Overview
overview
10Static
static
10PRE-ADVISE...49.exe
windows7-x64
10PRE-ADVISE...49.exe
windows10-2004-x64
10New P.O.exe
windows7-x64
10New P.O.exe
windows10-2004-x64
10174d337dc9...e8.exe
windows7-x64
10174d337dc9...e8.exe
windows10-2004-x64
31acc6fd285...05.elf
debian-12-armhf
9JDtnp2mcrQvXDeo.exe
windows7-x64
10JDtnp2mcrQvXDeo.exe
windows10-2004-x64
1073c5c4b126...f0.exe
windows7-x64
1073c5c4b126...f0.exe
windows10-2004-x64
10PR-ZWL 07...O).exe
windows7-x64
8PR-ZWL 07...O).exe
windows10-2004-x64
8SOA pdf.exe
windows7-x64
10SOA pdf.exe
windows10-2004-x64
108c56b0f77a...4a.exe
windows7-x64
108c56b0f77a...4a.exe
windows10-2004-x64
10a7756cd5c5...c1.elf
debian-12-armhf
1ac6ea6239a...de.exe
windows7-x64
7ac6ea6239a...de.exe
windows10-2004-x64
7c55761decb...27.elf
ubuntu-22.04-amd64
c79a98c3a1...73.exe
windows7-x64
8c79a98c3a1...73.exe
windows10-2004-x64
8d30f8c9b89...30.doc
windows7-x64
4d30f8c9b89...30.doc
windows10-2004-x64
1d38f510bc1...26.exe
windows7-x64
1d38f510bc1...26.exe
windows10-2004-x64
1d623c0b8d9...cf.bat
windows7-x64
1d623c0b8d9...cf.bat
windows10-2004-x64
1RFQ-2402-3572.exe
windows7-x64
10RFQ-2402-3572.exe
windows10-2004-x64
10INV&PL.exe
windows7-x64
8Analysis
-
max time kernel
146s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 02:17
Behavioral task
behavioral1
Sample
PRE-ADVISE PO 45202549.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
PRE-ADVISE PO 45202549.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
New P.O.exe
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
New P.O.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
1acc6fd2850bf39084454669685e98ad49bfab90fcafe1e91f49caf4af182405.elf
Resource
debian12-armhf-20240418-en
Behavioral task
behavioral8
Sample
JDtnp2mcrQvXDeo.exe
Resource
win7-20240221-en
Behavioral task
behavioral9
Sample
JDtnp2mcrQvXDeo.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral10
Sample
73c5c4b12646631dbf1e8adf10b52b8635b34d02d753d3fe829bd41210f547f0.exe
Resource
win7-20231129-en
Behavioral task
behavioral11
Sample
73c5c4b12646631dbf1e8adf10b52b8635b34d02d753d3fe829bd41210f547f0.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
PR-ZWL 07364G49574(Revised PO).exe
Resource
win7-20240508-en
Behavioral task
behavioral13
Sample
PR-ZWL 07364G49574(Revised PO).exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral14
Sample
SOA pdf.exe
Resource
win7-20240508-en
Behavioral task
behavioral15
Sample
SOA pdf.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral16
Sample
8c56b0f77abb15a25ffdd9e0700475d339c640c4f40094a8bc97223d850c1f4a.exe
Resource
win7-20240419-en
Behavioral task
behavioral17
Sample
8c56b0f77abb15a25ffdd9e0700475d339c640c4f40094a8bc97223d850c1f4a.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
a7756cd5c50f47896fe717bf2ae620f8f3b451e84a70f983c6d79c4f7ad63dc1.elf
Resource
debian12-armhf-20240221-en
Behavioral task
behavioral19
Sample
ac6ea6239a4b82d24b823f1a50ab207652024f33726730d4d7b791fcb2fec7de.exe
Resource
win7-20240611-en
Behavioral task
behavioral20
Sample
ac6ea6239a4b82d24b823f1a50ab207652024f33726730d4d7b791fcb2fec7de.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
c55761decbe72089e99909a2906c693b159c4b31564d8b795f8821b2683dba27.elf
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral22
Sample
c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe
Resource
win7-20240221-en
Behavioral task
behavioral23
Sample
c79a98c3a11afabf39a52a12cb7d1ee6cf4f9df5c7bc54aa969296f50b75aa73.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral24
Sample
d30f8c9b89f3bd4630fdfb8b9c5390e7e828846cc99d1ba179a2bee7886e6830.doc
Resource
win7-20240220-en
Behavioral task
behavioral25
Sample
d30f8c9b89f3bd4630fdfb8b9c5390e7e828846cc99d1ba179a2bee7886e6830.doc
