Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05-07-2024 08:54
Static task
static1
Behavioral task
behavioral1
Sample
327vRde1h3nsEEG.exe
Resource
win7-20240704-en
General
-
Target
327vRde1h3nsEEG.exe
-
Size
684KB
-
MD5
f665dfddb68cd78380ddf97c1194f475
-
SHA1
1345e5c2fe0ebe79f4d9bd842f69cc789a29bfc2
-
SHA256
0b6552f35a24fdef4ea92e7a0f48775178603092f271c406568ead3851cc37dd
-
SHA512
1b430fc947d44d9c823c73038ed8f9b4b8a361cc8db52330c58d133dc0e6eda4fb719dd5662ce29703b4ab05e106e81d1848a91797bc52740f56b696a2406c98
-
SSDEEP
12288:Eon5t/oCK1R0bMfzqKka41XtFVMxkeB69sMB8zFQRvuu89wCCwhas:3At0bmzrkD1Hax+s7zaCCw
Malware Config
Extracted
formbook
4.1
mc10
sttcorp.one
jack88.lat
owl-protect.com
hnszrrn.com
at89v2.com
h147.top
takle4creators.com
fondsa.xyz
mantenopolice.com
shophansler.com
dessertt.com
thecollisionmagazine.com
tatesfluffyfrenchies.com
h1f2v.rest
bluewandltd.com
cuplaho2003.shop
2thetcleaningservice.com
yc85w.top
natursache.shop
allmyabilities.com
sorteioagora.shop
291van.fun
bforeplay.com
playcoy99.com
grapplegrid.app
machaiproductions.com
bjcysadz.xyz
hg44a.com
english4u.online
w15hh.rest
kurainu.xyz
psycrowolgy.com
quantron.xyz
realtors.biz
hjjhggh.top
767jogo.com
inspirationandhumor.com
basedawgz.live
jigofort.com
bonjourmignon.com
huttonsidel.online
iffacosmetics.com
483yes.com
motolimod.com
xatapartners.com
laurelhw.com
sztopsports.com
ethermail-register.com
ust-online.com
theofficescowork.com
arkonwheels.com
projectorvibe.com
xpanas.black
gemaroke2.shop
sofiastory.store
dealerxai.com
zerolength.xyz
marketmaventesfayellc.site
instrumentsurvey-dinarjatim.com
ajansyapai.net
llngx.com
onwardgrowth.com
useprize.com
zaki-argan.com
sainikshiksha.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2700-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2700-18-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3452-22-0x0000000000120000-0x000000000014F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
327vRde1h3nsEEG.exe327vRde1h3nsEEG.execmstp.exedescription pid process target process PID 2244 set thread context of 2700 2244 327vRde1h3nsEEG.exe 327vRde1h3nsEEG.exe PID 2700 set thread context of 3540 2700 327vRde1h3nsEEG.exe Explorer.EXE PID 3452 set thread context of 3540 3452 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
327vRde1h3nsEEG.execmstp.exepid process 2700 327vRde1h3nsEEG.exe 2700 327vRde1h3nsEEG.exe 2700 327vRde1h3nsEEG.exe 2700 327vRde1h3nsEEG.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe 3452 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
327vRde1h3nsEEG.execmstp.exepid process 2700 327vRde1h3nsEEG.exe 2700 327vRde1h3nsEEG.exe 2700 327vRde1h3nsEEG.exe 3452 cmstp.exe 3452 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
327vRde1h3nsEEG.execmstp.exedescription pid process Token: SeDebugPrivilege 2700 327vRde1h3nsEEG.exe Token: SeDebugPrivilege 3452 cmstp.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3540 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
