Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02-07-2024 02:13
Static task
static1
Behavioral task
behavioral1
Sample
f86b5c769c4ae7db9a13fa32b90030bf8b700d8d0f5c30584044942602d2af30.exe
Resource
win7-20240221-en
General
-
Target
f86b5c769c4ae7db9a13fa32b90030bf8b700d8d0f5c30584044942602d2af30.exe
-
Size
1.1MB
-
MD5
e03cefcd99feaf7ca8fd37a4bec8280c
-
SHA1
1ef21abddff685aeb42767f9288d67bf22a9422d
-
SHA256
f86b5c769c4ae7db9a13fa32b90030bf8b700d8d0f5c30584044942602d2af30
-
SHA512
af81a05f31cc3cd87872f95d448ce65936c6cd9ee8296c2ee46fd9af7b1cc7f76104c4272c4ce03d206086cb676e034e8a40670ec98494de8c28e551f2776277
-
SSDEEP
24576:2AHnh+eWsN3skA4RV1Hom2KXMmHaFUjMJc+pSA1TZHrhb5:Rh+ZkldoPK8YaFXJnrT
Malware Config
Extracted
formbook
4.1
ts59
hgptgz684w.top
gas39.pro
totalcow.com
76466.club
ssweatstudio.com
nr35.top
hmstr-drop.site
kjsdhklssk13.xyz
lostaino.com
athenamotel.info
9332946.com
ec-delivery-jobs-8j.bond
complaix.com
824go.com
checkout4xgrow.shop
modleavedepts.online
shoedio54.com
topallinoneaccounting.com
texhio.online
cn-brand.com
spotlights-instagram.com
kgstrengthandperformance.com
illumonos.com
asmauardotreschicshoes.com
732456.app
uorder.xyz
scarytube.world
ujgddhhfeffsfgg2.group
slumbergrip.com
anugerahcorp.biz
genevieveeventrental.com
wizardatm.com
pipelin.xyz
zangbreaker.com
782akd.top
theurbangarden.xyz
relatablemedia.net
robottts.com
femininequantumflowcoach.com
thebeckettfamily.com
yys1.rest
f-kd.net
ycmg5352.com
babyscan.xyz
superprinterworld.com
decorland.online
anatomiasiedzenia.com
digitalanju.life
zu89.top
dropfile.xyz
00050516.xyz
kris1.com
riedmw.sbs
osofamilycoffee.com
redseadivingadventure.com
momura.xyz
bvlazaedi.xyz
vifjzpdi.xyz
digitalimageryde.shop
anjay4d.green
qjjkxi260l.top
granadaiighting.com
agenciademarketingtorreon.com
casinomaxnodepositbonus.icu
gb-electric-wheelchairs-8j.bond
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3404-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3404-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2424-20-0x0000000000FA0000-0x0000000000FCF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
f86b5c769c4ae7db9a13fa32b90030bf8b700d8d0f5c30584044942602d2af30.exesvchost.exeexplorer.exedescription pid process target process PID 2020 set thread context of 3404 2020 f86b5c769c4ae7db9a13fa32b90030bf8b700d8d0f5c30584044942602d2af30.exe svchost.exe PID 3404 set thread context of 3424 3404 svchost.exe Explorer.EXE PID 2424 set thread context of 3424 2424 explorer.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
svchost.exeexplorer.exepid process 3404 svchost.exe 3404 svchost.exe 3404 svchost.exe 3404 svchost.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe 2424 explorer.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
f86b5c769c4ae7db9a13fa32b90030bf8b700d8d0f5c30584044942602d2af30.exesvchost.exeexplorer.exepid process 2020 f86b5c769c4ae7db9a13fa32b90030bf8b700d8d0f5c30584044942602d2af30.exe 3404 svchost.exe 3404 svchost.exe 3404 svchost.exe 2424 explorer.exe 2424 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
