Analysis
-
max time kernel
146s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-06-2024 07:00
Static task
static1
Behavioral task
behavioral1
Sample
IZPnmcCu5EZWa98.exe
Resource
win7-20240611-en
General
-
Target
IZPnmcCu5EZWa98.exe
-
Size
594KB
-
MD5
a5a66a419e31b8a69cf1bd612ec6ffde
-
SHA1
a8e3a66fff21e337ada34998a717aaad0d323fc0
-
SHA256
e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1
-
SHA512
9b797f22e6e1a030255adf506514ae3567fafc7853b5aa116a44bed0e63a62589cfe500cc84b98a62f10132fa14d2137da5c1622320433df71344bdad24faf93
-
SSDEEP
12288:+FIsPALdYGwUQkNVgnkLclbIDCTBr4TXzwgOAju:YIKtGEkNynD5IOTexTj
Malware Config
Extracted
formbook
4.1
dy13
manga-house.com
kjsdhklssk51.xyz
b0ba138.xyz
bt365033.com
ccbsinc.net
mrwine.xyz
nrxkrd527o.xyz
hoshi.social
1912ai.com
serco2020.com
byfchfyr.xyz
imuschestvostorgov.online
austinheafey.com
mrdfa.club
883106.photos
profitablefxmarkets.com
taini00.net
brye.top
ginsm.com
sportglid.com
hdretailllc.com
umeshraja.com
bum-arch.com
carefulapp.com
kjqlq.top
3dsciagames.com
520yhy.com
magahatinu.com
freedompopo.com
directgaragedoor.com
tyupok.xyz
thecrystore.com
camperelektrikde.shop
soloparentconnect.com
sonderfullcoaching.com
jesuscrewofficial.com
oioc.xyz
assineunitv.com
whysco.com
484844.vip
gdctus840t.top
acc-pay.top
bdsmnutzbar.info
sdplat.media
cioncarp4213.com
facecasino2.top
bankablebark.com
gulerweb.online
radheyranidailyproduct.com
fin4d-sl.com
northshorehousekeeping.com
femmeteefatale.com
d0ge6or54x07cfn.xyz
craftwhirl.com
kgfna.biz
real-estate-96841.bond
cfuhtkwo.xyz
nestormediaproduction.com
txglobedev.com
kermoal.dev
yr8gl32.vip
bathroomremodelnearyou.today
nearmeacupuncture.com
chicstop.store
cpuk-finance.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1944-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1944-16-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1692-21-0x0000000000640000-0x000000000066F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
IZPnmcCu5EZWa98.exeIZPnmcCu5EZWa98.exeNETSTAT.EXEdescription pid process target process PID 1696 set thread context of 1944 1696 IZPnmcCu5EZWa98.exe IZPnmcCu5EZWa98.exe PID 1944 set thread context of 3408 1944 IZPnmcCu5EZWa98.exe Explorer.EXE PID 1692 set thread context of 3408 1692 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 1692 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
IZPnmcCu5EZWa98.exeIZPnmcCu5EZWa98.exeNETSTAT.EXEpid process 1696 IZPnmcCu5EZWa98.exe 1696 IZPnmcCu5EZWa98.exe 1944 IZPnmcCu5EZWa98.exe 1944 IZPnmcCu5EZWa98.exe 1944 IZPnmcCu5EZWa98.exe 1944 IZPnmcCu5EZWa98.exe 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE 1692 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
IZPnmcCu5EZWa98.exeNETSTAT.EXEpid process 1944 IZPnmcCu5EZWa98.exe 1944 IZPnmcCu5EZWa98.exe 1944 IZPnmcCu5EZWa98.exe 1692 NETSTAT.EXE 1692 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
IZPnmcCu5EZWa98.exeIZPnmcCu5EZWa98.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 1696 IZPnmcCu5EZWa98.exe Token: SeDebugPrivilege 1944 IZPnmcCu5EZWa98.exe Token: SeDebugPrivilege 1692 NETSTAT.EXE -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
Explorer.EXEpid process 3408 Explorer.EXE 3408 Explorer.EXE 3408 Explorer.EXE -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
Explorer.EXEpid process 3408 Explorer.EXE 3408 Explorer.EXE 3408 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
