Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
23-02-2021 12:55
Static task
static1
Behavioral task
behavioral1
Sample
PO-29840032.exe
Resource
win7v20201028
General
-
Target
PO-29840032.exe
-
Size
495KB
-
MD5
16a8bcda6b8877e2a76f56ac5707eaa8
-
SHA1
2f6a4a474c53183a14ef815d2f3aa9cdb6a0b545
-
SHA256
4116c5111907369d23e1a5f7adf2b0cd13186d6155a8f9406b794f191180f914
-
SHA512
6cacea9c50c6f5d8fa96a6c8047db43458cd5159e87fe3c0807599b21ba80d4f31649b0f26c51edc352c0f55f2c405e32131d81baa70c0547a556efd253ad380
Malware Config
Extracted
formbook
http://www.merckcbd.com/dei5/
studiomullerphoto.com
reallionairewear.com
dogsalondoggy-tail.com
excelmache.net
bigdiscounters.com
7986799.com
ignition.guru
xiaoxu.info
jpinpd.com
solpool.info
uchooswrewards.com
everestengineeringworks.com
qianglongzhipin.com
deepimper-325.com
appliedrate.com
radsazemehr.com
vivabematividadesfisicas.com
capacitalo.com
somecore.com
listingclass.net
romel.codes
mybettermentor.com
hxc43.com
btccvil312723.com
rudiskenya.com
internationalrockmusic.com
wudiwifi.com
scienceacademyraj.com
tumulusinnovations.com
studioeduardobeninca.com
formabench.com
ribbonredwhiteandblue.com
miningequipmentrental.com
myamom.com
riversportswear.net
14505glenmarkdr.com
nikolcosmetic.com
toninopr.com
cutfortheconnect.com
nl22584.com
mezokovesd.com
rozhandesign.com
futbolki.space
rmobipanoshop.com
merchmuslim.com
recurrentcornealerosion.com
enottampan.com
vasquez.photos
koreanmindbeauty.com
andressabode.com
thetwolouises.com
weberbyroble.com
followmargpolo.com
englishclubb.online
sorryididnthearthat.com
greatlookfashion.club
cartoleriagrillocatania.com
esteprize.com
sdsej.com
phiecraft.xyz
psm-gen.com
passivefiresafe.com
homeyplantycosy.com
0343888.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3672-15-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3672-16-0x000000000041ECD0-mapping.dmp formbook behavioral2/memory/2100-24-0x0000000000CC0000-0x0000000000CEE000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO-29840032.exePO-29840032.execmmon32.exedescription pid process target process PID 640 set thread context of 3672 640 PO-29840032.exe PO-29840032.exe PID 3672 set thread context of 2580 3672 PO-29840032.exe Explorer.EXE PID 2100 set thread context of 2580 2100 cmmon32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
PO-29840032.execmmon32.exepid process 3672 PO-29840032.exe 3672 PO-29840032.exe 3672 PO-29840032.exe 3672 PO-29840032.exe 2100 cmmon32.exe 2100 cmmon32.exe 2100 cmmon32.exe 2100 cmmon32.exe 2100 cmmon32.exe 2100 cmmon32.exe 2100 cmmon32.exe 2100 cmmon32.exe 2100 cmmon32.exe 2100 cmmon32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PO-29840032.execmmon32.exepid process 3672 PO-29840032.exe 3672 PO-29840032.exe 3672 PO-29840032.exe 2100 cmmon32.exe 2100 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO-29840032.execmmon32.exedescription pid process Token: SeDebugPrivilege 3672 PO-29840032.exe Token: SeDebugPrivilege 2100 cmmon32.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