svchost.exeexplorer.exedescription pid process Token: SeDebugPrivilege 3404 svchost.exe Token: SeDebugPrivilege 2424 explorer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
f86b5c769c4ae7db9a13fa32b90030bf8b700d8d0f5c30584044942602d2af30.exepid process 2020 f86b5c769c4ae7db9a13fa32b90030bf8b700d8d0f5c30584044942602d2af30.exe 2020 f86b5c769c4ae7db9a13fa32b90030bf8b700d8d0f5c30584044942602d2af30.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
f86b5c769c4ae7db9a13fa32b90030bf8b700d8d0f5c30584044942602d2af30.exepid process 2020 f86b5c769c4ae7db9a13fa32b90030bf8b700d8d0f5c30584044942602d2af30.exe 2020 f86b5c769c4ae7db9a13fa32b90030bf8b700d8d0f5c30584044942602d2af30.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
f86b5c769c4ae7db9a13fa32b90030bf8b700d8d0f5c30584044942602d2af30.exeExplorer.EXEexplorer.exedescription pid process target process PID 2020 wrote to memory of 3404 2020 f86b5c769c4ae7db9a13fa32b90030bf8b700d8d0f5c30584044942602d2af30.exe svchost.exe PID 2020 wrote to memory of 3404 2020 f86b5c769c4ae7db9a13fa32b90030bf8b700d8d0f5c30584044942602d2af30.exe svchost.exe PID 2020 wrote to memory of 3404 2020 f86b5c769c4ae7db9a13fa32b90030bf8b700d8d0f5c30584044942602d2af30.exe svchost.exe PID 2020 wrote to memory of 3404 2020 f86b5c769c4ae7db9a13fa32b90030bf8b700d8d0f5c30584044942602d2af30.exe svchost.exe PID 3424 wrote to memory of 2424 3424 Explorer.EXE explorer.exe PID 3424 wrote to memory of 2424 3424 Explorer.EXE explorer.exe PID 3424 wrote to memory of 2424 3424 Explorer.EXE explorer.exe PID 2424 wrote to memory of 936 2424 explorer.exe cmd.exe PID 2424 wrote to memory of 936 2424 explorer.exe cmd.exe PID 2424 wrote to memory of 936 2424 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f86b5c769c4ae7db9a13fa32b90030bf8b700d8d0f5c30584044942602d2af30.exe"C:\Users\Admin\AppData\Local\Temp\f86b5c769c4ae7db9a13fa32b90030bf8b700d8d0f5c30584044942602d2af30.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\f86b5c769c4ae7db9a13fa32b90030bf8b700d8d0f5c30584044942602d2af30.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2020-10-0x0000000001360000-0x0000000001364000-memory.dmpFilesize
16KB
-
memory/2424-18-0x00000000002D0000-0x0000000000703000-memory.dmpFilesize
4.2MB
-
memory/2424-20-0x0000000000FA0000-0x0000000000FCF000-memory.dmpFilesize
188KB
-
memory/2424-19-0x00000000002D0000-0x0000000000703000-memory.dmpFilesize
4.2MB
-
memory/3404-15-0x00000000016C0000-0x00000000016D4000-memory.dmpFilesize
80KB
-
memory/3404-14-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3404-12-0x0000000001700000-0x0000000001A4A000-memory.dmpFilesize
3.3MB
-
memory/3404-11-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3424-16-0x0000000008A90000-0x0000000008BF3000-memory.dmpFilesize
1.4MB
-
memory/3424-22-0x0000000008A90000-0x0000000008BF3000-memory.dmpFilesize
1.4MB
-
memory/3424-25-0x0000000008C00000-0x0000000008CE0000-memory.dmpFilesize
896KB
-
memory/3424-26-0x0000000008C00000-0x0000000008CE0000-memory.dmpFilesize
896KB
-
memory/3424-29-0x0000000008C00000-0x0000000008CE0000-memory.dmpFilesize
896KB