327vRde1h3nsEEG.exeExplorer.EXEcmstp.exedescription pid process target process PID 2244 wrote to memory of 2700 2244 327vRde1h3nsEEG.exe 327vRde1h3nsEEG.exe PID 2244 wrote to memory of 2700 2244 327vRde1h3nsEEG.exe 327vRde1h3nsEEG.exe PID 2244 wrote to memory of 2700 2244 327vRde1h3nsEEG.exe 327vRde1h3nsEEG.exe PID 2244 wrote to memory of 2700 2244 327vRde1h3nsEEG.exe 327vRde1h3nsEEG.exe PID 2244 wrote to memory of 2700 2244 327vRde1h3nsEEG.exe 327vRde1h3nsEEG.exe PID 2244 wrote to memory of 2700 2244 327vRde1h3nsEEG.exe 327vRde1h3nsEEG.exe PID 3540 wrote to memory of 3452 3540 Explorer.EXE cmstp.exe PID 3540 wrote to memory of 3452 3540 Explorer.EXE cmstp.exe PID 3540 wrote to memory of 3452 3540 Explorer.EXE cmstp.exe PID 3452 wrote to memory of 1508 3452 cmstp.exe cmd.exe PID 3452 wrote to memory of 1508 3452 cmstp.exe cmd.exe PID 3452 wrote to memory of 1508 3452 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\327vRde1h3nsEEG.exe"C:\Users\Admin\AppData\Local\Temp\327vRde1h3nsEEG.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\327vRde1h3nsEEG.exe"C:\Users\Admin\AppData\Local\Temp\327vRde1h3nsEEG.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\327vRde1h3nsEEG.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2244-14-0x0000000074A70000-0x0000000075220000-memory.dmpFilesize
7.7MB
-
memory/2244-1-0x00000000003E0000-0x0000000000492000-memory.dmpFilesize
712KB
-
memory/2244-2-0x0000000005510000-0x0000000005AB4000-memory.dmpFilesize
5.6MB
-
memory/2244-3-0x0000000004E70000-0x0000000004F02000-memory.dmpFilesize
584KB
-
memory/2244-4-0x0000000004F40000-0x0000000004F4A000-memory.dmpFilesize
40KB
-
memory/2244-5-0x0000000074A70000-0x0000000075220000-memory.dmpFilesize
7.7MB
-
memory/2244-6-0x00000000060C0000-0x000000000616E000-memory.dmpFilesize
696KB
-
memory/2244-7-0x00000000054D0000-0x00000000054EA000-memory.dmpFilesize
104KB
-
memory/2244-8-0x00000000062B0000-0x00000000062B8000-memory.dmpFilesize
32KB
-
memory/2244-9-0x0000000004850000-0x000000000485C000-memory.dmpFilesize
48KB
-
memory/2244-10-0x0000000007980000-0x00000000079F6000-memory.dmpFilesize
472KB
-
memory/2244-11-0x0000000006360000-0x00000000063FC000-memory.dmpFilesize
624KB
-
memory/2244-0-0x0000000074A7E000-0x0000000074A7F000-memory.dmpFilesize
4KB
-
memory/2700-12-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2700-18-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2700-17-0x00000000015A0000-0x00000000015B4000-memory.dmpFilesize
80KB
-
memory/2700-16-0x00000000015E0000-0x000000000192A000-memory.dmpFilesize
3.3MB
-
memory/3452-20-0x0000000000360000-0x0000000000376000-memory.dmpFilesize
88KB
-
memory/3452-21-0x0000000000360000-0x0000000000376000-memory.dmpFilesize
88KB
-
memory/3452-22-0x0000000000120000-0x000000000014F000-memory.dmpFilesize
188KB
-
memory/3540-19-0x0000000007CE0000-0x0000000007DB3000-memory.dmpFilesize
844KB
-
memory/3540-24-0x0000000007CE0000-0x0000000007DB3000-memory.dmpFilesize
844KB
-
memory/3540-26-0x00000000084D0000-0x0000000008607000-memory.dmpFilesize
1.2MB
-
memory/3540-27-0x00000000084D0000-0x0000000008607000-memory.dmpFilesize
1.2MB
-
memory/3540-30-0x00000000084D0000-0x0000000008607000-memory.dmpFilesize
1.2MB