Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows11-21h2_x64 -
resource
win11-20250410-en -
resource tags
arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system -
submitted
16/04/2025, 14:13
Behavioral task
behavioral1
Sample
bin-crypted.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
bin-crypted.exe
-
Size
349KB
-
MD5
8d9ce3796ab75494d8506e1317ad0edf
-
SHA1
601541fd266a7894d9f40b923a312ea5fe1bbeec
-
SHA256
20e06558da9221d09648c2a64bd93b8bfa9d7d67ab9bc0c16d7d4035f1b8b454
-
SHA512
2fadd09017c7e2536e174a78b21d14ab901e203dcc9f5a0db0c164e3f364e51c431b5238749d56bcbee6ad12c644cd4fb29d08fefdf89d829f71e94a2df8c3a0
-
SSDEEP
3072:WQnciRMiqBIBub5iaeijvOwQF/MhZeqnOe103huHXJ+9ihSSHYgIPQjy1xYq:eBIMbo4iF/MXe2103hu09ihSU0wG
Malware Config
Extracted
Family
formbook
Version
4.1
Campaign
jc27
Decoy
uymygel.xyz
aregiver-services-test01.sbs
ouyin67gh.vip
lobalz.top
cl1ic4.pro
mconotc.top
hmm365.cfd
olonam.shop
ionnel.shop
ntroductorypage.info
einopumpify.net
hsnac.xyz
rameny.net
itness-apps1-s2025.sbs
nshulthakurdev.pro
iveawaywin.online
setobe.info
ostury.shop
5r03a.sbs
yota-blog.net
5381a6.app
acdzvx.top
raindeposits.info
gsp607.top
allbucdial.store
t615873tel.top
uckycasino88.net
oclywts.top
ol.autos
udm9p.cfd
arsonsales.online
0422.pet
94478.app
9ghaefscrnmu.shop
akery156mart.xyz
ogmuppets.top
-payret.shop
fcgroup.net
upcup.info
x3zig.sbs
port-eu.shop
sbjgu.cfd
01dt.top
4250017.xyz
yfreedom.lol
personegitim.xyz
acecarpg.vip
illavilavenue.xyz
2ap7moc06aou.xyz
rchi-architects.net
mretdoy.xyz
eucartaoflash.online
e-eaac.top
itfukt.net
agam77.net
4249874.xyz
85793.fit
ph63.info
oxupa.shop
arnaca.realestate
onarchglobalsecurityweb.info
gc6koahcyqn2y.xyz
1t2r1k8f.top
akalovwww.online
ingkersk8.store
Signatures
-
Formbook family
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 5036 set thread context of 3256 5036 bin-crypted.exe 52 PID 4048 set thread context of 3256 4048 netsh.exe 52 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bin-crypted.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-599783296-1627459723-2423478968-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 5036 bin-crypted.exe 5036 bin-crypted.exe 5036 bin-crypted.exe 5036 bin-crypted.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe 4048 netsh.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3256 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 5036 bin-crypted.exe 5036 bin-crypted.exe 5036 bin-crypted.exe 4048 netsh.exe 4048 netsh.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5036 bin-crypted.exe Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeDebugPrivilege 4048 netsh.exe Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3256 Explorer.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3256 wrote to memory of 4048 3256 Explorer.EXE 82 PID 3256 wrote to memory of 4048 3256 Explorer.EXE 82 PID 3256 wrote to memory of 4048 3256 Explorer.EXE 82 PID 4048 wrote to memory of 3480 4048 netsh.exe 85 PID 4048 wrote to memory of 3480 4048 netsh.exe 85 PID 4048 wrote to memory of 3480 4048 netsh.exe 85
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\bin-crypted.exe"C:\Users\Admin\AppData\Local\Temp\bin-crypted.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:5036
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\bin-crypted.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3480
-
-