Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
06-05-2021 11:52
Static task
static1
Behavioral task
behavioral1
Sample
NEW ODER.exe
Resource
win7v20210410
General
-
Target
NEW ODER.exe
-
Size
225KB
-
MD5
a995d24b27548f0215eaa0d87dc140c3
-
SHA1
d2adc518df40843623413b5d5310ea4069fdba2e
-
SHA256
859db52a7e6fdf6f93350d27b7917853b8b88a2536721328ff60a98f59a93b91
-
SHA512
693d6532465d4bbf3d5f67473bdc539ec255bbc6a7950ae7a170a7a2dc8eee8a7c16f471fb210d8f492aea8e038e9f794207354906c231216bfd81cfd2e897ac
Malware Config
Extracted
formbook
4.1
http://www.knighttechinca.com/dxe/
sardarfarm.com
959tremont.com
privat-livecam.net
ansel-homebakery.com
joysupermarket.com
peninsulamatchmakers.net
northsytyle.com
radioconexaoubermusic.com
relocatingrealtor.com
desyrnan.com
onlinehoortoestel.online
enpointe.online
rvvikings.com
paulpoirier.com
shitarpa.net
kerneis.net
rokitreach.com
essentiallygaia.com
prestiged.net
fuerzaagavera.com
soukid.com
moderndatingcoach.com
mentalfreedom.guru
bullishsoftware.com
sectorulb.com
outletyana.com
fptplaybox.website
artinmemory.com
buyruon.com
ljd.xyz
mondaysmatters.com
spiritsoundart.net
ixiangzu.com
lacompagniadelfardello.com
bnctly.com
sarasvati-yoga.com
0055game.com
lagrangewildliferemoval.com
umlausa.com
chaytel.com
kkkc5.com
union-green.com
philreid4cc.com
theanimehat.com
redlightlegal.com
myaustraliarewards.com
barkinlot.com
mujahidservice.online
nugeneraonline.com
sopplugin.com
makemyroom.design
ferienschweden.com
fps2020dkasphotoop.com
stylezbykay.com
royalpropertiesgurugram.com
birzulova.com
cosmicmtn.com
kissanime.press
poweringprogress.today
omsamedic.com
drunkpoetsociety.com
hostbison.com
asapdecor.com
houseofsisson.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4060-117-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3932-125-0x0000000003270000-0x000000000329E000-memory.dmp formbook -
Loads dropped DLL 1 IoCs
Processes:
NEW ODER.exepid process 3904 NEW ODER.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
NEW ODER.exeNEW ODER.exemstsc.exedescription pid process target process PID 3904 set thread context of 4060 3904 NEW ODER.exe NEW ODER.exe PID 4060 set thread context of 388 4060 NEW ODER.exe Explorer.EXE PID 4060 set thread context of 388 4060 NEW ODER.exe Explorer.EXE PID 3932 set thread context of 388 3932 mstsc.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
NEW ODER.exemstsc.exepid process 4060 NEW ODER.exe 4060 NEW ODER.exe 4060 NEW ODER.exe 4060 NEW ODER.exe 4060 NEW ODER.exe 4060 NEW ODER.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe 3932 mstsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 388 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
NEW ODER.exeNEW ODER.exemstsc.exepid process 3904 NEW ODER.exe 4060 NEW ODER.exe 4060 NEW ODER.exe 4060 NEW ODER.exe 4060 NEW ODER.exe 3932 mstsc.exe 3932 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
NEW ODER.exeExplorer.EXEmstsc.exedescription pid process Token: SeDebugPrivilege 4060 NEW ODER.exe Token: SeShutdownPrivilege 388 Explorer.EXE Token: SeCreatePagefilePrivilege 388 Explorer.EXE Token: SeShutdownPrivilege 388 Explorer.EXE Token: SeCreatePagefilePrivilege 388 Explorer.EXE Token: SeShutdownPrivilege 388 Explorer.EXE Token: SeCreatePagefilePrivilege 388 Explorer.EXE Token: SeShutdownPrivilege 388 Explorer.EXE Token: SeCreatePagefilePrivilege 388 Explorer.EXE Token: SeShutdownPrivilege 388 Explorer.EXE Token: SeCreatePagefilePrivilege 388 Explorer.EXE Token: SeShutdownPrivilege 388 Explorer.EXE Token: SeCreatePagefilePrivilege 388 Explorer.EXE Token: SeDebugPrivilege 3932 mstsc.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 388 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
NEW ODER.exeExplorer.EXEmstsc.exedescription pid process target process PID 3904 wrote to memory of 4060 3904 NEW ODER.exe NEW ODER.exe PID 3904 wrote to memory of 4060 3904 NEW ODER.exe NEW ODER.exe PID 3904 wrote to memory of 4060 3904 NEW ODER.exe NEW ODER.exe PID 3904 wrote to memory of 4060 3904 NEW ODER.exe NEW ODER.exe PID 388 wrote to memory of 3932 388 Explorer.EXE mstsc.exe PID 388 wrote to memory of 3932 388 Explorer.EXE mstsc.exe PID 388 wrote to memory of 3932 388 Explorer.EXE mstsc.exe PID 3932 wrote to memory of 1204 3932 mstsc.exe cmd.exe PID 3932 wrote to memory of 1204 3932 mstsc.exe cmd.exe PID 3932 wrote to memory of 1204 3932 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW ODER.exe"C:\Users\Admin\AppData\Local\Temp\NEW ODER.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW ODER.exe"C:\Users\Admin\AppData\Local\Temp\NEW ODER.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\NEW ODER.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nspF902.tmp\aj28.dllMD5
3a2c0cbf7b078a932352865c9c3ccc04
SHA179d95f00557a629f1008ef44b961437772092864
SHA256e67bc472ae4eacd5543ade899c75dc7a7d703f0e5a9663de35ad5b28808410da
SHA5125136b1538c5784abaaef9c8d81ac32c9d2f768d459d30e47d581127ee741f319a49e1bfeff5a9f4acca683f4447a1581d3ed92ac980fa80f71ee2a577df36a59
-
memory/388-118-0x0000000005C50000-0x0000000005D66000-memory.dmpFilesize
1.1MB
-
memory/388-129-0x00000000066E0000-0x0000000006824000-memory.dmpFilesize
1.3MB
-
memory/388-122-0x0000000006490000-0x0000000006625000-memory.dmpFilesize
1.6MB
-
memory/1204-126-0x0000000000000000-mapping.dmp
-
memory/3904-115-0x00000000027C0000-0x00000000027E3000-memory.dmpFilesize
140KB
-
memory/3932-123-0x0000000000000000-mapping.dmp
-
memory/3932-124-0x0000000000310000-0x000000000060C000-memory.dmpFilesize
3.0MB
-
memory/3932-125-0x0000000003270000-0x000000000329E000-memory.dmpFilesize
184KB
-
memory/3932-127-0x0000000004B60000-0x0000000004E80000-memory.dmpFilesize
3.1MB
-
memory/3932-128-0x00000000048C0000-0x0000000004953000-memory.dmpFilesize
588KB
-
memory/4060-120-0x00000000006D0000-0x00000000006E4000-memory.dmpFilesize
80KB
-
memory/4060-119-0x0000000000B20000-0x0000000000E40000-memory.dmpFilesize
3.1MB
-
memory/4060-117-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/4060-121-0x0000000000A20000-0x0000000000A34000-memory.dmpFilesize
80KB
-
memory/4060-116-0x000000000041EAF0-mapping.dmp