Analysis
-
max time kernel
147s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
19-06-2024 22:21
Static task
static1
Behavioral task
behavioral1
Sample
Purchase List .exe
Resource
win7-20240419-en
General
-
Target
Purchase List .exe
-
Size
79KB
-
MD5
3462a1a8071d37ce9110eaea3b9cdf50
-
SHA1
ccd57efa4c7330c0d351b62a362f8b7b06e35c92
-
SHA256
6f61a8c2f7e89c87050811f34877179ed753ea5344115e7b059da05c3f1f2b79
-
SHA512
4bc0636b997f78d461be2f9124e1ef83b0ea20e5af7d49b4c6aaf5fe87629aac78064c96007e4d6a8ffd288ba21c967780da365bb301d965278bcd7714272ba3
-
SSDEEP
1536:3YTth9Ag7qBLMeHdLfK6IVoi+pQNafOC3BSmDi:3YD7qFHTIMQQmmO
Malware Config
Extracted
formbook
4.1
45er
depotpulsa.com
k2bilbao.online
bb4uoficial.com
rwc666.club
us-pservice.cyou
tricegottreats.com
zsystems.pro
qudouyin6.com
sfumaturedamore.net
pcetyy.icu
notbokin.online
beqprod.tech
flipbuilding.com
errormitigationzoo.com
zj5u603.xyz
jezzatravel.com
zmdniavysyi.shop
quinnsteele.com
522334.com
outdoorshopping.net
7140k.vip
appmonster.live
rvrentalsusane.com
berry-hut.com
h-m-32.com
aklnk.xyz
project.fail
thelbacollection.com
ternkm.com
331022.xyz
qhr86.com
casvivip.com
f661dsa-dsf564a.biz
holisticfox.com
taobaoo03.com
kursy-parikmaher.store
reignscents.com
wot4x4.com
axoloterosa.com
instzn.site
nn477.xyz
jwsalestx.com
cualuoinuhoang.com
sagehrsuiteindercloud.solutions
2ecxab.vip
lottery99nft.xyz
budakbetingbet43.click
plaay.live
drmediapulsehub.com
bahismax.com
clareleeuwinclark.com
clarimix.com
ssongg11913.cfd
shapoorji-kingstown.com
detoxifysupplements.info
easy100ksidegig.com
abramovatata.online
barillonfo.net
keendeed.com
yunosave.online
pptv05.xyz
malianbeini.net
polariscicuit.com
sahibindencomparamguvend.link
used-cars-99583.bond
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2976-41-0x00000000042D0000-0x00000000042FF000-memory.dmp formbook behavioral1/memory/2976-46-0x00000000042D0000-0x00000000042FF000-memory.dmp formbook behavioral1/memory/2816-50-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2516 cmd.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Purchase List .exeipconfig.exedescription pid process target process PID 2976 set thread context of 1192 2976 Purchase List .exe Explorer.EXE PID 2816 set thread context of 1192 2816 ipconfig.exe Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 2816 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
Purchase List .exeipconfig.exepid process 2976 Purchase List .exe 2976 Purchase List .exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe 2816 ipconfig.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Purchase List .exeipconfig.exepid process 2976 Purchase List .exe 2976 Purchase List .exe 2976 Purchase List .exe 2816 ipconfig.exe 2816 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Purchase List .exeipconfig.exedescription pid process Token: SeDebugPrivilege 2976 Purchase List .exe Token: SeDebugPrivilege 2976 Purchase List .exe Token: SeDebugPrivilege 2816 ipconfig.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Explorer.EXEipconfig.exedescription pid process target process PID 1192 wrote to memory of 2816 1192 Explorer.EXE ipconfig.exe PID 1192 wrote to memory of 2816 1192 Explorer.EXE ipconfig.exe PID 1192 wrote to memory of 2816 1192 Explorer.EXE ipconfig.exe PID 1192 wrote to memory of 2816 1192 Explorer.EXE ipconfig.exe PID 2816 wrote to memory of 2516 2816 ipconfig.exe cmd.exe PID 2816 wrote to memory of 2516 2816 ipconfig.exe cmd.exe PID 2816 wrote to memory of 2516 2816 ipconfig.exe cmd.exe PID 2816 wrote to memory of 2516 2816 ipconfig.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase List .exe"C:\Users\Admin\AppData\Local\Temp\Purchase List .exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase List .exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\Local\Temp\Tar14B0.tmpFilesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
memory/1192-45-0x0000000007860000-0x00000000079E1000-memory.dmpFilesize
1.5MB
-
memory/1192-44-0x0000000003CD0000-0x0000000003DD0000-memory.dmpFilesize
1024KB
-
memory/1192-53-0x0000000007860000-0x00000000079E1000-memory.dmpFilesize
1.5MB
-
memory/2816-47-0x0000000000AF0000-0x0000000000AFA000-memory.dmpFilesize
40KB
-
memory/2816-48-0x0000000000AF0000-0x0000000000AFA000-memory.dmpFilesize
40KB
-
memory/2816-50-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/2976-41-0x00000000042D0000-0x00000000042FF000-memory.dmpFilesize
188KB
-
memory/2976-42-0x00000000741B0000-0x000000007489E000-memory.dmpFilesize
6.9MB
-
memory/2976-0-0x00000000741BE000-0x00000000741BF000-memory.dmpFilesize
4KB
-
memory/2976-40-0x0000000002160000-0x0000000002192000-memory.dmpFilesize
200KB
-
memory/2976-49-0x00000000741B0000-0x000000007489E000-memory.dmpFilesize
6.9MB
-
memory/2976-2-0x00000000741B0000-0x000000007489E000-memory.dmpFilesize
6.9MB
-
memory/2976-46-0x00000000042D0000-0x00000000042FF000-memory.dmpFilesize
188KB
-
memory/2976-1-0x0000000000360000-0x000000000037A000-memory.dmpFilesize
104KB