Analysis
-
max time kernel
147s -
max time network
139s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
05-05-2021 14:23
Static task
static1
Behavioral task
behavioral1
Sample
PI ZB_2021_P070 R3.exe
Resource
win7v20210410
General
-
Target
PI ZB_2021_P070 R3.exe
-
Size
229KB
-
MD5
8c34da075c440fe80be7af580725b0e8
-
SHA1
5b7903ed7fcfef0189621390336efe359a39e908
-
SHA256
ad86b6dd3faef43b4ef56786e35a7d2b38a369e6082c72c3cac0267a5b8efc5a
-
SHA512
7d7504d10dba181aaab5d1fc7384719a05e16ed54c669b00a9c24ddb2e19e9b622e7bcc475dd2b6891d86d2e3e5a90fa70794075c7b65845a85946bff3773b57
Malware Config
Extracted
formbook
4.1
http://www.knighttechinca.com/dxe/
sardarfarm.com
959tremont.com
privat-livecam.net
ansel-homebakery.com
joysupermarket.com
peninsulamatchmakers.net
northsytyle.com
radioconexaoubermusic.com
relocatingrealtor.com
desyrnan.com
onlinehoortoestel.online
enpointe.online
rvvikings.com
paulpoirier.com
shitarpa.net
kerneis.net
rokitreach.com
essentiallygaia.com
prestiged.net
fuerzaagavera.com
soukid.com
moderndatingcoach.com
mentalfreedom.guru
bullishsoftware.com
sectorulb.com
outletyana.com
fptplaybox.website
artinmemory.com
buyruon.com
ljd.xyz
mondaysmatters.com
spiritsoundart.net
ixiangzu.com
lacompagniadelfardello.com
bnctly.com
sarasvati-yoga.com
0055game.com
lagrangewildliferemoval.com
umlausa.com
chaytel.com
kkkc5.com
union-green.com
philreid4cc.com
theanimehat.com
redlightlegal.com
myaustraliarewards.com
barkinlot.com
mujahidservice.online
nugeneraonline.com
sopplugin.com
makemyroom.design
ferienschweden.com
fps2020dkasphotoop.com
stylezbykay.com
royalpropertiesgurugram.com
birzulova.com
cosmicmtn.com
kissanime.press
poweringprogress.today
omsamedic.com
drunkpoetsociety.com
hostbison.com
asapdecor.com
houseofsisson.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3008-117-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2804-123-0x0000000003010000-0x000000000303E000-memory.dmp formbook -
Loads dropped DLL 1 IoCs
Processes:
PI ZB_2021_P070 R3.exepid process 3920 PI ZB_2021_P070 R3.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PI ZB_2021_P070 R3.exePI ZB_2021_P070 R3.exehelp.exedescription pid process target process PID 3920 set thread context of 3008 3920 PI ZB_2021_P070 R3.exe PI ZB_2021_P070 R3.exe PID 3008 set thread context of 3000 3008 PI ZB_2021_P070 R3.exe Explorer.EXE PID 2804 set thread context of 3000 2804 help.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
PI ZB_2021_P070 R3.exehelp.exepid process 3008 PI ZB_2021_P070 R3.exe 3008 PI ZB_2021_P070 R3.exe 3008 PI ZB_2021_P070 R3.exe 3008 PI ZB_2021_P070 R3.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe 2804 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3000 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
PI ZB_2021_P070 R3.exePI ZB_2021_P070 R3.exehelp.exepid process 3920 PI ZB_2021_P070 R3.exe 3008 PI ZB_2021_P070 R3.exe 3008 PI ZB_2021_P070 R3.exe 3008 PI ZB_2021_P070 R3.exe 2804 help.exe 2804 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PI ZB_2021_P070 R3.exehelp.exedescription pid process Token: SeDebugPrivilege 3008 PI ZB_2021_P070 R3.exe Token: SeDebugPrivilege 2804 help.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3000 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
PI ZB_2021_P070 R3.exeExplorer.EXEhelp.exedescription pid process target process PID 3920 wrote to memory of 3008 3920 PI ZB_2021_P070 R3.exe PI ZB_2021_P070 R3.exe PID 3920 wrote to memory of 3008 3920 PI ZB_2021_P070 R3.exe PI ZB_2021_P070 R3.exe PID 3920 wrote to memory of 3008 3920 PI ZB_2021_P070 R3.exe PI ZB_2021_P070 R3.exe PID 3920 wrote to memory of 3008 3920 PI ZB_2021_P070 R3.exe PI ZB_2021_P070 R3.exe PID 3000 wrote to memory of 2804 3000 Explorer.EXE help.exe PID 3000 wrote to memory of 2804 3000 Explorer.EXE help.exe PID 3000 wrote to memory of 2804 3000 Explorer.EXE help.exe PID 2804 wrote to memory of 928 2804 help.exe cmd.exe PID 2804 wrote to memory of 928 2804 help.exe cmd.exe PID 2804 wrote to memory of 928 2804 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PI ZB_2021_P070 R3.exe"C:\Users\Admin\AppData\Local\Temp\PI ZB_2021_P070 R3.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PI ZB_2021_P070 R3.exe"C:\Users\Admin\AppData\Local\Temp\PI ZB_2021_P070 R3.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PI ZB_2021_P070 R3.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsq2E3C.tmp\c9henai.dllMD5
6582e8fabdbec6c7696f94ff33dc6b6d
SHA1d6986e668b28edc49066013f1de9e1382d1a907d
SHA25625c43d3110644eb9a1712174ddf4f4851fcb7b1db8faa828baecaf3a2c75cd08
SHA51248a91f22e829a5f14db76426147f82324c8345137ddf02ba8564dccb29069ca7b928affcaa39f49d3653fd7437d1b3b34a302eb548de602ca633992797493210
-
memory/928-124-0x0000000000000000-mapping.dmp
-
memory/2804-123-0x0000000003010000-0x000000000303E000-memory.dmpFilesize
184KB
-
memory/2804-126-0x00000000033F0000-0x0000000003483000-memory.dmpFilesize
588KB
-
memory/2804-125-0x0000000003680000-0x00000000039A0000-memory.dmpFilesize
3.1MB
-
memory/2804-121-0x0000000000000000-mapping.dmp
-
memory/2804-122-0x0000000000B80000-0x0000000000B87000-memory.dmpFilesize
28KB
-
memory/3000-127-0x00000000067F0000-0x000000000689A000-memory.dmpFilesize
680KB
-
memory/3000-119-0x00000000066E0000-0x00000000067E8000-memory.dmpFilesize
1.0MB
-
memory/3008-118-0x0000000000A30000-0x0000000000D50000-memory.dmpFilesize
3.1MB
-
memory/3008-120-0x00000000004A0000-0x00000000005EA000-memory.dmpFilesize
1.3MB
-
memory/3008-117-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3008-116-0x000000000041EAF0-mapping.dmp
-
memory/3920-115-0x0000000002270000-0x0000000002272000-memory.dmpFilesize
8KB