Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
05-05-2021 18:59
Static task
static1
Behavioral task
behavioral1
Sample
PO.exe
Resource
win7v20210410
General
-
Target
PO.exe
-
Size
228KB
-
MD5
2593eef7b38e160b9697f2479fa8843f
-
SHA1
25d4d88f321321fb5b2b316fd5dbcd5bb144daa1
-
SHA256
b35de004189f271fe754dd614e5fbbc299425f5aca9ebf1f935bf26696964853
-
SHA512
c5beb57aae9c18ca5d7d73954216abc6a07871666d08a654d7b5d8e1d25b0defe9ca66eee77325bed03870a39757c85df13f868472447369bd2903ba05336a21
Malware Config
Extracted
formbook
4.1
http://www.knighttechinca.com/dxe/
sardarfarm.com
959tremont.com
privat-livecam.net
ansel-homebakery.com
joysupermarket.com
peninsulamatchmakers.net
northsytyle.com
radioconexaoubermusic.com
relocatingrealtor.com
desyrnan.com
onlinehoortoestel.online
enpointe.online
rvvikings.com
paulpoirier.com
shitarpa.net
kerneis.net
rokitreach.com
essentiallygaia.com
prestiged.net
fuerzaagavera.com
soukid.com
moderndatingcoach.com
mentalfreedom.guru
bullishsoftware.com
sectorulb.com
outletyana.com
fptplaybox.website
artinmemory.com
buyruon.com
ljd.xyz
mondaysmatters.com
spiritsoundart.net
ixiangzu.com
lacompagniadelfardello.com
bnctly.com
sarasvati-yoga.com
0055game.com
lagrangewildliferemoval.com
umlausa.com
chaytel.com
kkkc5.com
union-green.com
philreid4cc.com
theanimehat.com
redlightlegal.com
myaustraliarewards.com
barkinlot.com
mujahidservice.online
nugeneraonline.com
sopplugin.com
makemyroom.design
ferienschweden.com
fps2020dkasphotoop.com
stylezbykay.com
royalpropertiesgurugram.com
birzulova.com
cosmicmtn.com
kissanime.press
poweringprogress.today
omsamedic.com
drunkpoetsociety.com
hostbison.com
asapdecor.com
houseofsisson.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/736-117-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3424-124-0x0000000000150000-0x000000000017E000-memory.dmp formbook -
Loads dropped DLL 1 IoCs
Processes:
PO.exepid process 668 PO.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO.exePO.exenetsh.exedescription pid process target process PID 668 set thread context of 736 668 PO.exe PO.exe PID 736 set thread context of 2428 736 PO.exe Explorer.EXE PID 3424 set thread context of 2428 3424 netsh.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
PO.exenetsh.exepid process 736 PO.exe 736 PO.exe 736 PO.exe 736 PO.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe 3424 netsh.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2428 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
PO.exePO.exenetsh.exepid process 668 PO.exe 736 PO.exe 736 PO.exe 736 PO.exe 3424 netsh.exe 3424 netsh.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO.exenetsh.exedescription pid process Token: SeDebugPrivilege 736 PO.exe Token: SeDebugPrivilege 3424 netsh.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2428 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
PO.exeExplorer.EXEnetsh.exedescription pid process target process PID 668 wrote to memory of 736 668 PO.exe PO.exe PID 668 wrote to memory of 736 668 PO.exe PO.exe PID 668 wrote to memory of 736 668 PO.exe PO.exe PID 668 wrote to memory of 736 668 PO.exe PO.exe PID 2428 wrote to memory of 3424 2428 Explorer.EXE netsh.exe PID 2428 wrote to memory of 3424 2428 Explorer.EXE netsh.exe PID 2428 wrote to memory of 3424 2428 Explorer.EXE netsh.exe PID 3424 wrote to memory of 768 3424 netsh.exe cmd.exe PID 3424 wrote to memory of 768 3424 netsh.exe cmd.exe PID 3424 wrote to memory of 768 3424 netsh.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO.exe"C:\Users\Admin\AppData\Local\Temp\PO.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO.exe"C:\Users\Admin\AppData\Local\Temp\PO.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsz9235.tmp\k5ig8v1xqqd111h.dllMD5
fe9e8afe6e228256eaf3065c403d87bb
SHA11d46976328242b9e4f37d994bc1f169ee1f4c112
SHA256e2b161127954eb1373158a95ef083d1b00198fef933e9ad5a1496d82d9006b8b
SHA512573399e2885f89f05e27de783ef286c79dab04ca4e942f62ccbbb40d61fc7ab80baa97b13948b719dcae785d5daa19e4aa23adb4922e9737e0ecbfc2a09ba4a5
-
memory/668-116-0x0000000000AE0000-0x0000000000AE2000-memory.dmpFilesize
8KB
-
memory/736-115-0x000000000041EAF0-mapping.dmp
-
memory/736-117-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/736-118-0x00000000009A0000-0x0000000000CC0000-memory.dmpFilesize
3.1MB
-
memory/736-119-0x00000000008F0000-0x0000000000904000-memory.dmpFilesize
80KB
-
memory/768-122-0x0000000000000000-mapping.dmp
-
memory/2428-120-0x00000000049F0000-0x0000000004B77000-memory.dmpFilesize
1.5MB
-
memory/2428-127-0x0000000004B80000-0x0000000004CBF000-memory.dmpFilesize
1.2MB
-
memory/3424-121-0x0000000000000000-mapping.dmp
-
memory/3424-123-0x0000000000A00000-0x0000000000A1E000-memory.dmpFilesize
120KB
-
memory/3424-124-0x0000000000150000-0x000000000017E000-memory.dmpFilesize
184KB
-
memory/3424-125-0x0000000002E60000-0x0000000003180000-memory.dmpFilesize
3.1MB
-
memory/3424-126-0x0000000002C20000-0x0000000002CB3000-memory.dmpFilesize
588KB