Resource
win10v2004-20240508-en
Behavioral task
behavioral26
Sample
d38f510bc1a2f2e389f22e0a8609f531472d1b367111f74de9109b49c91cbe26.exe
Resource
win7-20240508-en
Behavioral task
behavioral27
Sample
d38f510bc1a2f2e389f22e0a8609f531472d1b367111f74de9109b49c91cbe26.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral28
Sample
d623c0b8d9d662362b6347c6862217221e660082ef0a9bff77a83a6efffda4cf.bat
Resource
win7-20240508-en
Behavioral task
behavioral29
Sample
d623c0b8d9d662362b6347c6862217221e660082ef0a9bff77a83a6efffda4cf.bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral30
Sample
RFQ-2402-3572.exe
Resource
win7-20240419-en
Behavioral task
behavioral31
Sample
RFQ-2402-3572.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral32
Sample
INV&PL.exe
Resource
win7-20231129-en
General
-
Target
JDtnp2mcrQvXDeo.exe
-
Size
652KB
-
MD5
3aee87433e931e3a5fc22f57f428fcbb
-
SHA1
f6495dd08bdc9d8d049e1e898800bd8d9311a549
-
SHA256
709cb8b2628d52b597a87f74bd8867dd40cb54bd48940d159dd11930d9d76472
-
SHA512
8f12394205a9940feaf4d350f2d4d6f3adb693e00a56ebb8933c6cb6b062f419e4aaf0f4ccccd507bc1cfe042bd9ac0ee669d52e29daebd2c8465a3c709e4f24
-
SSDEEP
12288:G3qyJMjKlhpPEe0XTfBSH9GuIwY4HwHDohzRqrewL5aArEpVLsGY:G6OFh9EVckHBshMreWgWJ
Malware Config
Extracted
formbook
4.1
cr12
nff1291.com
satyainfra.com
hechiceradeamores.com
jfgminimalist.com
qut68q.com
pedandmore.com
sugardefender24-usa.us
somalse.com
lotusluxecandle.com
certificadobassetpro.com
veryaroma.com
thehistoryofindia.in
33155.cc
terastudy.net
84031.vip
heilsambegegnen.com
horizon-rg.info
junongpei.website
winstons.club
henslotalt.us
home-care-72875.bond
elmetaversal.com
thetrendingproduct.com
kiki-hello-jury.com
fertami.info
free-cell-phones-en-arena.sbs
emilogiska.com
airexam.in
masters-of-1.com
othersidings.com
fullpaw.com
xmmtrader.com
astronomersparadise.net
cert.agency
pools-97641.bond
forexsignals-trading.com
bxsmediaconsulting.com
perfectedskincare.com
footresort.com
warehouse-inventory-80963.bond
purifygenius.com
bolinkpass.club
velleclub.com
epuar.com
winningpickleballshots.com
spiaggia.club
kadinzuri.com
keyboards-280323.cfd
africanfemalefounders.club
tkoelectriical.com
wg5688.com
properrr.com
fortune-tiger-rede.com
65302.vip
psychologyzerodegrees.today
top99bet4d.site
priuswuxi.com
carneden.com
ptwix.xyz
furniture-70925.bond
064817.com
ferradaoffroad.com
pix2click.life
jurj.xyz
spiritualpath.info
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral9/memory/4496-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral9/memory/4496-16-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral9/memory/4496-20-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral9/memory/388-25-0x0000000000D50000-0x0000000000D7F000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
JDtnp2mcrQvXDeo.exeJDtnp2mcrQvXDeo.execmstp.exedescription pid process target process PID 2672 set thread context of 4496 2672 JDtnp2mcrQvXDeo.exe JDtnp2mcrQvXDeo.exe PID 4496 set thread context of 3452 4496 JDtnp2mcrQvXDeo.exe Explorer.EXE PID 4496 set thread context of 3452 4496 JDtnp2mcrQvXDeo.exe Explorer.EXE PID 388 set thread context of 3452 388 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
JDtnp2mcrQvXDeo.execmstp.exepid process 4496 JDtnp2mcrQvXDeo.exe 4496 JDtnp2mcrQvXDeo.exe 4496 JDtnp2mcrQvXDeo.exe 4496 JDtnp2mcrQvXDeo.exe 4496 JDtnp2mcrQvXDeo.exe 4496 JDtnp2mcrQvXDeo.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe 388 cmstp.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
JDtnp2mcrQvXDeo.execmstp.exepid process 4496 JDtnp2mcrQvXDeo.exe 4496 JDtnp2mcrQvXDeo.exe 4496 JDtnp2mcrQvXDeo.exe 4496 JDtnp2mcrQvXDeo.exe 388 cmstp.exe 388 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
