Analysis
-
max time kernel
152s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
22-06-2024 01:10
Static task
static1
Behavioral task
behavioral1
Sample
MV Starship.exe
Resource
win7-20240611-en
General
-
Target
MV Starship.exe
-
Size
1.1MB
-
MD5
7735fefaf6b16dd97499d0d2016dff1b
-
SHA1
598d7c0eea1ca5fee2f7d8c052a01225bcd72761
-
SHA256
3cc81b7a9a59609e3267d06fad726352660b7c2e5c896c193939aff4744d499d
-
SHA512
4df13f92972522e14497ad16051b876983caf97810bb00128030b0121289eb11cf4774b5f458ae04a0ba3b7ceb4a2b6de913dddfef357fd8a164eff3093c4ad9
-
SSDEEP
24576:IAHnh+eWsN3skA4RV1Hom2KXMmHaxnRjGf9UYfLOKlD6J1y5:Ph+ZkldoPK8YaxnRjGSYfLdRN
Malware Config
Extracted
formbook
4.1
ty31
jejakunik.com
inb319.com
jifsjn.buzz
gkyukon.site
43443.cfd
cogil69id.com
oeaog.com
lpgatm.com
mymarketsales.com
tomclk.icu
404417.online
nysconstruction.com
ourwisequote.com
ahsanadvisory.com
ottawaherps.com
forevermust.com
apartments-for-rent-47679.bond
kdasjijaksdd.icu
buthaynah.com
manggungjayakanopi.com
cookygan.com
regalessencebeautystudio.com
material.directory
szxart.xyz
ykdbyjk.xyz
hankahve.com
tiituitdsa.net
avantbrews.com
springpace.com
seriesjeans.com
technikwunder.com
angellsonline.com
soujany.com
buysleepp.com
voltvanbage.com
qdhaohuisuan.com
bluedolphinshop.com
aguanegocios.com
abstractdiffusion.com
bahisanaliz16.xyz
weight-loss-34761.bond
x216.icu
twmallll.com
poalsdji.buzz
agtsolargrowth.biz
pixelcloudtec.com
0512155.com
mypsychedeliceducation.com
0306951.top
screw-air-compressor.com
10140wildhawk.com
antheaclinic.com
tppclients.com
needpickleball.com
iraq-visions.com
rtpbonanza138.skin
wjzjs.com
dw6msr8.icu
lepriossa.com
tiktokglobal.shop
youwu.autos
tripshipglobal.com
ncpekingducktogo.com
winbd24.com
xiaobanhome.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/464-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/464-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/548-20-0x0000000000CB0000-0x0000000000CDF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
MV Starship.exesvchost.exesystray.exedescription pid process target process PID 5020 set thread context of 464 5020 MV Starship.exe svchost.exe PID 464 set thread context of 3240 464 svchost.exe Explorer.EXE PID 548 set thread context of 3240 548 systray.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
svchost.exesystray.exepid process 464 svchost.exe 464 svchost.exe 464 svchost.exe 464 svchost.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
MV Starship.exesvchost.exesystray.exepid process 5020 MV Starship.exe 464 svchost.exe 464 svchost.exe 464 svchost.exe 548 systray.exe 548 systray.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
svchost.exesystray.exedescription pid process Token: SeDebugPrivilege 464 svchost.exe Token: SeDebugPrivilege 548 systray.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
MV Starship.exepid process 5020 MV Starship.exe 5020 MV Starship.exe 5020 MV Starship.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
MV Starship.exepid process 5020 MV Starship.exe 5020 MV Starship.exe 5020 MV Starship.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
MV Starship.exeExplorer.EXEsystray.exedescription pid process target process PID 5020 wrote to memory of 464 5020 MV Starship.exe svchost.exe PID 5020 wrote to memory of 464 5020 MV Starship.exe svchost.exe PID 5020 wrote to memory of 464 5020 MV Starship.exe svchost.exe PID 5020 wrote to memory of 464 5020 MV Starship.exe svchost.exe PID 3240 wrote to memory of 548 3240 Explorer.EXE systray.exe PID 3240 wrote to memory of 548 3240 Explorer.EXE systray.exe PID 3240 wrote to memory of 548 3240 Explorer.EXE systray.exe PID 548 wrote to memory of 3824 548 systray.exe cmd.exe PID 548 wrote to memory of 3824 548 systray.exe cmd.exe PID 548 wrote to memory of 3824 548 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MV Starship.exe"C:\Users\Admin\AppData\Local\Temp\MV Starship.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\MV Starship.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3932 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/464-15-0x00000000009C0000-0x00000000009D4000-memory.dmpFilesize
80KB
-
memory/464-11-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/464-12-0x0000000001500000-0x000000000184A000-memory.dmpFilesize
3.3MB
-
memory/464-14-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/548-17-0x0000000000C20000-0x0000000000C26000-memory.dmpFilesize
24KB
-
memory/548-19-0x0000000000C20000-0x0000000000C26000-memory.dmpFilesize
24KB
-
memory/548-20-0x0000000000CB0000-0x0000000000CDF000-memory.dmpFilesize
188KB
-
memory/3240-16-0x00000000087F0000-0x000000000892F000-memory.dmpFilesize
1.2MB
-
memory/3240-22-0x00000000087F0000-0x000000000892F000-memory.dmpFilesize
1.2MB
-
memory/3240-25-0x0000000008A20000-0x0000000008B66000-memory.dmpFilesize
1.3MB
-
memory/3240-26-0x0000000008A20000-0x0000000008B66000-memory.dmpFilesize
1.3MB
-
memory/3240-29-0x0000000008A20000-0x0000000008B66000-memory.dmpFilesize
1.3MB
-
memory/5020-10-0x0000000000BE0000-0x0000000000BE4000-memory.dmpFilesize
16KB