Analysis
-
max time kernel
113s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2024 02:13
Static task
static1
Behavioral task
behavioral1
Sample
RE01.exe
Resource
win7-20241010-en
windows7-x64
4 signatures
150 seconds
General
-
Target
RE01.exe
-
Size
520KB
-
MD5
6544d732fba17d55644a72fd352b89c4
-
SHA1
d6dbced2975720f23d0cac726e4a8dea81b65544
-
SHA256
270ae3c9673c2f6d3e11e5dab49d33741c7a24fb493beca2876abcbb5901db9d
-
SHA512
fda2dc083fb2c77e738c1100f7de3a75fd697a7f2980feb8e5781878c63ac1df17400cbd20f30465c3b32e0309e96be50971244c0294b2857a8459535d12e56a
-
SSDEEP
6144:6Qttl0WdGjFZichhs1HK69P/8newQ96mQYwEAhG:37bdGjeEm1/t8newQ96uwZhG
Malware Config
Extracted
Family
formbook
Version
3.8
Campaign
be
Decoy
rihamc.com
boundlesslc.com
friendsandfoundationhpl.info
coryanneva.com
trackdaybuddy.com
f-cielo.com
cnyoubu.com
jewellrybyrhomel.com
mineopqq.site
rapidqi.com
iprugby.net
suzhoufuyao.com
codinghome.net
aliqua3.com
swashbucklr.com
radiosityandroid.com
parpanama.com
mixtapebooster.com
vermudes.com
sisutechpartners.com
joashlasharon.com
kaminoyobou.site
gc661.com
flightsandbitestravel.com
newoolonce.com
ardiraq.com
phit.ltd
beepmanager.com
avawangdesign.com
northgeorgiaprowash.com
emma-rowan-kelly.com
enhancedanimalwellbeing.com
grerniture.net
lampuhijau.info
chatwebcamguys.com
riosautoglassllc.com
rishietourica.com
dickcreative.com
kez-li.com
toysushibelt.com
propertytreesales.com
wholesalestitchedjerseys.com
xiaodiu.net
jaccessjungenesishcc.com
03ssss.com
pastrystop.com
kuangzhanfu.com
yamahapay.com
xn--fjqa823v.com
tanopartners.info
6066366.com
vandaculture.com
pestcontrolholden.com
herba-sport.com
trentonstinson.com
beziersinfo.com
hotladies.life
woodmodi.com
thetenderoniarchives.com
impresionenlonas.com
vgas.ltd
gyteni.men
gmqbk.info
sxrcny.com
rotfas.com
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/4540-5-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/4540-7-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/4540-8-0x0000000000400000-0x0000000000481000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1948 set thread context of 4540 1948 RE01.exe 91 PID 4540 set thread context of 3404 4540 RE01.exe 56 PID 2496 set thread context of 3404 2496 wlanext.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RE01.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RE01.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wlanext.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4540 RE01.exe 4540 RE01.exe 4540 RE01.exe 4540 RE01.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 2496 wlanext.exe 2496 wlanext.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 2496 wlanext.exe 2496 wlanext.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 2496 wlanext.exe 2496 wlanext.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 2496 wlanext.exe 2496 wlanext.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4804 taskmgr.exe 3404 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 4540 RE01.exe 4540 RE01.exe 4540 RE01.exe 2496 wlanext.exe 2496 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 4540 RE01.exe Token: SeShutdownPrivilege 3404 Explorer.EXE Token: SeCreatePagefilePrivilege 3404 Explorer.EXE Token: SeShutdownPrivilege 3404 Explorer.EXE Token: SeCreatePagefilePrivilege 3404 Explorer.EXE Token: SeDebugPrivilege 4804 taskmgr.exe Token: SeSystemProfilePrivilege 4804 taskmgr.exe Token: SeCreateGlobalPrivilege 4804 taskmgr.exe Token: SeDebugPrivilege 2496 wlanext.exe Token: SeShutdownPrivilege 3404 Explorer.EXE Token: SeCreatePagefilePrivilege 3404 Explorer.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 3404 Explorer.EXE 3404 Explorer.EXE 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1948 RE01.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1948 wrote to memory of 4540 1948 RE01.exe 91 PID 1948 wrote to memory of 4540 1948 RE01.exe 91 PID 1948 wrote to memory of 4540 1948 RE01.exe 91 PID 3404 wrote to memory of 2496 3404 Explorer.EXE 93 PID 3404 wrote to memory of 2496 3404 Explorer.EXE 93 PID 3404 wrote to memory of 2496 3404 Explorer.EXE 93 PID 3404 wrote to memory of 4804 3404 Explorer.EXE 94 PID 3404 wrote to memory of 4804 3404 Explorer.EXE 94 PID 2496 wrote to memory of 4712 2496 wlanext.exe 95 PID 2496 wrote to memory of 4712 2496 wlanext.exe 95 PID 2496 wrote to memory of 4712 2496 wlanext.exe 95
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\RE01.exe"C:\Users\Admin\AppData\Local\Temp\RE01.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\RE01.exeC:\Users\Admin\AppData\Local\Temp\RE01.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4540
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RE01.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4712
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4804
-