Analysis
-
max time kernel
112s -
max time network
16s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
04-05-2021 15:56
Static task
static1
Behavioral task
behavioral1
Sample
106ada585df884b13cd6a8a71e404c78.exe
Resource
win7v20210410
General
-
Target
106ada585df884b13cd6a8a71e404c78.exe
-
Size
706KB
-
MD5
106ada585df884b13cd6a8a71e404c78
-
SHA1
470e8dd108972fe65c027b9d4856aa365b69fd9e
-
SHA256
612d1888d98714893e69c4649a46a990c9c26367834d5be5afc05df15e913572
-
SHA512
aa354154c552b5ea442a980a00abd64691caf30c73bc5bfc97846c0ad394ce4e829308b99642d09ad9d2843feda689770614116092210541655b66aafc2defb2
Malware Config
Extracted
formbook
4.1
http://www.mvcsecrets.com/op9s/
uscoser.club
gustrad.com
sowftwer.com
psychicpatrol.com
lmouowgoaa.com
riandmoara.com
sushigardentogo.com
cannabimall.com
ecolodgesworld.com
mysandboxcsp.com
coxsmobility.com
sfs-distribution.info
tymict.com
u-bahn.online
chrisjohnsondrums.com
comfyscoffee.com
eastwoodlearningcenter.com
a-authenticate.com
greatroyalspices.com
legalparaprofessionalonline.com
cnn24.site
servinguprichard.com
kongtiaodz.com
priminerw.com
intrateknik.com
arabiangulfgames.com
berkona.com
herbaquni.com
aluarte.info
wuxkfowev.icu
digitalneeds.tech
practisepractice.com
upgradeindonesia.com
designinject.com
chinahousecoralville.com
clubliakinder.com
sialkot.city
evgreen.fund
crg-construction.com
rikrakprod.com
classsnk.com
e-motionaligner.com
beautyblissshops.com
pickyourprice.club
kraekratom.com
digitexz.online
drburcindemirel.com
thisislisajones.com
bridge-the-mind.net
skincodemtblo.com
elayathemodel.com
reinboge.net
banks-in-cambodia.com
earthkeepforum.com
vbyvictorious.com
vyne.net
bearring.info
jndaohang.com
iandautomation.com
puteraizman.com
earthlyangelshomecare.com
jumlasx.xyz
holdergear.com
bmwsns.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/940-70-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/940-71-0x000000000041ED40-mapping.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
106ada585df884b13cd6a8a71e404c78.exedescription pid process target process PID 1832 set thread context of 940 1832 106ada585df884b13cd6a8a71e404c78.exe 106ada585df884b13cd6a8a71e404c78.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
106ada585df884b13cd6a8a71e404c78.exepid process 940 106ada585df884b13cd6a8a71e404c78.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
106ada585df884b13cd6a8a71e404c78.exepid process 1832 106ada585df884b13cd6a8a71e404c78.exe 1832 106ada585df884b13cd6a8a71e404c78.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
106ada585df884b13cd6a8a71e404c78.exedescription pid process target process PID 1832 wrote to memory of 1108 1832 106ada585df884b13cd6a8a71e404c78.exe schtasks.exe PID 1832 wrote to memory of 1108 1832 106ada585df884b13cd6a8a71e404c78.exe schtasks.exe PID 1832 wrote to memory of 1108 1832 106ada585df884b13cd6a8a71e404c78.exe schtasks.exe PID 1832 wrote to memory of 1108 1832 106ada585df884b13cd6a8a71e404c78.exe schtasks.exe PID 1832 wrote to memory of 940 1832 106ada585df884b13cd6a8a71e404c78.exe 106ada585df884b13cd6a8a71e404c78.exe PID 1832 wrote to memory of 940 1832 106ada585df884b13cd6a8a71e404c78.exe 106ada585df884b13cd6a8a71e404c78.exe PID 1832 wrote to memory of 940 1832 106ada585df884b13cd6a8a71e404c78.exe 106ada585df884b13cd6a8a71e404c78.exe PID 1832 wrote to memory of 940 1832 106ada585df884b13cd6a8a71e404c78.exe 106ada585df884b13cd6a8a71e404c78.exe PID 1832 wrote to memory of 940 1832 106ada585df884b13cd6a8a71e404c78.exe 106ada585df884b13cd6a8a71e404c78.exe PID 1832 wrote to memory of 940 1832 106ada585df884b13cd6a8a71e404c78.exe 106ada585df884b13cd6a8a71e404c78.exe PID 1832 wrote to memory of 940 1832 106ada585df884b13cd6a8a71e404c78.exe 106ada585df884b13cd6a8a71e404c78.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\106ada585df884b13cd6a8a71e404c78.exe"C:\Users\Admin\AppData\Local\Temp\106ada585df884b13cd6a8a71e404c78.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fendlKCsOIoiN" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB73E.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\106ada585df884b13cd6a8a71e404c78.exe"C:\Users\Admin\AppData\Local\Temp\106ada585df884b13cd6a8a71e404c78.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB73E.tmpMD5
c075e6f1cbf46155b4e600e10c332a41
SHA17f62b2a1f8e9a6a443f959ca412e890693a0b2e9
SHA256f279f2322ed8baea8f698151105c2ce310b151c57a447941b716ee1f7e9474e5
SHA512272126a2b0f54d72410aa25f99ba5b4bb2bf91a3f298de9361ab9018c3e53f93d14c2afe471a05f95f24033bebf80ff323b3239892c0202e913d6fd62fdd1095
-
memory/940-70-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/940-71-0x000000000041ED40-mapping.dmp
-
memory/940-73-0x0000000000A40000-0x0000000000D43000-memory.dmpFilesize
3.0MB
-
memory/1108-68-0x0000000000000000-mapping.dmp
-
memory/1832-60-0x0000000001280000-0x0000000001281000-memory.dmpFilesize
4KB
-
memory/1832-62-0x0000000001210000-0x0000000001211000-memory.dmpFilesize
4KB
-
memory/1832-63-0x0000000001211000-0x0000000001212000-memory.dmpFilesize
4KB
-
memory/1832-64-0x0000000000B80000-0x0000000000B8E000-memory.dmpFilesize
56KB
-
memory/1832-65-0x0000000001212000-0x0000000001213000-memory.dmpFilesize
4KB
-
memory/1832-66-0x0000000005BF0000-0x0000000005C6F000-memory.dmpFilesize
508KB
-
memory/1832-67-0x0000000004BB0000-0x0000000004BE5000-memory.dmpFilesize
212KB