Analysis
- max time kernel
150s - max time network
113s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system - submitted
12/08/2025, 14:58
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
fd4fa972a80b38a4a561bc647bf3720248f81eb85fe719f51fe8dc3965e7f330.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target fd4fa972a80b38a4a561bc647bf3720248f81eb85fe719f51fe8dc3965e7f330.exe
- Size 1.1MB
- Sample250812-scd1cssvbz
- SHA256 fd4fa972a80b38a4a561bc647bf3720248f81eb85fe719f51fe8dc3965e7f330
- MD5 a9d59e02f37939ff9d11fa9bf9c01861
- SHA1 7837819ecde84af4ff48f44f215c2edcab271420
- SHA512 061bba42959fdc566f0239a25a5bf20b5c83461568de58afc56dedb0d893d15cad0487cdfe2daef068e262b74217ed10e7fc4ffc29ffb30b069787bcab15c275
- SSDEEP 24576:Itb20pkaCqT5TBWgNQ7aWeA0ikWxc9EKnE6A:RVg5tQ7aWf0+e/E5
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Formbook family
- Formbook payload 5 IoCs
resource yara_rule behavioral2/memory/1676-18-0x0000000000400000-0x0000000000442000-memory.dmp family_formbook behavioral2/memory/1676-19-0x0000000000400000-0x0000000000442000-memory.dmp family_formbook behavioral2/memory/1676-24-0x0000000000400000-0x0000000000442000-memory.dmp family_formbook behavioral2/memory/4560-27-0x0000000000490000-0x00000000004CF000-memory.dmp family_formbook behavioral2/memory/4560-30-0x0000000000490000-0x00000000004CF000-memory.dmp family_formbook - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/5360-14-0x0000000001840000-0x0000000001C40000-memory.dmp autoit_exe - Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 5360 set thread context of 1676 5360 fd4fa972a80b38a4a561bc647bf3720248f81eb85fe719f51fe8dc3965e7f330.exe 79 PID 1676 set thread context of 3284 1676 svchost.exe 53 PID 1676 set thread context of 4560 1676 svchost.exe 83 PID 4560 set thread context of 3284 4560 netbtugc.exe 53 PID 4560 set thread context of 2676 4560 netbtugc.exe 84 - Program crash 1 IoCs
pid pid_target Process procid_target 3936 5360 WerFault.exe 78 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fd4fa972a80b38a4a561bc647bf3720248f81eb85fe719f51fe8dc3965e7f330.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netbtugc.exe -
description ioc Process Key created \Registry\User\S-1-5-21-625765727-1271952295-745797415-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 netbtugc.exe - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 1676 svchost.exe 1676 svchost.exe 1676 svchost.exe 1676 svchost.exe 1676 svchost.exe 1676 svchost.exe 1676 svchost.exe 1676 svchost.exe 1676 svchost.exe 1676 svchost.exe 1676 svchost.exe 1676 svchost.exe 1676 svchost.exe 1676 svchost.exe 1676 svchost.exe 1676 svchost.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3284 Explorer.EXE - Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 5360 fd4fa972a80b38a4a561bc647bf3720248f81eb85fe719f51fe8dc3965e7f330.exe 1676 svchost.exe 3284 Explorer.EXE 3284 Explorer.EXE 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe 4560 netbtugc.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5360 fd4fa972a80b38a4a561bc647bf3720248f81eb85fe719f51fe8dc3965e7f330.exe 5360 fd4fa972a80b38a4a561bc647bf3720248f81eb85fe719f51fe8dc3965e7f330.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 5360 fd4fa972a80b38a4a561bc647bf3720248f81eb85fe719f51fe8dc3965e7f330.exe 5360 fd4fa972a80b38a4a561bc647bf3720248f81eb85fe719f51fe8dc3965e7f330.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5360 wrote to memory of 1676 5360 fd4fa972a80b38a4a561bc647bf3720248f81eb85fe719f51fe8dc3965e7f330.exe 79 PID 5360 wrote to memory of 1676 5360 fd4fa972a80b38a4a561bc647bf3720248f81eb85fe719f51fe8dc3965e7f330.exe 79 PID 5360 wrote to memory of 1676 5360 fd4fa972a80b38a4a561bc647bf3720248f81eb85fe719f51fe8dc3965e7f330.exe 79 PID 5360 wrote to memory of 1676 5360 fd4fa972a80b38a4a561bc647bf3720248f81eb85fe719f51fe8dc3965e7f330.exe 79 PID 3284 wrote to memory of 4560 3284 Explorer.EXE 83 PID 3284 wrote to memory of 4560 3284 Explorer.EXE 83 PID 3284 wrote to memory of 4560 3284 Explorer.EXE 83 PID 4560 wrote to memory of 2676 4560 netbtugc.exe 84 PID 4560 wrote to memory of 2676 4560 netbtugc.exe 84
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\fd4fa972a80b38a4a561bc647bf3720248f81eb85fe719f51fe8dc3965e7f330.exe"C:\Users\Admin\AppData\Local\Temp\fd4fa972a80b38a4a561bc647bf3720248f81eb85fe719f51fe8dc3965e7f330.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\fd4fa972a80b38a4a561bc647bf3720248f81eb85fe719f51fe8dc3965e7f330.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1676
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5360 -s 7923⤵
- Program crash
PID:3936
-
-
-
C:\Windows\SysWOW64\netbtugc.exe"C:\Windows\SysWOW64\netbtugc.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:2676
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5360 -ip 53601⤵PID:4668
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\aut6B5D.tmp
- Size 264KB
- SHA256 fa90a5cb836a6130117ed7c2bbfa28ae9b259b647733a80512d55d4fae8157bf
- MD5 b580b98dbedaaff38e1cbb0b4f914384
- SHA1 40d7c876eabfe9d4dba1803ab7bc8a561ae1bf4e
- SHA512 bc6056d57c9ce226617f0a0681d405bfb0e6efa554eafc35d6c08f152c2d09128179102773b44f0abe89186f78ca63fedafa230fcf1568efbbb6d9d20e2152a1
- SSDEEP 6144:S2Dfl6YfZqfigOiWBKhohe1VxbqnbPz83o2SPUOgQSVg9IRk:Hl6UZqfi15i1VKoRSMtk
- MD5 SHA1 SHA512 SSDEEP