Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
19-06-2024 22:21
Static task
static1
Behavioral task
behavioral1
Sample
Purchase List .exe
Resource
win7-20240419-en
General
-
Target
Purchase List .exe
-
Size
79KB
-
MD5
3462a1a8071d37ce9110eaea3b9cdf50
-
SHA1
ccd57efa4c7330c0d351b62a362f8b7b06e35c92
-
SHA256
6f61a8c2f7e89c87050811f34877179ed753ea5344115e7b059da05c3f1f2b79
-
SHA512
4bc0636b997f78d461be2f9124e1ef83b0ea20e5af7d49b4c6aaf5fe87629aac78064c96007e4d6a8ffd288ba21c967780da365bb301d965278bcd7714272ba3
-
SSDEEP
1536:3YTth9Ag7qBLMeHdLfK6IVoi+pQNafOC3BSmDi:3YD7qFHTIMQQmmO
Malware Config
Extracted
formbook
4.1
45er
depotpulsa.com
k2bilbao.online
bb4uoficial.com
rwc666.club
us-pservice.cyou
tricegottreats.com
zsystems.pro
qudouyin6.com
sfumaturedamore.net
pcetyy.icu
notbokin.online
beqprod.tech
flipbuilding.com
errormitigationzoo.com
zj5u603.xyz
jezzatravel.com
zmdniavysyi.shop
quinnsteele.com
522334.com
outdoorshopping.net
7140k.vip
appmonster.live
rvrentalsusane.com
berry-hut.com
h-m-32.com
aklnk.xyz
project.fail
thelbacollection.com
ternkm.com
331022.xyz
qhr86.com
casvivip.com
f661dsa-dsf564a.biz
holisticfox.com
taobaoo03.com
kursy-parikmaher.store
reignscents.com
wot4x4.com
axoloterosa.com
instzn.site
nn477.xyz
jwsalestx.com
cualuoinuhoang.com
sagehrsuiteindercloud.solutions
2ecxab.vip
lottery99nft.xyz
budakbetingbet43.click
plaay.live
drmediapulsehub.com
bahismax.com
clareleeuwinclark.com
clarimix.com
ssongg11913.cfd
shapoorji-kingstown.com
detoxifysupplements.info
easy100ksidegig.com
abramovatata.online
barillonfo.net
keendeed.com
yunosave.online
pptv05.xyz
malianbeini.net
polariscicuit.com
sahibindencomparamguvend.link
used-cars-99583.bond
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1004-7-0x0000000006200000-0x000000000622F000-memory.dmp formbook behavioral2/memory/1004-13-0x0000000006200000-0x000000000622F000-memory.dmp formbook behavioral2/memory/2092-16-0x0000000000450000-0x000000000047F000-memory.dmp formbook -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Purchase List .exeNETSTAT.EXEdescription pid process target process PID 1004 set thread context of 3480 1004 Purchase List .exe Explorer.EXE PID 2092 set thread context of 3480 2092 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 2092 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
Purchase List .exeNETSTAT.EXEpid process 1004 Purchase List .exe 1004 Purchase List .exe 1004 Purchase List .exe 1004 Purchase List .exe 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE 2092 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Purchase List .exeNETSTAT.EXEpid process 1004 Purchase List .exe 1004 Purchase List .exe 1004 Purchase List .exe 2092 NETSTAT.EXE 2092 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Purchase List .exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 1004 Purchase List .exe Token: SeDebugPrivilege 1004 Purchase List .exe Token: SeDebugPrivilege 2092 NETSTAT.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3480 Explorer.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Explorer.EXENETSTAT.EXEdescription pid process target process PID 3480 wrote to memory of 2092 3480 Explorer.EXE NETSTAT.EXE PID 3480 wrote to memory of 2092 3480 Explorer.EXE NETSTAT.EXE PID 3480 wrote to memory of 2092 3480 Explorer.EXE NETSTAT.EXE PID 2092 wrote to memory of 664 2092 NETSTAT.EXE cmd.exe PID 2092 wrote to memory of 664 2092 NETSTAT.EXE cmd.exe PID 2092 wrote to memory of 664 2092 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase List .exe"C:\Users\Admin\AppData\Local\Temp\Purchase List .exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase List .exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1004-8-0x0000000074630000-0x0000000074DE0000-memory.dmpFilesize
7.7MB
-
memory/1004-13-0x0000000006200000-0x000000000622F000-memory.dmpFilesize
188KB
-
memory/1004-0-0x000000007463E000-0x000000007463F000-memory.dmpFilesize
4KB
-
memory/1004-3-0x0000000004D50000-0x0000000004DE2000-memory.dmpFilesize
584KB
-
memory/1004-4-0x0000000074630000-0x0000000074DE0000-memory.dmpFilesize
7.7MB
-
memory/1004-5-0x0000000004F00000-0x0000000004F0A000-memory.dmpFilesize
40KB
-
memory/1004-6-0x00000000061D0000-0x0000000006202000-memory.dmpFilesize
200KB
-
memory/1004-7-0x0000000006200000-0x000000000622F000-memory.dmpFilesize
188KB
-
memory/1004-2-0x0000000005220000-0x00000000057C4000-memory.dmpFilesize
5.6MB
-
memory/1004-1-0x0000000000340000-0x000000000035A000-memory.dmpFilesize
104KB
-
memory/1004-15-0x0000000074630000-0x0000000074DE0000-memory.dmpFilesize
7.7MB
-
memory/2092-11-0x0000000000600000-0x000000000060B000-memory.dmpFilesize
44KB
-
memory/2092-14-0x0000000000600000-0x000000000060B000-memory.dmpFilesize
44KB
-
memory/2092-16-0x0000000000450000-0x000000000047F000-memory.dmpFilesize
188KB
-
memory/3480-25-0x00000000081C0000-0x0000000008281000-memory.dmpFilesize
772KB
-
memory/3480-18-0x0000000002D10000-0x0000000002DF4000-memory.dmpFilesize
912KB
-
memory/3480-21-0x00000000081C0000-0x0000000008281000-memory.dmpFilesize
772KB
-
memory/3480-22-0x00000000081C0000-0x0000000008281000-memory.dmpFilesize
772KB
-
memory/3480-10-0x0000000002D10000-0x0000000002DF4000-memory.dmpFilesize
912KB