Resubmissions
01-07-2024 19:19
240701-x1p5raydmj 10Analysis
-
max time kernel
145s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 19:19
Static task
static1
Behavioral task
behavioral1
Sample
mQY9ka5sW6hv2Ri.exe
Resource
win7-20240508-en
General
-
Target
mQY9ka5sW6hv2Ri.exe
-
Size
584KB
-
MD5
e97620420d37596704d9f4fa70303453
-
SHA1
533b98b289ba07c446f8350950fdbee2ab39dcf2
-
SHA256
a5a3067e6a3c4e957152655df5c68ce4db77f8308feff43c53e7535031033be5
-
SHA512
a5ee774c492216568a9c16768cf83188cc261e1f4888cbe4aff9717bc13bccade2594ffe04bac35367213e8b3288e2671841320d529aa5f5a168e1756c6c7ed3
-
SSDEEP
12288:wanv6lRPM97SMRgqbFwWAEY/Z1NJQtUa2e0szSoMXGjxbFtACUYsOl7n9W1ei:5IRombqbFwWrYn7Q32e0GSUptACOOBn9
Malware Config
Extracted
formbook
4.1
dy13
manga-house.com
kjsdhklssk51.xyz
b0ba138.xyz
bt365033.com
ccbsinc.net
mrwine.xyz
nrxkrd527o.xyz
hoshi.social
1912ai.com
serco2020.com
byfchfyr.xyz
imuschestvostorgov.online
austinheafey.com
mrdfa.club
883106.photos
profitablefxmarkets.com
taini00.net
brye.top
ginsm.com
sportglid.com
hdretailllc.com
umeshraja.com
bum-arch.com
carefulapp.com
kjqlq.top
3dsciagames.com
520yhy.com
magahatinu.com
freedompopo.com
directgaragedoor.com
tyupok.xyz
thecrystore.com
camperelektrikde.shop
soloparentconnect.com
sonderfullcoaching.com
jesuscrewofficial.com
oioc.xyz
assineunitv.com
whysco.com
484844.vip
gdctus840t.top
acc-pay.top
bdsmnutzbar.info
sdplat.media
cioncarp4213.com
facecasino2.top
bankablebark.com
gulerweb.online
radheyranidailyproduct.com
fin4d-sl.com
northshorehousekeeping.com
femmeteefatale.com
d0ge6or54x07cfn.xyz
craftwhirl.com
kgfna.biz
real-estate-96841.bond
cfuhtkwo.xyz
nestormediaproduction.com
txglobedev.com
kermoal.dev
yr8gl32.vip
bathroomremodelnearyou.today
nearmeacupuncture.com
chicstop.store
cpuk-finance.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/528-10-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/528-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4876-21-0x0000000000D40000-0x0000000000D6F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
mQY9ka5sW6hv2Ri.exemQY9ka5sW6hv2Ri.exewscript.exedescription pid process target process PID 3704 set thread context of 528 3704 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 528 set thread context of 3372 528 mQY9ka5sW6hv2Ri.exe Explorer.EXE PID 4876 set thread context of 3372 4876 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
mQY9ka5sW6hv2Ri.exewscript.exepid process 528 mQY9ka5sW6hv2Ri.exe 528 mQY9ka5sW6hv2Ri.exe 528 mQY9ka5sW6hv2Ri.exe 528 mQY9ka5sW6hv2Ri.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe 4876 wscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
mQY9ka5sW6hv2Ri.exewscript.exepid process 528 mQY9ka5sW6hv2Ri.exe 528 mQY9ka5sW6hv2Ri.exe 528 mQY9ka5sW6hv2Ri.exe 4876 wscript.exe 4876 wscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
mQY9ka5sW6hv2Ri.exewscript.exedescription pid process Token: SeDebugPrivilege 528 mQY9ka5sW6hv2Ri.exe Token: SeDebugPrivilege 4876 wscript.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
mQY9ka5sW6hv2Ri.exeExplorer.EXEwscript.exedescription pid process target process PID 3704 wrote to memory of 528 3704 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 3704 wrote to memory of 528 3704 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 3704 wrote to memory of 528 3704 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 3704 wrote to memory of 528 3704 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 3704 wrote to memory of 528 3704 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 3704 wrote to memory of 528 3704 mQY9ka5sW6hv2Ri.exe mQY9ka5sW6hv2Ri.exe PID 3372 wrote to memory of 4876 3372 Explorer.EXE wscript.exe PID 3372 wrote to memory of 4876 3372 Explorer.EXE wscript.exe PID 3372 wrote to memory of 4876 3372 Explorer.EXE wscript.exe PID 4876 wrote to memory of 3436 4876 wscript.exe cmd.exe PID 4876 wrote to memory of 3436 4876 wscript.exe cmd.exe PID 4876 wrote to memory of 3436 4876 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mQY9ka5sW6hv2Ri.exe"C:\Users\Admin\AppData\Local\Temp\mQY9ka5sW6hv2Ri.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mQY9ka5sW6hv2Ri.exe"C:\Users\Admin\AppData\Local\Temp\mQY9ka5sW6hv2Ri.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\mQY9ka5sW6hv2Ri.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/528-10-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/528-15-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/528-16-0x0000000001040000-0x0000000001055000-memory.dmpFilesize
84KB
-
memory/528-13-0x00000000011A0000-0x00000000014EA000-memory.dmpFilesize
3.3MB
-
memory/3372-17-0x0000000002EF0000-0x0000000002FB1000-memory.dmpFilesize
772KB
-
memory/3372-25-0x0000000002FC0000-0x0000000003066000-memory.dmpFilesize
664KB
-
memory/3372-29-0x0000000002FC0000-0x0000000003066000-memory.dmpFilesize
664KB
-
memory/3372-26-0x0000000002FC0000-0x0000000003066000-memory.dmpFilesize
664KB
-
memory/3704-2-0x00000000056F0000-0x0000000005C94000-memory.dmpFilesize
5.6MB
-
memory/3704-0-0x000000007532E000-0x000000007532F000-memory.dmpFilesize
4KB
-
memory/3704-4-0x0000000005250000-0x000000000525A000-memory.dmpFilesize
40KB
-
memory/3704-12-0x0000000075320000-0x0000000075AD0000-memory.dmpFilesize
7.7MB
-
memory/3704-3-0x0000000005260000-0x00000000052F2000-memory.dmpFilesize
584KB
-
memory/3704-5-0x0000000075320000-0x0000000075AD0000-memory.dmpFilesize
7.7MB
-
memory/3704-1-0x00000000007D0000-0x0000000000866000-memory.dmpFilesize
600KB
-
memory/3704-9-0x00000000092D0000-0x000000000936C000-memory.dmpFilesize
624KB
-
memory/3704-6-0x0000000005640000-0x0000000005650000-memory.dmpFilesize
64KB
-
memory/3704-7-0x00000000056E0000-0x00000000056EC000-memory.dmpFilesize
48KB
-
memory/3704-8-0x0000000006C30000-0x0000000006CA6000-memory.dmpFilesize
472KB
-
memory/4876-21-0x0000000000D40000-0x0000000000D6F000-memory.dmpFilesize
188KB
-
memory/4876-18-0x0000000000720000-0x0000000000747000-memory.dmpFilesize
156KB
-
memory/4876-20-0x0000000000720000-0x0000000000747000-memory.dmpFilesize
156KB