Analysis
-
max time kernel
136s -
max time network
123s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
05-05-2021 14:05
Static task
static1
Behavioral task
behavioral1
Sample
6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe
Resource
win7v20210408
General
-
Target
6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe
-
Size
674KB
-
MD5
9fe12cde3aa06a540dd00ef6b182c5d0
-
SHA1
5b71e9d19292cbd95d455ce778db5d5c86270ab0
-
SHA256
6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65
-
SHA512
b223de4772986e3c95c233d49711e538d566527ab7f8b2f0bdbcd75643587ddd6140815c29ff168ea4ab1bd8914053ea697913be81f4d7f37e5e3450a31be465
Malware Config
Extracted
formbook
4.1
http://www.glittergalsboutique.com/8buc/
affiliatetraining101.com
sun5new.com
localstuffunlimited.store
getmrn.com
nipandtucknurse.com
companycreater.com
painfullyperfect.com
3dmobilemammo.com
theredbeegroup.net
loochaan.com
alanoliveiramkt.com
lxwzsh.com
twobookramblers.com
cscardinalmalula.net
hanarzr.com
sabaicp.com
foodprocessmedia.com
tirongroup.com
dcentralizedcloud.com
xn--80abnkzb2a.xn--p1acf
breadnight.icu
auchancasechallenge.com
szparallel.com
weddingbashboutique.com
youyoudog.com
thewillowsbanbury.co.uk
chef-delivered.com
onehealth.systems
energypotusa.com
racturingleaseless.net
juxrams.info
iwantmyribback.com
treasurevalleydeals.com
praveenverma.com
brucehomesinc.com
alexisbosch.com
xzwykj.com
alchemizewithraquel.com
virtualsellingcourse.com
avvab.com
mainstfarm.com
eddyunmasked.com
yobienbien.com
atmanirbharbharatrelease.com
everythingteacherish.com
thesheshedatl.com
osonautical.com
beez-safe.com
scsasandiego.com
leirun.net
xdbdb.com
coffee-md.com
quiltingvine.com
bharathextract.com
weekendrubs.com
vendopatentes.com
carportmaterials.com
k-ann.com
scallywagbeats.com
ecreatorstest.com
financeetc.net
vemaybaygiareonline.com
lolatto.com
puffin-coolers.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2224-140-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2224-141-0x000000000041ED80-mapping.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exedescription pid process target process PID 808 set thread context of 2224 808 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exepowershell.exepowershell.exepowershell.exe6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exepid process 808 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe 3344 powershell.exe 2052 powershell.exe 3484 powershell.exe 2224 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe 2224 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe 3484 powershell.exe 2052 powershell.exe 3344 powershell.exe 2052 powershell.exe 3484 powershell.exe 3344 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 808 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe Token: SeDebugPrivilege 3344 powershell.exe Token: SeDebugPrivilege 2052 powershell.exe Token: SeDebugPrivilege 3484 powershell.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exedescription pid process target process PID 808 wrote to memory of 3344 808 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe powershell.exe PID 808 wrote to memory of 3344 808 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe powershell.exe PID 808 wrote to memory of 3344 808 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe powershell.exe PID 808 wrote to memory of 2052 808 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe powershell.exe PID 808 wrote to memory of 2052 808 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe powershell.exe PID 808 wrote to memory of 2052 808 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe powershell.exe PID 808 wrote to memory of 3876 808 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe schtasks.exe PID 808 wrote to memory of 3876 808 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe schtasks.exe PID 808 wrote to memory of 3876 808 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe schtasks.exe PID 808 wrote to memory of 3484 808 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe powershell.exe PID 808 wrote to memory of 3484 808 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe powershell.exe PID 808 wrote to memory of 3484 808 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe powershell.exe PID 808 wrote to memory of 2224 808 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe PID 808 wrote to memory of 2224 808 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe PID 808 wrote to memory of 2224 808 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe PID 808 wrote to memory of 2224 808 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe PID 808 wrote to memory of 2224 808 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe PID 808 wrote to memory of 2224 808 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe 6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe"C:\Users\Admin\AppData\Local\Temp\6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aNSuLti.