PO-29840032.exeExplorer.EXEcmmon32.exedescription pid process target process PID 640 wrote to memory of 2532 640 PO-29840032.exe schtasks.exe PID 640 wrote to memory of 2532 640 PO-29840032.exe schtasks.exe PID 640 wrote to memory of 2532 640 PO-29840032.exe schtasks.exe PID 640 wrote to memory of 3672 640 PO-29840032.exe PO-29840032.exe PID 640 wrote to memory of 3672 640 PO-29840032.exe PO-29840032.exe PID 640 wrote to memory of 3672 640 PO-29840032.exe PO-29840032.exe PID 640 wrote to memory of 3672 640 PO-29840032.exe PO-29840032.exe PID 640 wrote to memory of 3672 640 PO-29840032.exe PO-29840032.exe PID 640 wrote to memory of 3672 640 PO-29840032.exe PO-29840032.exe PID 2580 wrote to memory of 2100 2580 Explorer.EXE cmmon32.exe PID 2580 wrote to memory of 2100 2580 Explorer.EXE cmmon32.exe PID 2580 wrote to memory of 2100 2580 Explorer.EXE cmmon32.exe PID 2100 wrote to memory of 1616 2100 cmmon32.exe cmd.exe PID 2100 wrote to memory of 1616 2100 cmmon32.exe cmd.exe PID 2100 wrote to memory of 1616 2100 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO-29840032.exe"C:\Users\Admin\AppData\Local\Temp\PO-29840032.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eejXKlefbIzpJy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4AB1.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PO-29840032.exe"C:\Users\Admin\AppData\Local\Temp\PO-29840032.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO-29840032.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4AB1.tmpMD5
face80302ae4cf229a321000805684c4
SHA1a88b083571d953aa4b9b4cdcece284dbf7bef8b7
SHA256b195d688283b0b7bb40e86674a3df6d27c3198ca3bb13e0c50b29ee4b3483d4e
SHA51269191376d44640516e7c6540f2bb4decb6b6f902386cb1b5d7945caa6aadba6079d49cf8313e47a24074e6ab18696cbb0884899c921c2780f4981fd3aa96e4bf
-
memory/640-2-0x0000000073F80000-0x000000007466E000-memory.dmpFilesize
6.9MB
-
memory/640-3-0x00000000009C0000-0x00000000009C1000-memory.dmpFilesize
4KB
-
memory/640-5-0x00000000053C0000-0x00000000053C1000-memory.dmpFilesize
4KB
-
memory/640-6-0x0000000005960000-0x0000000005961000-memory.dmpFilesize
4KB
-
memory/640-7-0x0000000005500000-0x0000000005501000-memory.dmpFilesize
4KB
-
memory/640-8-0x00000000053A0000-0x00000000053A1000-memory.dmpFilesize
4KB
-
memory/640-9-0x0000000005660000-0x0000000005661000-memory.dmpFilesize
4KB
-
memory/640-10-0x0000000005360000-0x0000000005361000-memory.dmpFilesize
4KB
-
memory/640-11-0x0000000005850000-0x0000000005853000-memory.dmpFilesize
12KB
-
memory/640-12-0x0000000001240000-0x0000000001295000-memory.dmpFilesize
340KB
-
memory/1616-23-0x0000000000000000-mapping.dmp
-
memory/2100-22-0x0000000001130000-0x000000000113C000-memory.dmpFilesize
48KB
-
memory/2100-21-0x0000000000000000-mapping.dmp
-
memory/2100-24-0x0000000000CC0000-0x0000000000CEE000-memory.dmpFilesize
184KB
-
memory/2100-25-0x0000000004540000-0x0000000004860000-memory.dmpFilesize
3.1MB
-
memory/2100-26-0x0000000000ED0000-0x0000000000F63000-memory.dmpFilesize
588KB
-
memory/2532-13-0x0000000000000000-mapping.dmp
-
memory/2580-20-0x0000000006050000-0x00000000061B5000-memory.dmpFilesize
1.4MB
-
memory/2580-27-0x00000000061C0000-0x00000000062D7000-memory.dmpFilesize
1.1MB
-
memory/3672-16-0x000000000041ECD0-mapping.dmp
-
memory/3672-18-0x0000000001800000-0x0000000001B20000-memory.dmpFilesize
3.1MB
-
memory/3672-19-0x00000000012F0000-0x0000000001304000-memory.dmpFilesize
80KB
-
memory/3672-15-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB