Analysis
-
max time kernel
148s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 10:07
Static task
static1
Behavioral task
behavioral1
Sample
kpCSGLBxAw2RnrW.exe
Resource
win7-20240220-en
General
-
Target
kpCSGLBxAw2RnrW.exe
-
Size
792KB
-
MD5
ecd71b32a9f7df1197ea46c0831f5e54
-
SHA1
aa8b0fc56cf3048ccd5f293500cce039305da1a3
-
SHA256
8d39599a31cac2a8cf51d0b0d6dfd6dbafa76dd1cd33d70d0ce6a8235c662a5d
-
SHA512
5ebee458ecc260368c5414d7b303c2fbf5779287ebfc55142d143da3cb10ee564f66ad8f8bed6c7574be4df479178ea149ddf990709547cea2083a932e630d26
-
SSDEEP
12288:J0KE8GILjWLWg/yGcktHAJr5OJKjHYXRLQXTtsepSTVp+:Pc/oEuaqHEwIn
Malware Config
Extracted
formbook
4.1
dy13
manga-house.com
kjsdhklssk51.xyz
b0ba138.xyz
bt365033.com
ccbsinc.net
mrwine.xyz
nrxkrd527o.xyz
hoshi.social
1912ai.com
serco2020.com
byfchfyr.xyz
imuschestvostorgov.online
austinheafey.com
mrdfa.club
883106.photos
profitablefxmarkets.com
taini00.net
brye.top
ginsm.com
sportglid.com
hdretailllc.com
umeshraja.com
bum-arch.com
carefulapp.com
kjqlq.top
3dsciagames.com
520yhy.com
magahatinu.com
freedompopo.com
directgaragedoor.com
tyupok.xyz
thecrystore.com
camperelektrikde.shop
soloparentconnect.com
sonderfullcoaching.com
jesuscrewofficial.com
oioc.xyz
assineunitv.com
whysco.com
484844.vip
gdctus840t.top
acc-pay.top
bdsmnutzbar.info
sdplat.media
cioncarp4213.com
facecasino2.top
bankablebark.com
gulerweb.online
radheyranidailyproduct.com
fin4d-sl.com
northshorehousekeeping.com
femmeteefatale.com
d0ge6or54x07cfn.xyz
craftwhirl.com
kgfna.biz
real-estate-96841.bond
cfuhtkwo.xyz
nestormediaproduction.com
txglobedev.com
kermoal.dev
yr8gl32.vip
bathroomremodelnearyou.today
nearmeacupuncture.com
chicstop.store
cpuk-finance.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4312-10-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4312-16-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1960-23-0x0000000001000000-0x000000000102F000-memory.dmp formbook behavioral2/memory/1960-25-0x0000000001000000-0x000000000102F000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 43 1960 msiexec.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
kpCSGLBxAw2RnrW.exekpCSGLBxAw2RnrW.exemsiexec.exedescription pid process target process PID 1504 set thread context of 4312 1504 kpCSGLBxAw2RnrW.exe kpCSGLBxAw2RnrW.exe PID 4312 set thread context of 3500 4312 kpCSGLBxAw2RnrW.exe Explorer.EXE PID 1960 set thread context of 3500 1960 msiexec.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
kpCSGLBxAw2RnrW.exemsiexec.exepid process 4312 kpCSGLBxAw2RnrW.exe 4312 kpCSGLBxAw2RnrW.exe 4312 kpCSGLBxAw2RnrW.exe 4312 kpCSGLBxAw2RnrW.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe 1960 msiexec.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
kpCSGLBxAw2RnrW.exemsiexec.exepid process 4312 kpCSGLBxAw2RnrW.exe 4312 kpCSGLBxAw2RnrW.exe 4312 kpCSGLBxAw2RnrW.exe 1960 msiexec.exe 1960 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
kpCSGLBxAw2RnrW.exemsiexec.exedescription pid process Token: SeDebugPrivilege 4312 kpCSGLBxAw2RnrW.exe Token: SeDebugPrivilege 1960 msiexec.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
