Analysis
-
max time kernel
84s -
max time network
86s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2024 08:22
Static task
static1
1 signatures
General
-
Target
wedmeymarsp.exe
-
Size
699KB
-
MD5
875b5af7b5c56f1913978cc8f535a114
-
SHA1
ce7a41a32572853b609f781e87d99634b9e7a00f
-
SHA256
3f65f8e74e4ced282a3f46df38dc2550abedf3ffebf6d523386902680905a865
-
SHA512
9c60ac8ae33ab71ee7b62c451bfbf44ad8918ba7398f1691bb4b759fd901dec3c8fa39848a45b5455de4756bba82f02e76ee9ea909431a9fa27c654b4dd70c9e
-
SSDEEP
12288:T0VZmK9yx3ASqzgWBYXP5KWcg3AstdkD+gF+G3f6zpjB4ejMp5OxL4SmaeS:oVDQ3ASAIP5Kg3AsTkSgryf4e/4Smae
Malware Config
Extracted
Family
formbook
Version
3.9
Campaign
ne
Decoy
ninaaizman.com
kpwinvestments.com
bday.ltd
nnodwigliefspect.win
xn--fiq20h03e3vbp93bkks2rn.com
www444678.com
tianshicishan.com
dustinzell.com
jassed.com
kcofficeinstallers.biz
545cb.com
pornohiet.com
apexlifeinsurance.com
fewproductions.com
000006s.com
bocloud.ink
tlcef.com
pmcop.loan
whxwg.com
4k5five.loan
rcgld.com
coral-red.com
fredhoelzel.com
pj6677666.com
indigorev.com
viral4g.com
awmannequins-de.com
treasuretrousers.com
championsfootballkcmo.com
threelittlepigs.cymru
bespokephni.com
vietnamcambodiatravel.com
xn--1lqq7iu1fzrcitee09b.com
hiddenyoungtop.com
marfacollective.com
990460.top
xwtv001.com
myultratv.net
totalresidualincome.com
free-iphonex.com
rungo.info
8gordonstreet.com
sixgill.run
agmovies.live
880md.com
hci-rcc.com
yifavakigat.com
kleancutlawn.com
phones.technology
mendzimesoso.com
conejemplos.com
blucr.com
sex-mania.review
coinedge.network
nqk.info
tapiceriatorreshebert.com
zorssarhair.com
okhlites.com
seerenergetics.com
xwxox8.info
cervelo-goodzo.com
heat-deloitte.biz
podplug.net
laparuredebain.com
paltox.com
Signatures
-
Formbook family
-
Formbook payload 2 IoCs
resource yara_rule behavioral1/memory/4916-2-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/4916-5-0x0000000000400000-0x000000000042A000-memory.dmp formbook -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\QZR8FTBPB4B = "C:\\Program Files (x86)\\N3fbxnn\\taskhosthnclh4ix.exe" colorcpl.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1612 set thread context of 4916 1612 wedmeymarsp.exe 89 PID 4916 set thread context of 3320 4916 wedmeymarsp.exe 55 PID 3944 set thread context of 3320 3944 colorcpl.exe 55 -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\N3fbxnn\taskhosthnclh4ix.exe colorcpl.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wedmeymarsp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language colorcpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
description ioc Process Key created \Registry\User\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 colorcpl.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1612 wedmeymarsp.exe 1612 wedmeymarsp.exe 4916 wedmeymarsp.exe 4916 wedmeymarsp.exe 4916 wedmeymarsp.exe 4916 wedmeymarsp.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 3944 colorcpl.exe 3944 colorcpl.exe 4952 taskmgr.exe 4952 taskmgr.exe 3944 colorcpl.exe 3944 colorcpl.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 3944 colorcpl.exe 3944 colorcpl.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 3944 colorcpl.exe 3944 colorcpl.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 3944 colorcpl.exe 3944 colorcpl.exe 4952 taskmgr.exe 4952 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4952 taskmgr.