Analysis
-
max time kernel
146s -
max time network
143s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
08-04-2021 07:03
Static task
static1
Behavioral task
behavioral1
Sample
ORDER7946ERA-LBT.exe
Resource
win7v20201028
General
-
Target
ORDER7946ERA-LBT.exe
-
Size
664KB
-
MD5
b36e69f884b74fe568bdb7fdb06362cb
-
SHA1
e17782339164117645128597cfd22152c80cf229
-
SHA256
9f578e7bf0375c366223406cd1504c79feb2f2408f88ffbccc22cd1bc3237389
-
SHA512
ab22ad98a9a14be9607e7205384cf77e937715fcbd90f2dad240d0992094c6f0e945db0eca96081dc4728b22fe658cfb6936e123ebf1b802e045e433e2ea7792
Malware Config
Extracted
formbook
4.1
http://www.valoremamma.com/cw3g/
qiuxi.ltd
kylayagerartwork.com
qzgay.com
riverandroadfilms.com
easislip.com
ma3loomat.info
babyuniverses.com
ovvldbxmd.icu
fthiscompany.com
tabac-control.com
x7exf2.com
juxrams.info
californialaserspinesurgery.com
theindielawyer.com
jxaotu.com
epostakutun.com
pappyjackburgershack.com
fgafinancialgroup.com
ddiesels.com
thesixthdesign.com
dunesrealtygroup.com
thorntonhillshousecleaning.com
xmgzj.com
np9co.com
sumerueduneed.com
harveyvargas.com
dpriew.com
mama-hochet-seksa.site
theforbiddentoybox.com
manhassetcarwash.com
dailyhealthyvibes.info
flutterlashestoronto.com
echelonfurniture.com
moukarram.com
burateamtr.net
psicobiologiadelser.com
theleave.club
texasapartmentinvestorclub.com
yul2.com
peixotoepeixotos.com
neflcounseling.com
awatabi.com
goodpractiz.com
smileworkscorp.com
oreshola.com
xn--m3ciavumc0b2aba4gwjkb9e.com
20dzb.com
lovvlens.com
awesomequery.com
sohailacollection.com
westglobaladvisors.com
virginiaelderlawattorney.com
sabariindustries.com
ownyourmoan.com
cricybuzz.com
sapxml.com
tndhaulingllc.com
hrzqjd.com
ortholasercenter.com
suzukisunter.com
geduvinware.com
japmenthe.com
pgdump.guru
couplesofhouston.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2076-17-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2076-18-0x000000000041ED90-mapping.dmp formbook behavioral2/memory/4428-27-0x0000000000A10000-0x0000000000A3E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
ORDER7946ERA-LBT.exeORDER7946ERA-LBT.exeNETSTAT.EXEdescription pid process target process PID 4684 set thread context of 2076 4684 ORDER7946ERA-LBT.exe ORDER7946ERA-LBT.exe PID 2076 set thread context of 3128 2076 ORDER7946ERA-LBT.exe Explorer.EXE PID 4428 set thread context of 3128 4428 NETSTAT.EXE Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 4428 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
ORDER7946ERA-LBT.exeORDER7946ERA-LBT.exeNETSTAT.EXEpid process 4684 ORDER7946ERA-LBT.exe 4684 ORDER7946ERA-LBT.exe 4684 ORDER7946ERA-LBT.exe 4684 ORDER7946ERA-LBT.exe 4684 ORDER7946ERA-LBT.exe 2076 ORDER7946ERA-LBT.exe 2076 ORDER7946ERA-LBT.exe 2076 ORDER7946ERA-LBT.exe 2076 ORDER7946ERA-LBT.exe 4428 NETSTAT.EXE 4428 NETSTAT.EXE 4428 NETSTAT.EXE 4428 NETSTAT.EXE 4428 NETSTAT.EXE 4428 NETSTAT.EXE 4428 NETSTAT.EXE 4428 NETSTAT.EXE 4428 NETSTAT.EXE 4428 NETSTAT.EXE 4428 NETSTAT.EXE 4428 NETSTAT.EXE 4428 NETSTAT.EXE 4428 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
ORDER7946ERA-LBT.exeNETSTAT.EXEpid process 2076 ORDER7946ERA-LBT.exe 2076 ORDER7946ERA-LBT.exe 2076 ORDER7946ERA-LBT.exe 4428 NETSTAT.EXE 4428 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
ORDER7946ERA-LBT.exeORDER7946ERA-LBT.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 4684 ORDER7946ERA-LBT.exe Token: SeDebugPrivilege 2076 ORDER7946ERA-LBT.exe Token: SeDebugPrivilege 4428 NETSTAT.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