kpCSGLBxAw2RnrW.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1504 wrote to memory of 4312 1504 kpCSGLBxAw2RnrW.exe kpCSGLBxAw2RnrW.exe PID 1504 wrote to memory of 4312 1504 kpCSGLBxAw2RnrW.exe kpCSGLBxAw2RnrW.exe PID 1504 wrote to memory of 4312 1504 kpCSGLBxAw2RnrW.exe kpCSGLBxAw2RnrW.exe PID 1504 wrote to memory of 4312 1504 kpCSGLBxAw2RnrW.exe kpCSGLBxAw2RnrW.exe PID 1504 wrote to memory of 4312 1504 kpCSGLBxAw2RnrW.exe kpCSGLBxAw2RnrW.exe PID 1504 wrote to memory of 4312 1504 kpCSGLBxAw2RnrW.exe kpCSGLBxAw2RnrW.exe PID 3500 wrote to memory of 1960 3500 Explorer.EXE msiexec.exe PID 3500 wrote to memory of 1960 3500 Explorer.EXE msiexec.exe PID 3500 wrote to memory of 1960 3500 Explorer.EXE msiexec.exe PID 1960 wrote to memory of 4576 1960 msiexec.exe cmd.exe PID 1960 wrote to memory of 4576 1960 msiexec.exe cmd.exe PID 1960 wrote to memory of 4576 1960 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kpCSGLBxAw2RnrW.exe"C:\Users\Admin\AppData\Local\Temp\kpCSGLBxAw2RnrW.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kpCSGLBxAw2RnrW.exe"C:\Users\Admin\AppData\Local\Temp\kpCSGLBxAw2RnrW.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\kpCSGLBxAw2RnrW.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1504-12-0x0000000075220000-0x00000000759D0000-memory.dmpFilesize
7.7MB
-
memory/1504-1-0x0000000000660000-0x000000000072C000-memory.dmpFilesize
816KB
-
memory/1504-2-0x0000000005770000-0x0000000005D14000-memory.dmpFilesize
5.6MB
-
memory/1504-3-0x00000000050F0000-0x0000000005182000-memory.dmpFilesize
584KB
-
memory/1504-4-0x0000000075220000-0x00000000759D0000-memory.dmpFilesize
7.7MB
-
memory/1504-5-0x00000000051C0000-0x00000000051CA000-memory.dmpFilesize
40KB
-
memory/1504-6-0x0000000005390000-0x00000000053A0000-memory.dmpFilesize
64KB
-
memory/1504-7-0x00000000055B0000-0x00000000055BC000-memory.dmpFilesize
48KB
-
memory/1504-8-0x00000000056D0000-0x0000000005746000-memory.dmpFilesize
472KB
-
memory/1504-9-0x0000000008250000-0x00000000082EC000-memory.dmpFilesize
624KB
-
memory/1504-0-0x000000007522E000-0x000000007522F000-memory.dmpFilesize
4KB
-
memory/1960-20-0x0000000000B10000-0x0000000000B22000-memory.dmpFilesize
72KB
-
memory/1960-23-0x0000000001000000-0x000000000102F000-memory.dmpFilesize
188KB
-
memory/1960-27-0x0000000003210000-0x00000000032A4000-memory.dmpFilesize
592KB
-
memory/1960-25-0x0000000001000000-0x000000000102F000-memory.dmpFilesize
188KB
-
memory/1960-24-0x0000000002EC0000-0x000000000320A000-memory.dmpFilesize
3.3MB
-
memory/1960-18-0x0000000000B10000-0x0000000000B22000-memory.dmpFilesize
72KB
-
memory/1960-22-0x0000000000B10000-0x0000000000B22000-memory.dmpFilesize
72KB
-
memory/3500-17-0x0000000008680000-0x00000000087E6000-memory.dmpFilesize
1.4MB
-
memory/3500-28-0x0000000008680000-0x00000000087E6000-memory.dmpFilesize
1.4MB
-
memory/3500-31-0x0000000008420000-0x0000000008568000-memory.dmpFilesize
1.3MB
-
memory/3500-32-0x0000000008420000-0x0000000008568000-memory.dmpFilesize
1.3MB
-
memory/3500-35-0x0000000008420000-0x0000000008568000-memory.dmpFilesize
1.3MB
-
memory/4312-10-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4312-16-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4312-14-0x00000000019E0000-0x0000000001D2A000-memory.dmpFilesize
3.3MB
-
memory/4312-15-0x0000000001450000-0x0000000001465000-memory.dmpFilesize
84KB