0.exe 1708 4bc87fbfe1c5bc22f4b002a8299d8ca46b8978ce2ca4b6ddaed51234099468a0.exe 1216 Explorer.EXE 1216 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
4bc87fbfe1c5bc22f4b002a8299d8ca46b8978ce2ca4b6ddaed51234099468a0.exepid process 1708 4bc87fbfe1c5bc22f4b002a8299d8ca46b8978ce2ca4b6ddaed51234099468a0.exe 1708 4bc87fbfe1c5bc22f4b002a8299d8ca46b8978ce2ca4b6ddaed51234099468a0.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
4bc87fbfe1c5bc22f4b002a8299d8ca46b8978ce2ca4b6ddaed51234099468a0.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1708 wrote to memory of 2460 1708 4bc87fbfe1c5bc22f4b002a8299d8ca46b8978ce2ca4b6ddaed51234099468a0.exe svchost.exe PID 1708 wrote to memory of 2460 1708 4bc87fbfe1c5bc22f4b002a8299d8ca46b8978ce2ca4b6ddaed51234099468a0.exe svchost.exe PID 1708 wrote to memory of 2460 1708 4bc87fbfe1c5bc22f4b002a8299d8ca46b8978ce2ca4b6ddaed51234099468a0.exe svchost.exe PID 1708 wrote to memory of 2460 1708 4bc87fbfe1c5bc22f4b002a8299d8ca46b8978ce2ca4b6ddaed51234099468a0.exe svchost.exe PID 1708 wrote to memory of 2460 1708 4bc87fbfe1c5bc22f4b002a8299d8ca46b8978ce2ca4b6ddaed51234099468a0.exe svchost.exe PID 1216 wrote to memory of 1972 1216 Explorer.EXE chkdsk.exe PID 1216 wrote to memory of 1972 1216 Explorer.EXE chkdsk.exe PID 1216 wrote to memory of 1972 1216 Explorer.EXE chkdsk.exe PID 1216 wrote to memory of 1972 1216 Explorer.EXE chkdsk.exe PID 1972 wrote to memory of 2692 1972 chkdsk.exe cmd.exe PID 1972 wrote to memory of 2692 1972 chkdsk.exe cmd.exe PID 1972 wrote to memory of 2692 1972 chkdsk.exe cmd.exe PID 1972 wrote to memory of 2692 1972 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4bc87fbfe1c5bc22f4b002a8299d8ca46b8978ce2ca4b6ddaed51234099468a0.exe"C:\Users\Admin\AppData\Local\Temp\4bc87fbfe1c5bc22f4b002a8299d8ca46b8978ce2ca4b6ddaed51234099468a0.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\4bc87fbfe1c5bc22f4b002a8299d8ca46b8978ce2ca4b6ddaed51234099468a0.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1216-31-0x0000000006EE0000-0x0000000006FF4000-memory.dmpFilesize
1.1MB
-
memory/1216-28-0x0000000006EE0000-0x0000000006FF4000-memory.dmpFilesize
1.1MB
-
memory/1216-17-0x0000000006DF0000-0x0000000006EDA000-memory.dmpFilesize
936KB
-
memory/1216-27-0x0000000006EE0000-0x0000000006FF4000-memory.dmpFilesize
1.1MB
-
memory/1216-14-0x0000000003CB0000-0x0000000003DB0000-memory.dmpFilesize
1024KB
-
memory/1216-23-0x0000000006DF0000-0x0000000006EDA000-memory.dmpFilesize
936KB
-
memory/1708-10-0x0000000000120000-0x0000000000124000-memory.dmpFilesize
16KB
-
memory/1972-20-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1972-19-0x0000000000A80000-0x0000000000A87000-memory.dmpFilesize
28KB
-
memory/1972-18-0x0000000000A80000-0x0000000000A87000-memory.dmpFilesize
28KB
-
memory/2460-13-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/2460-15-0x0000000000180000-0x0000000000195000-memory.dmpFilesize
84KB
-
memory/2460-16-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2460-11-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB