Overview
overview
10Static
static
81.bin/1.bin.exe
windows7_x64
101.bin/1.bin.exe
windows10_x64
102019-09-02...10.exe
windows7_x64
102019-09-02...10.exe
windows10_x64
1031.exe
windows7_x64
1031.exe
windows10_x64
103DMark 11 ...on.exe
windows7_x64
13DMark 11 ...on.exe
windows10_x64
15da0116af4...18.exe
windows7_x64
85da0116af4...18.exe
windows10_x64
8Archive.zi...3e.exe
windows7_x64
8Archive.zi...3e.exe
windows10_x64
8CVE-2018-1...oC.swf
windows7_x64
3CVE-2018-1...oC.swf
windows10_x64
3CVWSHSetup...1].exe
windows7_x64
3CVWSHSetup...1].exe
windows10_x64
3DiskIntern...en.exe
windows7_x64
1DiskIntern...en.exe
windows10_x64
1ForceOp 2....ce.exe
windows7_x64
10ForceOp 2....ce.exe
windows10_x64
10HYDRA.exe
windows7_x64
10HYDRA.exe
windows10_x64
10Keygen.exe
windows7_x64
10Keygen.exe
windows10_x64
10Lonelyscre...ox.exe
windows7_x64
1Lonelyscre...ox.exe
windows10_x64
1LtHv0O2KZDK4M637.exe
windows7_x64
10LtHv0O2KZDK4M637.exe
windows10_x64
10Magic_File...ja.exe
windows7_x64
1Magic_File...ja.exe
windows10_x64
1OnlineInstaller.exe
windows7_x64
8OnlineInstaller.exe
windows10_x64
8Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-11-2020 16:58
Static task
static1
Behavioral task
behavioral1
Sample
1.bin/1.bin.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral2
Sample
1.bin/1.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral3
Sample
2019-09-02_22-41-10.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral4
Sample
2019-09-02_22-41-10.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral5
Sample
31.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral6
Sample
31.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral7
Sample
3DMark 11 Advanced Edition.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral8
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral9
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral10
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral11
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral12
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral13
Sample
CVE-2018-15982_PoC.swf
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral14
Sample
CVE-2018-15982_PoC.swf
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral15
Sample
CVWSHSetup[1].bin/WSHSetup[1].exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral16
Sample
CVWSHSetup[1].bin/WSHSetup[1].exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral17
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral18
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral19
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral20
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral21
Sample
HYDRA.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral22
Sample
HYDRA.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral23
Sample
Keygen.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral24
Sample
Keygen.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral25
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox/Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral26
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox/Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral27
Sample
LtHv0O2KZDK4M637.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral28
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral29
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral30
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral31
Sample
OnlineInstaller.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral32
Sample
OnlineInstaller.exe
Resource
win10v20201028
windows10_x64
Malware Config
Extracted
formbook
4.0
http://www.worstig.com/w9z/
crazzysex.com
hanferd.com
gteesrd.com
bayfrontbabyplace.com
jicuiquan.net
relationshiplink.net
ohchacyberphoto.com
kauegimenes.com
powerful-seldom.com
ketotoken.com
make-money-online-success.com
redgoldcollection.com
hannan-football.com
hamptondc.com
vllii.com
aa8520.com
platform35markethall.com
larozeimmo.com
oligopoly.net
llhak.info
fisioservice.com
tesla-magnumopus.com
cocodrilodigital.com
pinegrovesg.com
traveladventureswithme.com
hebitaixin.com
golphysi.com
gayjeans.com
quickhire.expert
randomviews1.com
eatatnobu.com
topmabati.com
mediaupside.com
spillerakademi.com
thebowtie.store
sensomaticloadcell.com
turismodemadrid.net
yuhe89.com
wernerkrug.com
cdpogo.net
dannynhois.com
realestatestructureddata.com
matewhereareyou.net
laimeibei.ltd
sw328.com
lmwworks.net
xtremefish.com
tonerias.com
dsooneclinicianexpert.com
281clara.com
smmcommunity.net
dreamneeds.info
twocraft.com
yasasiite.salon
advk8qi.top
drabist.com
europartnersplus.com
saltbgone.com
teslaoceanic.info
bestmedicationstore.com
buynewcartab.live
prospect.money
viebrocks.com
transportationhappy.com
Signatures
-
Formbook Payload 3 IoCs
resource yara_rule behavioral1/memory/1764-14-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/1764-15-0x000000000041E2D0-mapping.dmp formbook behavioral1/memory/1784-18-0x0000000000000000-mapping.dmp formbook -
Executes dropped EXE 3 IoCs
pid Process 1168 2.exe 1972 3.exe 1764 2.exe -
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
description ioc Process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe 3.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe 3.exe -
Loads dropped DLL 3 IoCs
pid Process 1168 2.exe 1972 3.exe 1260 3.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 3.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Dokumen4 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Dibromob\\PRECONCE.vbs" 3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1972 3.exe 1260 3.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1168 set thread context of 1764 1168 2.exe 31 PID 1764 set thread context of 1200 1764 2.exe 21 PID 1972 set thread context of 1260 1972 3.exe 35 PID 1784 set thread context of 1200 1784 raserver.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
pid Process 1168 2.exe 1972 3.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 1168 2.exe 1764 2.exe 1764 2.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe 1784 raserver.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1168 2.exe 1764 2.exe 1764 2.exe 1764 2.exe 1784 raserver.exe 1972 3.exe 1784 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1764 2.exe Token: SeDebugPrivilege 1784 raserver.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1972 3.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 328 wrote to memory of 1812 328 1.bin.exe 26 PID 328 wrote to memory of 1812 328 1.bin.exe 26 PID 328 wrote to memory of 1812 328 1.bin.exe 26 PID 328 wrote to memory of 1812 328 1.bin.exe 26 PID 1812 wrote to memory of 2004 1812 cmd.exe 28 PID 1812 wrote to memory of 2004 1812 cmd.exe 28 PID 1812 wrote to memory of 2004 1812 cmd.exe 28 PID 1812 wrote to memory of 1168 1812 cmd.exe 29 PID 1812 wrote to memory of 1168 1812 cmd.exe 29 PID 1812 wrote to memory of 1168 1812 cmd.exe 29 PID 1812 wrote to memory of 1168 1812 cmd.exe 29 PID 1812 wrote to memory of 1972 1812 cmd.exe 30 PID 1812 wrote to memory of 1972 1812 cmd.exe 30 PID 1812 wrote to memory of 1972 1812 cmd.exe 30 PID 1812 wrote to memory of 1972 1812 cmd.exe 30 PID 1168 wrote to memory of 1764 1168 2.exe 31 PID 1168 wrote to memory of 1764 1168 2.exe 31 PID 1168 wrote to memory of 1764 1168 2.exe 31 PID 1168 wrote to memory of 1764 1168 2.exe 31 PID 1200 wrote to memory of 1784 1200 Explorer.EXE 32 PID 1200 wrote to memory of 1784 1200 Explorer.EXE 32 PID 1200 wrote to memory of 1784 1200 Explorer.EXE 32 PID 1200 wrote to memory of 1784 1200 Explorer.EXE 32 PID 1784 wrote to memory of 1084 1784 raserver.exe 33 PID 1784 wrote to memory of 1084 1784 raserver.exe 33 PID 1784 wrote to memory of 1084 1784 raserver.exe 33 PID 1784 wrote to memory of 1084 1784 raserver.exe 33 PID 1972 wrote to memory of 1260 1972 3.exe 35 PID 1972 wrote to memory of 1260 1972 3.exe 35 PID 1972 wrote to memory of 1260 1972 3.exe 35 PID 1972 wrote to memory of 1260 1972 3.exe 35 PID 1972 wrote to memory of 1260 1972 3.exe 35
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\1.bin\1.bin.exe"C:\Users\Admin\AppData\Local\Temp\1.bin\1.bin.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6B41.tmp\6B42.tmp\6B43.bat C:\Users\Admin\AppData\Local\Temp\1.bin\1.bin.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\1.jar"4⤵PID:2004
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1764
-
-
-
C:\Users\Admin\AppData\Roaming\3.exeC:\Users\Admin\AppData\Roaming\3.exe4⤵
- Executes dropped EXE
- Checks QEMU agent file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Roaming\3.exeC:\Users\Admin\AppData\Roaming\3.exe5⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1260
-
-
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\2.exe"3⤵PID:1084
-
-