ORDER7946ERA-LBT.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 4684 wrote to memory of 4304 4684 ORDER7946ERA-LBT.exe schtasks.exe PID 4684 wrote to memory of 4304 4684 ORDER7946ERA-LBT.exe schtasks.exe PID 4684 wrote to memory of 4304 4684 ORDER7946ERA-LBT.exe schtasks.exe PID 4684 wrote to memory of 2092 4684 ORDER7946ERA-LBT.exe ORDER7946ERA-LBT.exe PID 4684 wrote to memory of 2092 4684 ORDER7946ERA-LBT.exe ORDER7946ERA-LBT.exe PID 4684 wrote to memory of 2092 4684 ORDER7946ERA-LBT.exe ORDER7946ERA-LBT.exe PID 4684 wrote to memory of 2076 4684 ORDER7946ERA-LBT.exe ORDER7946ERA-LBT.exe PID 4684 wrote to memory of 2076 4684 ORDER7946ERA-LBT.exe ORDER7946ERA-LBT.exe PID 4684 wrote to memory of 2076 4684 ORDER7946ERA-LBT.exe ORDER7946ERA-LBT.exe PID 4684 wrote to memory of 2076 4684 ORDER7946ERA-LBT.exe ORDER7946ERA-LBT.exe PID 4684 wrote to memory of 2076 4684 ORDER7946ERA-LBT.exe ORDER7946ERA-LBT.exe PID 4684 wrote to memory of 2076 4684 ORDER7946ERA-LBT.exe ORDER7946ERA-LBT.exe PID 3128 wrote to memory of 4428 3128 Explorer.EXE NETSTAT.EXE PID 3128 wrote to memory of 4428 3128 Explorer.EXE NETSTAT.EXE PID 3128 wrote to memory of 4428 3128 Explorer.EXE NETSTAT.EXE PID 4428 wrote to memory of 4404 4428 NETSTAT.EXE cmd.exe PID 4428 wrote to memory of 4404 4428 NETSTAT.EXE cmd.exe PID 4428 wrote to memory of 4404 4428 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ORDER7946ERA-LBT.exe"C:\Users\Admin\AppData\Local\Temp\ORDER7946ERA-LBT.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QRUZjOQK" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCB5F.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\ORDER7946ERA-LBT.exe"C:\Users\Admin\AppData\Local\Temp\ORDER7946ERA-LBT.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\ORDER7946ERA-LBT.exe"C:\Users\Admin\AppData\Local\Temp\ORDER7946ERA-LBT.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ORDER7946ERA-LBT.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpCB5F.tmpMD5
6cc1a33515e4cae6891300179f3e9a45
SHA1a54f5e4e99e99f2f8b9015a7ba42f92361b9bc28
SHA256a8e788dbad18166153cd975b4f6d4d789fa248f296fa3ed96994ff276eb5d601
SHA512b06237e210133642ba3d7837a292fd3ce9e7ae52dd75d6cc92410bfb5afb8e0a12b7100f02c9985f25ec87fac284b7c6aad050fadc3f72241d86b241b6567105
-
memory/2076-21-0x0000000000F40000-0x0000000001260000-memory.dmpFilesize
3.1MB
-
memory/2076-22-0x0000000000EE0000-0x0000000000EF4000-memory.dmpFilesize
80KB
-
memory/2076-18-0x000000000041ED90-mapping.dmp
-
memory/2076-17-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3128-30-0x0000000000AF0000-0x0000000000BD5000-memory.dmpFilesize
916KB
-
memory/3128-23-0x00000000062B0000-0x000000000645B000-memory.dmpFilesize
1.7MB
-
memory/4304-15-0x0000000000000000-mapping.dmp
-
memory/4404-25-0x0000000000000000-mapping.dmp
-
memory/4428-24-0x0000000000000000-mapping.dmp
-
memory/4428-29-0x00000000032B0000-0x0000000003343000-memory.dmpFilesize
588KB
-
memory/4428-28-0x00000000033A0000-0x00000000036C0000-memory.dmpFilesize
3.1MB
-
memory/4428-26-0x0000000000AF0000-0x0000000000AFB000-memory.dmpFilesize
44KB
-
memory/4428-27-0x0000000000A10000-0x0000000000A3E000-memory.dmpFilesize
184KB
-
memory/4684-2-0x0000000073900000-0x0000000073FEE000-memory.dmpFilesize
6.9MB
-
memory/4684-8-0x0000000004D00000-0x0000000004D01000-memory.dmpFilesize
4KB
-
memory/4684-7-0x0000000004EB0000-0x0000000004EB1000-memory.dmpFilesize
4KB
-
memory/4684-6-0x0000000005310000-0x0000000005311000-memory.dmpFilesize
4KB
-
memory/4684-5-0x0000000004D30000-0x0000000004D31000-memory.dmpFilesize
4KB
-
memory/4684-9-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/4684-10-0x0000000004EA0000-0x0000000004EA1000-memory.dmpFilesize
4KB
-
memory/4684-11-0x0000000008460000-0x0000000008464000-memory.dmpFilesize
16KB
-
memory/4684-14-0x0000000000DC0000-0x0000000000DF3000-memory.dmpFilesize
204KB
-
memory/4684-13-0x0000000000C00000-0x0000000000C78000-memory.dmpFilesize
480KB
-
memory/4684-3-0x0000000000310000-0x0000000000311000-memory.dmpFilesize
4KB
-
memory/4684-12-0x000000007EC40000-0x000000007EC41000-memory.dmpFilesize
4KB