Overview

overview

10

Static

static

1.exe

windows7_x64

10

1.exe

windows10_x64

10

Analysis

  • max time kernel
    33s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    16-08-2020 18:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1.exe

  • Size

    12.5MB

  • MD5

    af8e86c5d4198549f6375df9378f983c

  • SHA1

    7ab5ed449b891bd4899fba62d027a2cc26a05e6f

  • SHA256

    7570a7a6830ade05dcf862d5862f12f12445dbd3c0ad7433d90872849e11c267

  • SHA512

    137f5a281aa15802e300872fdf93b9ee014d2077c29d30e5a029664eb0991af2afbe1e5c53a9d7bff8f0508393a8b7641c5a97b4b0e0061befb79a93506c94e1

Score
10/10
dharmaformbookagilenetcoreentityevasionpersistenceransomwareratrezer0spywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.0

C2

http://www.worstig.com/w9z/

Decoy

crazzysex.com

hanferd.com

gteesrd.com

bayfrontbabyplace.com

jicuiquan.net

relationshiplink.net

ohchacyberphoto.com

kauegimenes.com

powerful-seldom.com

ketotoken.com

make-money-online-success.com

redgoldcollection.com

hannan-football.com

hamptondc.com

vllii.com

aa8520.com

platform35markethall.com

larozeimmo.com

oligopoly.net

llhak.info

Signatures

  • CoreEntity .NET Packer 1 IoCs

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity
  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook Payload 3 IoCs
    rat
  • Looks for VirtualBox Guest Additions in registry 2 TTPs
    evasion
  • ReZer0 packer 1 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0
  • Executes dropped EXE 16 IoCs
  • Looks for VMWare Tools registry key 2 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks QEMU agent file 2 TTPs 1 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Drops startup file 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Drops desktop.ini file(s) 3 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\Users\Admin\AppData\Local\Temp\1.exe
      "C:\Users\Admin\AppData\Local\Temp\1.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3588
      • C:\Windows\System32\cmd.exe
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\F3D5.tmp\F3D6.tmp\F3E7.bat C:\Users\Admin\AppData\Local\Temp\1.exe"
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3856
        • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
          "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\1.jar"
          4⤵
            PID:3916
          • C:\Users\Admin\AppData\Roaming\2.exe
            C:\Users\Admin\AppData\Roaming\2.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:1908
            • C:\Users\Admin\AppData\Roaming\2.exe
              C:\Users\Admin\AppData\Roaming\2.exe
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              PID:2992
          • C:\Users\Admin\AppData\Roaming\3.exe
            C:\Users\Admin\AppData\Roaming\3.exe
            4⤵
            • Executes dropped EXE
            • Checks QEMU agent file
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3292
            • C:\Users\Admin\AppData\Roaming\3.exe
              C:\Users\Admin\AppData\Roaming\3.exe
              5⤵
              • Loads dropped DLL
              PID:424
          • C:\Users\Admin\AppData\Roaming\4.exe
            C:\Users\Admin\AppData\Roaming\4.exe
            4⤵
            • Executes dropped EXE
            PID:3208
          • C:\Users\Admin\AppData\Roaming\5.exe
            C:\Users\Admin\AppData\Roaming\5.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:3172
          • C:\Users\Admin\AppData\Roaming\6.exe
            C:\Users\Admin\AppData\Roaming\6.exe
            4⤵
            • Executes dropped EXE
            PID:3888
          • C:\Users\Admin\AppData\Roaming\7.exe
            C:\Users\Admin\AppData\Roaming\7.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:652
          • C:\Users\Admin\AppData\Roaming\8.exe
            C:\Users\Admin\AppData\Roaming\8.exe
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1060
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1764
              • C:\Windows\SysWOW64\reg.exe
                REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"
                6⤵
                • Adds Run key to start application
                PID:912
          • C:\Users\Admin\AppData\Roaming\9.exe
            C:\Users\Admin\AppData\Roaming\9.exe
            4⤵
            • Executes dropped EXE
            PID:1468
          • C:\Users\Admin\AppData\Roaming\10.exe
            C:\Users\Admin\AppData\Roaming\10.exe
            4⤵
            • Executes dropped EXE
            PID:1928
          • C:\Users\Admin\AppData\Roaming\11.exe
            C:\Users\Admin\AppData\Roaming\11.exe
            4⤵
            • Executes dropped EXE
            • Checks BIOS information in registry
            • Maps connected drives based on registry
            PID:2776
          • C:\Users\Admin\AppData\Roaming\12.exe
            C:\Users\Admin\AppData\Roaming\12.exe
            4⤵
            • Executes dropped EXE
            PID:616
          • C:\Users\Admin\AppData\Roaming\13.exe
            C:\Users\Admin\AppData\Roaming\13.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:1644
          • C:\Users\Admin\AppData\Roaming\14.exe
            C:\Users\Admin\AppData\Roaming\14.exe
            4⤵
            • Executes dropped EXE
            PID:2788
          • C:\Users\Admin\AppData\Roaming\15.exe
            C:\Users\Admin\AppData\Roaming\15.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2828
          • C:\Users\Admin\AppData\Roaming\16.exe
            C:\Users\Admin\AppData\Roaming\16.exe
            4⤵
            • Executes dropped EXE
            • Drops startup file
            • Adds Run key to start application
            • Drops desktop.ini file(s)
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            PID:1768
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe"
              5⤵
                PID:2096
        • C:\Windows\SysWOW64\mstsc.exe
          "C:\Windows\SysWOW64\mstsc.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:576
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Users\Admin\AppData\Roaming\2.exe"
            3⤵
              PID:1812

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/576-54-0x00000000000C0000-0x00000000003BC000-memory.dmp

          Filesize

          3.0MB

          Download

        • memory/576-56-0x00000000000C0000-0x00000000003BC000-memory.dmp

          Filesize

          3.0MB

          Download

        • memory/1060-65-0x00000000054B0000-0x00000000054B1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1060-78-0x0000000005850000-0x0000000005851000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1060-48-0x00000000710E0000-0x00000000717CE000-memory.dmp

          Filesize

          6.9MB

          Download

        • memory/1060-52-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1060-60-0x00000000058C0000-0x00000000058C1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1060-58-0x0000000002B90000-0x0000000002B9F000-memory.dmp

          Filesize

          60KB

          Download

        • memory/1060-63-0x0000000002BA0000-0x0000000002BA2000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1060-76-0x00000000056C0000-0x00000000056C2000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1060-80-0x00000000056D0000-0x00000000056D2000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1468-93-0x0000000008C80000-0x0000000008CD3000-memory.dmp

          Filesize

          332KB

          Download

        • memory/1468-71-0x0000000000C70000-0x0000000000C71000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1468-95-0x0000000008D80000-0x0000000008D81000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1468-83-0x0000000005560000-0x0000000005561000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1468-68-0x00000000710E0000-0x00000000717CE000-memory.dmp

          Filesize

          6.9MB

          Download

        • memory/1468-91-0x00000000057C0000-0x00000000057C2000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1928-136-0x0000000002FA3000-0x0000000002FA4000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1928-138-0x0000000003090000-0x0000000003091000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2992-15-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

          Download

        • memory/3208-116-0x0000000003690000-0x0000000003691000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3888-34-0x0000000000500000-0x0000000000510000-memory.dmp

          Filesize

          64KB

          Download