JDtnp2mcrQvXDeo.execmstp.exedescription pid process Token: SeDebugPrivilege 4496 JDtnp2mcrQvXDeo.exe Token: SeDebugPrivilege 388 cmstp.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3452 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
JDtnp2mcrQvXDeo.exeExplorer.EXEcmstp.exedescription pid process target process PID 2672 wrote to memory of 4496 2672 JDtnp2mcrQvXDeo.exe JDtnp2mcrQvXDeo.exe PID 2672 wrote to memory of 4496 2672 JDtnp2mcrQvXDeo.exe JDtnp2mcrQvXDeo.exe PID 2672 wrote to memory of 4496 2672 JDtnp2mcrQvXDeo.exe JDtnp2mcrQvXDeo.exe PID 2672 wrote to memory of 4496 2672 JDtnp2mcrQvXDeo.exe JDtnp2mcrQvXDeo.exe PID 2672 wrote to memory of 4496 2672 JDtnp2mcrQvXDeo.exe JDtnp2mcrQvXDeo.exe PID 2672 wrote to memory of 4496 2672 JDtnp2mcrQvXDeo.exe JDtnp2mcrQvXDeo.exe PID 3452 wrote to memory of 388 3452 Explorer.EXE cmstp.exe PID 3452 wrote to memory of 388 3452 Explorer.EXE cmstp.exe PID 3452 wrote to memory of 388 3452 Explorer.EXE cmstp.exe PID 388 wrote to memory of 3500 388 cmstp.exe cmd.exe PID 388 wrote to memory of 3500 388 cmstp.exe cmd.exe PID 388 wrote to memory of 3500 388 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JDtnp2mcrQvXDeo.exe"C:\Users\Admin\AppData\Local\Temp\JDtnp2mcrQvXDeo.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JDtnp2mcrQvXDeo.exe"C:\Users\Admin\AppData\Local\Temp\JDtnp2mcrQvXDeo.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\JDtnp2mcrQvXDeo.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/388-24-0x0000000000310000-0x0000000000326000-memory.dmpFilesize
88KB
-
memory/388-25-0x0000000000D50000-0x0000000000D7F000-memory.dmpFilesize
188KB
-
memory/388-23-0x0000000000310000-0x0000000000326000-memory.dmpFilesize
88KB
-
memory/2672-7-0x0000000005520000-0x000000000552E000-memory.dmpFilesize
56KB
-
memory/2672-1-0x0000000000610000-0x00000000006B6000-memory.dmpFilesize
664KB
-
memory/2672-4-0x00000000050B0000-0x00000000050BA000-memory.dmpFilesize
40KB
-
memory/2672-6-0x00000000054E0000-0x00000000054F6000-memory.dmpFilesize
88KB
-
memory/2672-0-0x0000000074A1E000-0x0000000074A1F000-memory.dmpFilesize
4KB
-
memory/2672-8-0x0000000005740000-0x0000000005750000-memory.dmpFilesize
64KB
-
memory/2672-9-0x0000000006320000-0x0000000006396000-memory.dmpFilesize
472KB
-
memory/2672-10-0x00000000065F0000-0x000000000668C000-memory.dmpFilesize
624KB
-
memory/2672-5-0x0000000074A10000-0x00000000751C0000-memory.dmpFilesize
7.7MB
-
memory/2672-13-0x0000000074A10000-0x00000000751C0000-memory.dmpFilesize
7.7MB
-
memory/2672-2-0x0000000005760000-0x0000000005D04000-memory.dmpFilesize
5.6MB
-
memory/2672-3-0x00000000050D0000-0x0000000005162000-memory.dmpFilesize
584KB
-
memory/3452-26-0x0000000008C60000-0x0000000008DC7000-memory.dmpFilesize
1.4MB
-
memory/3452-18-0x0000000008C60000-0x0000000008DC7000-memory.dmpFilesize
1.4MB
-
memory/3452-33-0x0000000004B60000-0x0000000004C05000-memory.dmpFilesize
660KB
-
memory/3452-30-0x0000000004B60000-0x0000000004C05000-memory.dmpFilesize
660KB
-
memory/3452-22-0x0000000009370000-0x0000000009507000-memory.dmpFilesize
1.6MB
-
memory/3452-28-0x0000000009370000-0x0000000009507000-memory.dmpFilesize
1.6MB
-
memory/3452-29-0x0000000004B60000-0x0000000004C05000-memory.dmpFilesize
660KB
-
memory/4496-21-0x0000000001120000-0x0000000001134000-memory.dmpFilesize
80KB
-
memory/4496-11-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4496-14-0x0000000001280000-0x00000000015CA000-memory.dmpFilesize
3.3MB
-
memory/4496-17-0x0000000000DB0000-0x0000000000DC4000-memory.dmpFilesize
80KB
-
memory/4496-16-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4496-20-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB