Analysis
- max time kernel
149s - max time network
133s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system - submitted
10/06/2025, 09:51
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
21d3f57e61ce525123d11ca6da1dbfe05b9e95bdd5867309e38d59c4140f7d86.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 21d3f57e61ce525123d11ca6da1dbfe05b9e95bdd5867309e38d59c4140f7d86.exe
- Size 1.0MB
- Sample250610-lvl1csszet
- SHA256 21d3f57e61ce525123d11ca6da1dbfe05b9e95bdd5867309e38d59c4140f7d86
- MD5 729879c904325aab4786b3d538e8168a
- SHA1 e54f5963c6382d277d1cc76692691e96274c114e
- SHA512 d6a66cff124a4600feaa7a7ee9d94ed68bb1b523ca892dc5c8551a21022cc7e6d01eba2d805df1fcba662868642640eb646dc822e65824ef81668658190e5c67
- SSDEEP 12288:rtb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaF7m2UrWPrDzmB7KCXt5:rtb20pkaCqT5TBWgNQ7aZmXaPSTt6A
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
dy23
Decoy
-
anguage-courses-48869.bond
-
967dhs23.top
-
kc7u5.top
-
qe9bz.vip
-
ucky-jet777-1.top
-
hopngoworld.net
-
bbgpower.xyz
-
31589.vip
-
ark-spots-removal-96358.bond
-
jwe.top
-
adiantexplorer822.shop
-
ad.llc
-
t6lvy.vip
-
arovinulexop.click
-
-lordserial82.top
-
tundst.xyz
-
321jwm.top
-
rkapex.homes
-
sviuwrhdejt.pro
-
om-etceow.vip
-
maingur.website
-
eoul-bestanma7.xyz
-
agaku88menang.xyz
-
eisehuixx106.top
-
efenseagency.pro
-
moja.coffee
-
eladann.pro
-
mx0h2.vip
-
win7.click
-
omesenior.shop
-
950701.xyz
-
eatsandals.top
-
utotraca.net
-
athroom-remodeling-18957.bond
-
mwcauk.xyz
-
es02i.vip
-
ibttb.top
-
bkaczw.website
-
heni.xyz
-
2jwe.top
-
ain-management-94044.bond
-
lzqod.vip
-
926a.top
-
otrepoker.net
-
alentinocontihome.shop
-
39cz.top
-
d6bow.cfd
-
lokiboop.xyz
-
bt1473.xyz
-
ires-93741.bond
-
p0xwy.vip
-
k4f2f.vip
-
yatt.pics
-
qazlu4bsc4.xyz
-
afangui.chat
-
hayanshi.top
-
bss1317.xyz
-
n315.top
-
ayezp.vip
-
hotohub.tech
-
jf8er.vip
-
stral-wisdomportal.click
-
no8q8.vip
-
eavenjoyful.shop
-
herapy-centers-47841.bond
Signatures
- Formbook family
- Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/1008-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1008-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4544-21-0x0000000000C50000-0x0000000000C7F000-memory.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2384 set thread context of 1008 2384 21d3f57e61ce525123d11ca6da1dbfe05b9e95bdd5867309e38d59c4140f7d86.exe 78 PID 1008 set thread context of 3300 1008 svchost.exe 51 PID 4544 set thread context of 3300 4544 WWAHost.exe 51 - Program crash 1 IoCs
pid pid_target Process procid_target 752 2384 WerFault.exe 77 - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21d3f57e61ce525123d11ca6da1dbfe05b9e95bdd5867309e38d59c4140f7d86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WWAHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1008 svchost.exe 1008 svchost.exe 1008 svchost.exe 1008 svchost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe 4544 WWAHost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3300 Explorer.EXE - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2384 21d3f57e61ce525123d11ca6da1dbfe05b9e95bdd5867309e38d59c4140f7d86.exe 1008 svchost.exe 1008 svchost.exe 1008 svchost.exe 4544 WWAHost.exe 4544 WWAHost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1008 svchost.exe Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeDebugPrivilege 4544 WWAHost.exe Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2384 wrote to memory of 1008 2384 21d3f57e61ce525123d11ca6da1dbfe05b9e95bdd5867309e38d59c4140f7d86.exe 78 PID 2384 wrote to memory of 1008 2384 21d3f57e61ce525123d11ca6da1dbfe05b9e95bdd5867309e38d59c4140f7d86.exe 78 PID 2384 wrote to memory of 1008 2384 21d3f57e61ce525123d11ca6da1dbfe05b9e95bdd5867309e38d59c4140f7d86.exe 78 PID 2384 wrote to memory of 1008 2384 21d3f57e61ce525123d11ca6da1dbfe05b9e95bdd5867309e38d59c4140f7d86.exe 78 PID 3300 wrote to memory of 4544 3300 Explorer.EXE 82 PID 3300 wrote to memory of 4544 3300 Explorer.EXE 82 PID 3300 wrote to memory of 4544 3300 Explorer.EXE 82 PID 4544 wrote to memory of 3320 4544 WWAHost.exe 83 PID 4544 wrote to memory of 3320 4544 WWAHost.exe 83 PID 4544 wrote to memory of 3320 4544 WWAHost.exe 83
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\21d3f57e61ce525123d11ca6da1dbfe05b9e95bdd5867309e38d59c4140f7d86.exe"C:\Users\Admin\AppData\Local\Temp\21d3f57e61ce525123d11ca6da1dbfe05b9e95bdd5867309e38d59c4140f7d86.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\21d3f57e61ce525123d11ca6da1dbfe05b9e95bdd5867309e38d59c4140f7d86.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1008
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 6883⤵
- Program crash
PID:752
-
-
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3320
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2384 -ip 23841⤵PID:5712