Analysis
-
max time kernel
148s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 09:18
Static task
static1
Behavioral task
behavioral1
Sample
RFQ_BDS636011.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
RFQ_BDS636011.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
RFQ_BDS636011.exe
-
Size
694KB
-
MD5
74f8407f98ac51a0b9feb8782bd8f7c9
-
SHA1
d49d93ac8941442fe52eda4b1240f3afd620bb08
-
SHA256
53a703b29d5aebc4a0b5794d0904e49aa90d72525018df4f9121e5da86116534
-
SHA512
9ee6d913eeabc524e2f271b87e7df993adeb886299ec12ceb81790355d234439fac5ab2c98f6cbcca6742bcb0abe3fd603add6bcdd17ea0bf8ebdda12c6aa790
-
SSDEEP
12288:xXFAO0Qb6xMem7HGKCdt44epEx3linXjVdiyqkkHnZ4CCVjscJ4nX0q2mY9+QQhX:xXFN0Yem7Q3yOx3gnXRdiZ9HkV+nX0qj
Malware Config
Extracted
formbook
4.1
hy29
obswell.online
etflix.luxury
ulunguwethu.store
ulbcenter.shop
nswering-service-mi-de-tt.click
upport-marketplace84.click
wepxbd163.lat
mplants-doctors.today
aofexf90yj.top
hermodynamic.space
dfg3n489.cyou
off.gay
alkak.cam
ijanarko.net
7tl.site
yaanincma.store
ires-47022.bond
elek4dalt77.xyz
foxsakepeople.online
ndefeatedqs.shop
ordseetouristik.reisen
eviewmywebsite.xyz
igitalcommandos.net
eqtech.net
5655600.xyz
rbis.site
entures-sharp.today
atrixslotviral.xyz
zrk148.ink
nline-advertising-18349.bond
unnify.net
ylosnackpark.online
sakasouzoku.net
emonslayerlatinclub.xyz
tus.live
tm189vip.live
eintix.store
oinflogo.xyz
nline-gaming-16655.bond
uyglp.one
ihjp69483.vip
n6n.xyz
veriox.xyz
limtightwaistkh.shop
roelitecraft.mom
eifeigou.top
inak.net
audesa.shop
ealclick.club
oktopus.kids
elisiaco.shop
xvsk.global
littlebitoffaith.net
dc188link04.xyz
tagprobe.band
orldlullaby.net
hswe.top
ultankinglogin.world
ustdoit.store
bhishekanand.biz
erminalplanner.app
oopia-faktura.info
a-consulting.online
owboyaero.net
84jys301.top
Signatures
-
Formbook family
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Formbook payload 4 IoCs
resource yara_rule behavioral2/memory/1400-19-0x0000000000400000-0x0000000001654000-memory.dmp formbook behavioral2/memory/1400-20-0x0000000000400000-0x0000000001654000-memory.dmp formbook behavioral2/memory/1400-22-0x0000000000400000-0x0000000001654000-memory.dmp formbook behavioral2/memory/2600-25-0x0000000000430000-0x000000000045F000-memory.dmp formbook -
Loads dropped DLL 1 IoCs
pid Process 4432 RFQ_BDS636011.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1400 RFQ_BDS636011.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4432 RFQ_BDS636011.exe 1400 RFQ_BDS636011.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4432 set thread context of 1400 4432 RFQ_BDS636011.exe 91 PID 1400 set thread context of 3416 1400 RFQ_BDS636011.exe 56 PID 1400 set thread context of 3416 1400 RFQ_BDS636011.exe 56 PID 2600 set thread context of 3416 2600 raserver.exe 56 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\fips\beskydende.ini RFQ_BDS636011.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language raserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFQ_BDS636011.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFQ_BDS636011.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 1400 RFQ_BDS636011.exe 1400 RFQ_BDS636011.exe 1400 RFQ_BDS636011.exe 1400 RFQ_BDS636011.exe 1400 RFQ_BDS636011.exe 1400 RFQ_BDS636011.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe 2600 raserver.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 4432 RFQ_BDS636011.exe 1400 RFQ_BDS636011.exe 1400 RFQ_BDS636011.exe 1400 RFQ_BDS636011.exe 1400 RFQ_BDS636011.exe 2600 raserver.exe 2600 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1400 RFQ_BDS636011.exe Token: SeDebugPrivilege 2600 raserver.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3416 Explorer.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4432 wrote to memory of 1400 4432 RFQ_BDS636011.exe 91 PID 4432 wrote to memory of 1400 4432 RFQ_BDS636011.exe 91 PID 4432 wrote to memory of 1400 4432 RFQ_BDS636011.exe 91 PID 4432 wrote to memory of 1400 4432 RFQ_BDS636011.exe 91 PID 4432 wrote to memory of 1400 4432 RFQ_BDS636011.exe 91 PID 1400 wrote to memory of 2600 1400 RFQ_BDS636011.exe 94 PID 1400 wrote to memory of 2600 1400 RFQ_BDS636011.exe 94 PID 1400 wrote to memory of 2600 1400 RFQ_BDS636011.exe 94 PID 2600 wrote to memory of 3132 2600 raserver.exe 96 PID 2600 wrote to memory of 3132 2600 raserver.exe 96 PID 2600 wrote to memory of 3132 2600 raserver.exe 96
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\RFQ_BDS636011.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_BDS636011.exe"2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\RFQ_BDS636011.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_BDS636011.exe"3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"4⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ_BDS636011.exe"5⤵
- System Location Discovery: System Language Discovery
PID:3132
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD54add245d4ba34b04f213409bfe504c07
SHA1ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA2569111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
SHA5121bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d