IZPnmcCu5EZWa98.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 1696 wrote to memory of 1940 1696 IZPnmcCu5EZWa98.exe IZPnmcCu5EZWa98.exe PID 1696 wrote to memory of 1940 1696 IZPnmcCu5EZWa98.exe IZPnmcCu5EZWa98.exe PID 1696 wrote to memory of 1940 1696 IZPnmcCu5EZWa98.exe IZPnmcCu5EZWa98.exe PID 1696 wrote to memory of 1944 1696 IZPnmcCu5EZWa98.exe IZPnmcCu5EZWa98.exe PID 1696 wrote to memory of 1944 1696 IZPnmcCu5EZWa98.exe IZPnmcCu5EZWa98.exe PID 1696 wrote to memory of 1944 1696 IZPnmcCu5EZWa98.exe IZPnmcCu5EZWa98.exe PID 1696 wrote to memory of 1944 1696 IZPnmcCu5EZWa98.exe IZPnmcCu5EZWa98.exe PID 1696 wrote to memory of 1944 1696 IZPnmcCu5EZWa98.exe IZPnmcCu5EZWa98.exe PID 1696 wrote to memory of 1944 1696 IZPnmcCu5EZWa98.exe IZPnmcCu5EZWa98.exe PID 3408 wrote to memory of 1692 3408 Explorer.EXE NETSTAT.EXE PID 3408 wrote to memory of 1692 3408 Explorer.EXE NETSTAT.EXE PID 3408 wrote to memory of 1692 3408 Explorer.EXE NETSTAT.EXE PID 1692 wrote to memory of 2656 1692 NETSTAT.EXE cmd.exe PID 1692 wrote to memory of 2656 1692 NETSTAT.EXE cmd.exe PID 1692 wrote to memory of 2656 1692 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IZPnmcCu5EZWa98.exe"C:\Users\Admin\AppData\Local\Temp\IZPnmcCu5EZWa98.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IZPnmcCu5EZWa98.exe"C:\Users\Admin\AppData\Local\Temp\IZPnmcCu5EZWa98.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\IZPnmcCu5EZWa98.exe"C:\Users\Admin\AppData\Local\Temp\IZPnmcCu5EZWa98.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\IZPnmcCu5EZWa98.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1692-19-0x0000000000050000-0x000000000005B000-memory.dmpFilesize
44KB
-
memory/1692-21-0x0000000000640000-0x000000000066F000-memory.dmpFilesize
188KB
-
memory/1692-20-0x0000000000050000-0x000000000005B000-memory.dmpFilesize
44KB
-
memory/1696-6-0x0000000005920000-0x00000000059BC000-memory.dmpFilesize
624KB
-
memory/1696-1-0x0000000000D10000-0x0000000000DAA000-memory.dmpFilesize
616KB
-
memory/1696-5-0x0000000074E30000-0x00000000755E0000-memory.dmpFilesize
7.7MB
-
memory/1696-0-0x0000000074E3E000-0x0000000074E3F000-memory.dmpFilesize
4KB
-
memory/1696-7-0x00000000059D0000-0x00000000059E2000-memory.dmpFilesize
72KB
-
memory/1696-8-0x0000000008150000-0x0000000008158000-memory.dmpFilesize
32KB
-
memory/1696-9-0x0000000008160000-0x000000000816C000-memory.dmpFilesize
48KB
-
memory/1696-10-0x00000000081F0000-0x0000000008266000-memory.dmpFilesize
472KB
-
memory/1696-4-0x0000000005850000-0x000000000585A000-memory.dmpFilesize
40KB
-
memory/1696-13-0x0000000074E30000-0x00000000755E0000-memory.dmpFilesize
7.7MB
-
memory/1696-2-0x0000000005D50000-0x00000000062F4000-memory.dmpFilesize
5.6MB
-
memory/1696-3-0x00000000057A0000-0x0000000005832000-memory.dmpFilesize
584KB
-
memory/1944-16-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1944-17-0x0000000000B80000-0x0000000000B95000-memory.dmpFilesize
84KB
-
memory/1944-14-0x0000000001000000-0x000000000134A000-memory.dmpFilesize
3.3MB
-
memory/1944-11-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3408-18-0x00000000080C0000-0x000000000825F000-memory.dmpFilesize
1.6MB
-
memory/3408-23-0x00000000080C0000-0x000000000825F000-memory.dmpFilesize
1.6MB
-
memory/3408-28-0x00000000086C0000-0x000000000879F000-memory.dmpFilesize
892KB
-
memory/3408-30-0x00000000086C0000-0x000000000879F000-memory.dmpFilesize
892KB
-
memory/3408-33-0x00000000086C0000-0x000000000879F000-memory.dmpFilesize
892KB