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aNSuLti" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5540.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aNSuLti.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe"C:\Users\Admin\AppData\Local\Temp\6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
1c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
9e216bbc35b45c41d3284fd57390cfde
SHA1cf0a68e448d33658fce67caf5d436ce636d6e31d
SHA25614e1684e7774306ddbac7bf21df1fa7d5c0509fe65f7b7c9f47d8359199f608c
SHA512d8ec8cccb03ffbceb0b233aa11e40b2ecebe1b3c8b918f4b38b157cfd5254e131911b069891f08bb5c0b2cb7bb3c7d0f0b47521758528a329a1a56da840348b4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
654a05b469aa8b1c7d5a4bda3a18e8b3
SHA1346542c46da07bf87eeb74a745f186855d80fc1c
SHA2563e3d5047bda82be8139f3932443ab984b43e92700adf76c5d1682041d5f8665e
SHA512c3cceb89e24712777f6cdc7f5e97b4538aa118d967f591a5fc16840cea5440c108fe87654ed338b0481afe14a5b40e68e14f86452669877c3e89ec84b3dd9643
-
C:\Users\Admin\AppData\Local\Temp\tmp5540.tmpMD5
c138621fc93d93f6c39824c18c5a49e3
SHA17d93e89642b1cdf1738ebf90f19006f943e5319a
SHA256c001c8ebd52ec6560f3a2bc44003e8137b9be0e11ac009db9bbf28e156c60dd6
SHA512d8200756a2350e0c79c98931e05a1213ef927a76fd862d73d9a5d914c36a709de380dd4792e33ac3dc77dcbfe7a730bc87c61b0372d33242993b8ec25984b8a2
-
memory/808-120-0x0000000004E90000-0x000000000538E000-memory.dmpFilesize
5.0MB
-
memory/808-116-0x0000000004DF0000-0x0000000004DF1000-memory.dmpFilesize
4KB
-
memory/808-121-0x0000000004FF0000-0x0000000004FF1000-memory.dmpFilesize
4KB
-
memory/808-122-0x00000000050C0000-0x00000000050CE000-memory.dmpFilesize
56KB
-
memory/808-123-0x0000000000D60000-0x0000000000DD9000-memory.dmpFilesize
484KB
-
memory/808-124-0x0000000005280000-0x00000000052B5000-memory.dmpFilesize
212KB
-
memory/808-119-0x0000000004F50000-0x0000000004F51000-memory.dmpFilesize
4KB
-
memory/808-118-0x0000000004E90000-0x0000000004E91000-memory.dmpFilesize
4KB
-
memory/808-117-0x0000000005390000-0x0000000005391000-memory.dmpFilesize
4KB
-
memory/808-114-0x0000000000490000-0x0000000000491000-memory.dmpFilesize
4KB
-
memory/2052-194-0x000000007F6F0000-0x000000007F6F1000-memory.dmpFilesize
4KB
-
memory/2052-132-0x0000000000000000-mapping.dmp
-
memory/2052-167-0x00000000082B0000-0x00000000082B1000-memory.dmpFilesize
4KB
-
memory/2052-149-0x0000000006E70000-0x0000000006E71000-memory.dmpFilesize
4KB
-
memory/2052-164-0x0000000007C70000-0x0000000007C71000-memory.dmpFilesize
4KB
-
memory/2052-161-0x0000000007E20000-0x0000000007E21000-memory.dmpFilesize
4KB
-
memory/2052-197-0x0000000006E73000-0x0000000006E74000-memory.dmpFilesize
4KB
-
memory/2052-152-0x0000000006E72000-0x0000000006E73000-memory.dmpFilesize
4KB
-
memory/2224-141-0x000000000041ED80-mapping.dmp
-
memory/2224-140-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2224-150-0x0000000001060000-0x0000000001380000-memory.dmpFilesize
3.1MB
-
memory/3344-131-0x0000000006F50000-0x0000000006F51000-memory.dmpFilesize
4KB
-
memory/3344-125-0x0000000000000000-mapping.dmp
-
memory/3344-128-0x0000000004370000-0x0000000004371000-memory.dmpFilesize
4KB
-
memory/3344-130-0x0000000006912000-0x0000000006913000-memory.dmpFilesize
4KB
-
memory/3344-198-0x0000000006913000-0x0000000006914000-memory.dmpFilesize
4KB
-
memory/3344-129-0x0000000006910000-0x0000000006911000-memory.dmpFilesize
4KB
-
memory/3344-193-0x000000007EE10000-0x000000007EE11000-memory.dmpFilesize
4KB
-
memory/3344-170-0x0000000007E90000-0x0000000007E91000-memory.dmpFilesize
4KB
-
memory/3484-195-0x000000007F280000-0x000000007F281000-memory.dmpFilesize
4KB
-
memory/3484-139-0x0000000000000000-mapping.dmp
-
memory/3484-196-0x0000000004133000-0x0000000004134000-memory.dmpFilesize
4KB
-
memory/3484-158-0x0000000007280000-0x0000000007281000-memory.dmpFilesize
4KB
-
memory/3484-155-0x0000000004132000-0x0000000004133000-memory.dmpFilesize
4KB
-
memory/3484-151-0x0000000007210000-0x0000000007211000-memory.dmpFilesize
4KB
-
memory/3484-154-0x0000000004130000-0x0000000004131000-memory.dmpFilesize
4KB
-
memory/3484-146-0x0000000006A40000-0x0000000006A41000-memory.dmpFilesize
4KB
-
memory/3876-133-0x0000000000000000-mapping.dmp