Analysis
- max time kernel
150s - max time network
131s - platform
windows11-21h2_x64 - resource
win11-20250905-en - resource tags
arch:x64arch:x86image:win11-20250905-enlocale:en-usos:windows11-21h2-x64system - submitted
09/10/2025, 04:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SWIFT_75,000EURO.exe
Resource
win10v2004-20250610-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target SWIFT_75,000EURO.exe
- Size 585KB
- Sample251009-e71kysywfw
- SHA256 412a097d36135d1c09ef2e81f3fac61e43037670822ff0ddea3a553bb81d0f8f
- MD5 762f00a6463f238696b22ddd004d40d8
- SHA1 1612e486bdf2d45e41dc616208163947247e436c
- SHA512 fe4a5f2c4ab76dd92eb7b761d0e67dd8ccbfe52edd9c5037751a14a986bdda8e543967caf8339967eb61d665678d809b0954972efff38596db9521fbdda6c9df
- SSDEEP 12288:j7k4rDU/F4aJmGwHGUqY8xRHxE2KOf/yWMW/82koS6sEiFGOxFuaDcN:U4mmGwHjl8z7f/yWMW/N8REBa
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
sg36
Decoy
-
iwo7n.top
-
teluge.top
-
usman.vip
-
badan-drc-tusabv.info
-
aabodl.vip
-
luecap.xyz
-
c3024.top
-
oreaimoremoney.net
-
ushattention.tokyo
-
vcxb.xyz
-
esr.dev
-
aytime-sleepiness-79553.bond
-
ardrop.dev
-
y55ut8.pro
-
ling-it-up.xyz
-
ostepnosc.net
-
ebt-management.sbs
-
rkada4608.buzz
-
aquishaportfolio.net
-
onin69slot.net
-
badiahmuriithiwachira.cfd
-
o55bm.top
-
igtech.net
-
gileplanner.cloud
-
ineflaire.shop
-
upvwp.top
-
7cq.net
-
hidingllc.shop
-
g51-lzal1646.vip
-
refabricated-homes-22120.bond
-
oastwithjam.net
-
wcer.top
-
etablr.click
-
2675.click
-
nything-foo.bar
-
etivaeqiuq.pro
-
c1723.top
-
remation-services-51778.bond
-
layworld-club.xyz
-
zsjelmqkruv.xyz
-
herice.tech
-
ocsimples.top
-
7sfb5.top
-
ellygardner.shop
-
arsity-tutors.cfd
-
tormi.net
-
34a.vip
-
quqwb.top
-
ffshoreexecshub.shop
-
luprintpros.net
-
b177.top
-
accu.net
-
opycatinkteam.click
-
eamglobaltalenthub.shop
-
u7xgk.top
-
8644.club
-
yudn.shop
-
c1045.top
-
ura.shop
-
etmoonbuggy.click
-
ass.lat
-
hinecrest.shop
-
24-va9q13.rest
-
e520.net
-
ome-pest-control-9evich.zone
Signatures
- Formbook family
- Formbook payload 4 IoCs
resource yara_rule behavioral2/memory/4948-10-0x0000000000400000-0x000000000042F000-memory.dmp family_formbook behavioral2/memory/4948-14-0x0000000000400000-0x000000000042F000-memory.dmp family_formbook behavioral2/memory/488-22-0x00000000001B0000-0x00000000001DF000-memory.dmp family_formbook behavioral2/memory/488-24-0x00000000001B0000-0x00000000001DF000-memory.dmp family_formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3016 set thread context of 4948 3016 SWIFT_75,000EURO.exe 78 PID 4948 set thread context of 3256 4948 SWIFT_75,000EURO.exe 53 PID 488 set thread context of 3256 488 msiexec.exe 53 - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SWIFT_75,000EURO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 4948 SWIFT_75,000EURO.exe 4948 SWIFT_75,000EURO.exe 4948 SWIFT_75,000EURO.exe 4948 SWIFT_75,000EURO.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe 488 msiexec.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3256 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 4948 SWIFT_75,000EURO.exe 4948 SWIFT_75,000EURO.exe 4948 SWIFT_75,000EURO.exe 488 msiexec.exe 488 msiexec.exe - Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: SeDebugPrivilege 4948 SWIFT_75,000EURO.exe Token: SeDebugPrivilege 488 msiexec.exe Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE Token: SeShutdownPrivilege 3256 Explorer.EXE Token: SeCreatePagefilePrivilege 3256 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3256 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3016 wrote to memory of 4948 3016 SWIFT_75,000EURO.exe 78 PID 3016 wrote to memory of 4948 3016 SWIFT_75,000EURO.exe 78 PID 3016 wrote to memory of 4948 3016 SWIFT_75,000EURO.exe 78 PID 3016 wrote to memory of 4948 3016 SWIFT_75,000EURO.exe 78 PID 3016 wrote to memory of 4948 3016 SWIFT_75,000EURO.exe 78 PID 3016 wrote to memory of 4948 3016 SWIFT_75,000EURO.exe 78 PID 3256 wrote to memory of 488 3256 Explorer.EXE 79 PID 3256 wrote to memory of 488 3256 Explorer.EXE 79 PID 3256 wrote to memory of 488 3256 Explorer.EXE 79 PID 488 wrote to memory of 3832 488 msiexec.exe 80 PID 488 wrote to memory of 3832 488 msiexec.exe 80 PID 488 wrote to memory of 3832 488 msiexec.exe 80
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\SWIFT_75,000EURO.exe"C:\Users\Admin\AppData\Local\Temp\SWIFT_75,000EURO.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\SWIFT_75,000EURO.exe"C:\Users\Admin\AppData\Local\Temp\SWIFT_75,000EURO.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4948
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SWIFT_75,000EURO.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3832
-
-