Analysis
-
max time kernel
145s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 06:19
Static task
static1
Behavioral task
behavioral1
Sample
lhDCR5RvXwLbWQu.exe
Resource
win7-20240611-en
General
-
Target
lhDCR5RvXwLbWQu.exe
-
Size
903KB
-
MD5
66bbfd82c0b1bdd60dca1d71945b42c2
-
SHA1
467d4125a380f1672983c51f1a4706f039b890af
-
SHA256
780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5
-
SHA512
ca85a5e898139ad5e437a66c99baee9c8408773a214d37df02bad4388f8d5ab30cb240985b8869c1e36d971c9615da236e90de20d3a3e091b13caded01fa2bbf
-
SSDEEP
12288:4SiJkBoxXIFykQzrAVZK3B6xNYUCSPGnsV9nJyJ+XwrwILkz4ZTyrhbjjq5jCkj4:37wWg4NtCSPGGkUNW2rJjq5uM4
Malware Config
Extracted
formbook
4.1
dy13
manga-house.com
kjsdhklssk51.xyz
b0ba138.xyz
bt365033.com
ccbsinc.net
mrwine.xyz
nrxkrd527o.xyz
hoshi.social
1912ai.com
serco2020.com
byfchfyr.xyz
imuschestvostorgov.online
austinheafey.com
mrdfa.club
883106.photos
profitablefxmarkets.com
taini00.net
brye.top
ginsm.com
sportglid.com
hdretailllc.com
umeshraja.com
bum-arch.com
carefulapp.com
kjqlq.top
3dsciagames.com
520yhy.com
magahatinu.com
freedompopo.com
directgaragedoor.com
tyupok.xyz
thecrystore.com
camperelektrikde.shop
soloparentconnect.com
sonderfullcoaching.com
jesuscrewofficial.com
oioc.xyz
assineunitv.com
whysco.com
484844.vip
gdctus840t.top
acc-pay.top
bdsmnutzbar.info
sdplat.media
cioncarp4213.com
facecasino2.top
bankablebark.com
gulerweb.online
radheyranidailyproduct.com
fin4d-sl.com
northshorehousekeeping.com
femmeteefatale.com
d0ge6or54x07cfn.xyz
craftwhirl.com
kgfna.biz
real-estate-96841.bond
cfuhtkwo.xyz
nestormediaproduction.com
txglobedev.com
kermoal.dev
yr8gl32.vip
bathroomremodelnearyou.today
nearmeacupuncture.com
chicstop.store
cpuk-finance.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3508-13-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3508-18-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3508-22-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4452-27-0x0000000000260000-0x000000000028F000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
lhDCR5RvXwLbWQu.exelhDCR5RvXwLbWQu.execscript.exedescription pid process target process PID 1828 set thread context of 3508 1828 lhDCR5RvXwLbWQu.exe lhDCR5RvXwLbWQu.exe PID 3508 set thread context of 3520 3508 lhDCR5RvXwLbWQu.exe Explorer.EXE PID 3508 set thread context of 3520 3508 lhDCR5RvXwLbWQu.exe Explorer.EXE PID 4452 set thread context of 3520 4452 cscript.exe Explorer.EXE -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
lhDCR5RvXwLbWQu.exelhDCR5RvXwLbWQu.execscript.exepid process 1828 lhDCR5RvXwLbWQu.exe 1828 lhDCR5RvXwLbWQu.exe 1828 lhDCR5RvXwLbWQu.exe 1828 lhDCR5RvXwLbWQu.exe 1828 lhDCR5RvXwLbWQu.exe 1828 lhDCR5RvXwLbWQu.exe 3508 lhDCR5RvXwLbWQu.exe 3508 lhDCR5RvXwLbWQu.exe 3508 lhDCR5RvXwLbWQu.exe 3508 lhDCR5RvXwLbWQu.exe 3508 lhDCR5RvXwLbWQu.exe 3508 lhDCR5RvXwLbWQu.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe 4452 cscript.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
lhDCR5RvXwLbWQu.execscript.exepid process 3508 lhDCR5RvXwLbWQu.exe 3508 lhDCR5RvXwLbWQu.exe 3508 lhDCR5RvXwLbWQu.exe 3508 lhDCR5RvXwLbWQu.exe 4452 cscript.exe 4452 cscript.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
lhDCR5RvXwLbWQu.exelhDCR5RvXwLbWQu.execscript.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1828 lhDCR5RvXwLbWQu.exe Token: SeDebugPrivilege 3508 lhDCR5RvXwLbWQu.exe Token: SeDebugPrivilege 4452 cscript.exe Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3520 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
