Analysis
-
max time kernel
147s -
max time network
139s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
04-05-2021 21:26
Static task
static1
Behavioral task
behavioral1
Sample
BANK RECEIPT.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
BANK RECEIPT.exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
PO.exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
PO.exe
Resource
win10v20210408
Behavioral task
behavioral5
Sample
STATEMENT OF ACCOUNT.exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
STATEMENT OF ACCOUNT.exe
Resource
win10v20210410
General
-
Target
BANK RECEIPT.exe
-
Size
280KB
-
MD5
6317a0b98ebd6f0ba716fc1b73b4bf31
-
SHA1
6f593ad2588b2ca2e561f0b47c9654df9fd95932
-
SHA256
a2e99d0aabd8f0ad83b885eccf313563526a58b2da435bf34dad29294c712efe
-
SHA512
e29265b8cc385be1c86751dd04dd2a70d727e8e298cd0d0ca250c2c6515c8d1c189511c564de11cf9c3c85d3efed1e23f7ad4b91bcca156b6b7c4341195f449a
Malware Config
Extracted
formbook
4.1
http://www.knighttechinca.com/dxe/
sardarfarm.com
959tremont.com
privat-livecam.net
ansel-homebakery.com
joysupermarket.com
peninsulamatchmakers.net
northsytyle.com
radioconexaoubermusic.com
relocatingrealtor.com
desyrnan.com
onlinehoortoestel.online
enpointe.online
rvvikings.com
paulpoirier.com
shitarpa.net
kerneis.net
rokitreach.com
essentiallygaia.com
prestiged.net
fuerzaagavera.com
soukid.com
moderndatingcoach.com
mentalfreedom.guru
bullishsoftware.com
sectorulb.com
outletyana.com
fptplaybox.website
artinmemory.com
buyruon.com
ljd.xyz
mondaysmatters.com
spiritsoundart.net
ixiangzu.com
lacompagniadelfardello.com
bnctly.com
sarasvati-yoga.com
0055game.com
lagrangewildliferemoval.com
umlausa.com
chaytel.com
kkkc5.com
union-green.com
philreid4cc.com
theanimehat.com
redlightlegal.com
myaustraliarewards.com
barkinlot.com
mujahidservice.online
nugeneraonline.com
sopplugin.com
makemyroom.design
ferienschweden.com
fps2020dkasphotoop.com
stylezbykay.com
royalpropertiesgurugram.com
birzulova.com
cosmicmtn.com
kissanime.press
poweringprogress.today
omsamedic.com
drunkpoetsociety.com
hostbison.com
asapdecor.com
houseofsisson.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1844-63-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1560-70-0x00000000000C0000-0x00000000000EE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 536 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
BANK RECEIPT.exepid process 1084 BANK RECEIPT.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
BANK RECEIPT.exeBANK RECEIPT.exesystray.exedescription pid process target process PID 1084 set thread context of 1844 1084 BANK RECEIPT.exe BANK RECEIPT.exe PID 1844 set thread context of 1288 1844 BANK RECEIPT.exe Explorer.EXE PID 1560 set thread context of 1288 1560 systray.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
BANK RECEIPT.exesystray.exepid process 1844 BANK RECEIPT.exe 1844 BANK RECEIPT.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1288 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
BANK RECEIPT.exeBANK RECEIPT.exesystray.exepid process 1084 BANK RECEIPT.exe 1844 BANK RECEIPT.exe 1844 BANK RECEIPT.exe 1844 BANK RECEIPT.exe 1560 systray.exe 1560 systray.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
BANK RECEIPT.exesystray.exedescription pid process Token: SeDebugPrivilege 1844 BANK RECEIPT.exe Token: SeDebugPrivilege 1560 systray.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
BANK RECEIPT.exeExplorer.EXEsystray.exedescription pid process target process PID 1084 wrote to memory of 1844 1084 BANK RECEIPT.exe BANK RECEIPT.exe PID 1084 wrote to memory of 1844 1084 BANK RECEIPT.exe BANK RECEIPT.exe PID 1084 wrote to memory of 1844 1084 BANK RECEIPT.exe BANK RECEIPT.exe PID 1084 wrote to memory of 1844 1084 BANK RECEIPT.exe BANK RECEIPT.exe PID 1084 wrote to memory of 1844 1084 BANK RECEIPT.exe BANK RECEIPT.exe PID 1288 wrote to memory of 1560 1288 Explorer.EXE systray.exe PID 1288 wrote to memory of 1560 1288 Explorer.EXE systray.exe PID 1288 wrote to memory of 1560 1288 Explorer.EXE systray.exe PID 1288 wrote to memory of 1560 1288 Explorer.EXE systray.exe PID 1560 wrote to memory of 536 1560 systray.exe cmd.exe PID 1560 wrote to memory of 536 1560 systray.exe cmd.exe PID 1560 wrote to memory of 536 1560 systray.exe cmd.exe PID 1560 wrote to memory of 536 1560 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BANK RECEIPT.exe"C:\Users\Admin\AppData\Local\Temp\BANK RECEIPT.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BANK RECEIPT.exe"C:\Users\Admin\AppData\Local\Temp\BANK RECEIPT.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\BANK RECEIPT.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsx34D.tmp\2g6ght2plrugud.dllMD5
64ade443342d3aa3790c2846abf93959
SHA1d6668f6881d40dc3dc3d1f627f2721e1d333e698
SHA256ea1deb95fa6614524006ee3260957aef27ebd563f609dde680cace5f2ea09e45
SHA5122fdce6c768ded710d6d011be5317b184a09e10058145bdff545e83df63f5e0f46db4f679161174397b37d0fb2f43abe7275405845742e4a73bc6ef995edf4845
-
memory/536-68-0x0000000000000000-mapping.dmp
-
memory/1084-62-0x0000000000310000-0x0000000000312000-memory.dmpFilesize
8KB
-
memory/1084-59-0x00000000752F1000-0x00000000752F3000-memory.dmpFilesize
8KB
-
memory/1288-66-0x00000000049A0000-0x0000000004A6E000-memory.dmpFilesize
824KB
-
memory/1288-73-0x0000000004FF0000-0x00000000050E9000-memory.dmpFilesize
996KB
-
memory/1560-67-0x0000000000000000-mapping.dmp
-
memory/1560-69-0x00000000003D0000-0x00000000003D5000-memory.dmpFilesize
20KB
-
memory/1560-70-0x00000000000C0000-0x00000000000EE000-memory.dmpFilesize
184KB
-
memory/1560-71-0x0000000001F30000-0x0000000002233000-memory.dmpFilesize
3.0MB
-
memory/1560-72-0x0000000001D00000-0x0000000001D93000-memory.dmpFilesize
588KB
-
memory/1844-63-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1844-64-0x0000000000740000-0x0000000000A43000-memory.dmpFilesize
3.0MB
-
memory/1844-65-0x0000000000480000-0x0000000000494000-memory.dmpFilesize
80KB
-
memory/1844-61-0x000000000041EAF0-mapping.dmp