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1612 wedmeymarsp.exe 1612 wedmeymarsp.exe 4916 wedmeymarsp.exe 4916 wedmeymarsp.exe 4916 wedmeymarsp.exe 3944 colorcpl.exe 3944 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 4916 wedmeymarsp.exe Token: SeShutdownPrivilege 3320 Explorer.EXE Token: SeCreatePagefilePrivilege 3320 Explorer.EXE Token: SeShutdownPrivilege 3320 Explorer.EXE Token: SeCreatePagefilePrivilege 3320 Explorer.EXE Token: SeShutdownPrivilege 3320 Explorer.EXE Token: SeCreatePagefilePrivilege 3320 Explorer.EXE Token: SeDebugPrivilege 4952 taskmgr.exe Token: SeSystemProfilePrivilege 4952 taskmgr.exe Token: SeCreateGlobalPrivilege 4952 taskmgr.exe Token: SeDebugPrivilege 3944 colorcpl.exe Token: SeShutdownPrivilege 3320 Explorer.EXE Token: SeCreatePagefilePrivilege 3320 Explorer.EXE Token: SeShutdownPrivilege 3320 Explorer.EXE Token: SeCreatePagefilePrivilege 3320 Explorer.EXE Token: SeShutdownPrivilege 3320 Explorer.EXE Token: SeCreatePagefilePrivilege 3320 Explorer.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 3320 Explorer.EXE 3320 Explorer.EXE 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 3320 Explorer.EXE 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 3320 Explorer.EXE 4952 taskmgr.exe 3320 Explorer.EXE 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 4952 taskmgr.exe 3320 Explorer.EXE 3320 Explorer.EXE 3320 Explorer.EXE 3320 Explorer.EXE 3320 Explorer.EXE 3320 Explorer.EXE 3320 Explorer.EXE 4952 taskmgr.exe 3320 Explorer.EXE 3320 Explorer.EXE 4952 taskmgr.exe 3320 Explorer.EXE 4952 taskmgr.exe 3320 Explorer.EXE 4952 taskmgr.exe 3320 Explorer.EXE 4952 taskmgr.exe 3320 Explorer.EXE 4952 taskmgr.exe 3320 Explorer.EXE 4952 taskmgr.exe 3320 Explorer.EXE 4952 taskmgr.exe 3320 Explorer.EXE 4952 taskmgr.exe 3320 Explorer.EXE 4952 taskmgr.exe 3320 Explorer.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1612 wrote to memory of 4916 1612 wedmeymarsp.exe 89 PID 1612 wrote to memory of 4916 1612 wedmeymarsp.exe 89 PID 1612 wrote to memory of 4916 1612 wedmeymarsp.exe 89 PID 3320 wrote to memory of 3944 3320 Explorer.EXE 90 PID 3320 wrote to memory of 3944 3320 Explorer.EXE 90 PID 3320 wrote to memory of 3944 3320 Explorer.EXE 90 PID 3320 wrote to memory of 4952 3320 Explorer.EXE 93 PID 3320 wrote to memory of 4952 3320 Explorer.EXE 93 PID 3944 wrote to memory of 5044 3944 colorcpl.exe 94 PID 3944 wrote to memory of 5044 3944 colorcpl.exe 94 PID 3944 wrote to memory of 5044 3944 colorcpl.exe 94 PID 3944 wrote to memory of 2912 3944 colorcpl.exe 98 PID 3944 wrote to memory of 2912 3944 colorcpl.exe 98 PID 3944 wrote to memory of 2912 3944 colorcpl.exe 98
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\wedmeymarsp.exe"C:\Users\Admin\AppData\Local\Temp\wedmeymarsp.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\wedmeymarsp.exe"C:\Users\Admin\AppData\Local\Temp\wedmeymarsp.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4916
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\wedmeymarsp.exe"3⤵
- System Location Discovery: System Language Discovery
PID:5044
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
- System Location Discovery: System Language Discovery
PID:2912
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4952
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5a182561a527f929489bf4b8f74f65cd7
SHA18cd6866594759711ea1836e86a5b7ca64ee8911f
SHA25642aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA5129bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558