lhDCR5RvXwLbWQu.exeExplorer.EXEcscript.exedescription pid process target process PID 1828 wrote to memory of 4060 1828 lhDCR5RvXwLbWQu.exe lhDCR5RvXwLbWQu.exe PID 1828 wrote to memory of 4060 1828 lhDCR5RvXwLbWQu.exe lhDCR5RvXwLbWQu.exe PID 1828 wrote to memory of 4060 1828 lhDCR5RvXwLbWQu.exe lhDCR5RvXwLbWQu.exe PID 1828 wrote to memory of 2356 1828 lhDCR5RvXwLbWQu.exe lhDCR5RvXwLbWQu.exe PID 1828 wrote to memory of 2356 1828 lhDCR5RvXwLbWQu.exe lhDCR5RvXwLbWQu.exe PID 1828 wrote to memory of 2356 1828 lhDCR5RvXwLbWQu.exe lhDCR5RvXwLbWQu.exe PID 1828 wrote to memory of 2116 1828 lhDCR5RvXwLbWQu.exe lhDCR5RvXwLbWQu.exe PID 1828 wrote to memory of 2116 1828 lhDCR5RvXwLbWQu.exe lhDCR5RvXwLbWQu.exe PID 1828 wrote to memory of 2116 1828 lhDCR5RvXwLbWQu.exe lhDCR5RvXwLbWQu.exe PID 1828 wrote to memory of 3508 1828 lhDCR5RvXwLbWQu.exe lhDCR5RvXwLbWQu.exe PID 1828 wrote to memory of 3508 1828 lhDCR5RvXwLbWQu.exe lhDCR5RvXwLbWQu.exe PID 1828 wrote to memory of 3508 1828 lhDCR5RvXwLbWQu.exe lhDCR5RvXwLbWQu.exe PID 1828 wrote to memory of 3508 1828 lhDCR5RvXwLbWQu.exe lhDCR5RvXwLbWQu.exe PID 1828 wrote to memory of 3508 1828 lhDCR5RvXwLbWQu.exe lhDCR5RvXwLbWQu.exe PID 1828 wrote to memory of 3508 1828 lhDCR5RvXwLbWQu.exe lhDCR5RvXwLbWQu.exe PID 3520 wrote to memory of 4452 3520 Explorer.EXE cscript.exe PID 3520 wrote to memory of 4452 3520 Explorer.EXE cscript.exe PID 3520 wrote to memory of 4452 3520 Explorer.EXE cscript.exe PID 4452 wrote to memory of 3252 4452 cscript.exe cmd.exe PID 4452 wrote to memory of 3252 4452 cscript.exe cmd.exe PID 4452 wrote to memory of 3252 4452 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lhDCR5RvXwLbWQu.exe"C:\Users\Admin\AppData\Local\Temp\lhDCR5RvXwLbWQu.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lhDCR5RvXwLbWQu.exe"C:\Users\Admin\AppData\Local\Temp\lhDCR5RvXwLbWQu.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\lhDCR5RvXwLbWQu.exe"C:\Users\Admin\AppData\Local\Temp\lhDCR5RvXwLbWQu.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\lhDCR5RvXwLbWQu.exe"C:\Users\Admin\AppData\Local\Temp\lhDCR5RvXwLbWQu.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\lhDCR5RvXwLbWQu.exe"C:\Users\Admin\AppData\Local\Temp\lhDCR5RvXwLbWQu.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\lhDCR5RvXwLbWQu.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1828-15-0x00000000752A0000-0x0000000075A50000-memory.dmpFilesize
7.7MB
-
memory/1828-2-0x0000000005370000-0x0000000005914000-memory.dmpFilesize
5.6MB
-
memory/1828-0-0x00000000752AE000-0x00000000752AF000-memory.dmpFilesize
4KB
-
memory/1828-3-0x0000000004CD0000-0x0000000004D62000-memory.dmpFilesize
584KB
-
memory/1828-4-0x0000000004C80000-0x0000000004C8A000-memory.dmpFilesize
40KB
-
memory/1828-5-0x0000000004FC0000-0x000000000505C000-memory.dmpFilesize
624KB
-
memory/1828-6-0x00000000752A0000-0x0000000075A50000-memory.dmpFilesize
7.7MB
-
memory/1828-7-0x0000000005E50000-0x000000000637C000-memory.dmpFilesize
5.2MB
-
memory/1828-8-0x0000000004F90000-0x0000000004FA2000-memory.dmpFilesize
72KB
-
memory/1828-9-0x0000000004FB0000-0x0000000004FB8000-memory.dmpFilesize
32KB
-
memory/1828-10-0x00000000050E0000-0x00000000050EC000-memory.dmpFilesize
48KB
-
memory/1828-11-0x00000000088C0000-0x0000000008944000-memory.dmpFilesize
528KB
-
memory/1828-12-0x0000000008DC0000-0x0000000008E36000-memory.dmpFilesize
472KB
-
memory/1828-1-0x0000000000190000-0x0000000000278000-memory.dmpFilesize
928KB
-
memory/3508-13-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3508-16-0x00000000012B0000-0x00000000015FA000-memory.dmpFilesize
3.3MB
-
memory/3508-19-0x0000000001240000-0x0000000001255000-memory.dmpFilesize
84KB
-
memory/3508-23-0x0000000001700000-0x0000000001715000-memory.dmpFilesize
84KB
-
memory/3508-18-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3508-22-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3520-20-0x0000000008380000-0x00000000084C1000-memory.dmpFilesize
1.3MB
-
memory/3520-35-0x0000000002770000-0x0000000002853000-memory.dmpFilesize
908KB
-
memory/3520-28-0x0000000008380000-0x00000000084C1000-memory.dmpFilesize
1.3MB
-
memory/3520-30-0x0000000002770000-0x0000000002853000-memory.dmpFilesize
908KB
-
memory/3520-31-0x000000000A1D0000-0x000000000A367000-memory.dmpFilesize
1.6MB
-
memory/3520-32-0x0000000002770000-0x0000000002853000-memory.dmpFilesize
908KB
-
memory/3520-24-0x000000000A1D0000-0x000000000A367000-memory.dmpFilesize
1.6MB
-
memory/4452-25-0x0000000000210000-0x0000000000237000-memory.dmpFilesize
156KB
-
memory/4452-26-0x0000000000210000-0x0000000000237000-memory.dmpFilesize
156KB
-
memory/4452-27-0x0000000000260000-0x000000000028F000-memory.dmpFilesize
188KB