Overview
overview
10Static
static
8BANK RECEIPT.exe
windows7_x64
10BANK RECEIPT.exe
windows10_x64
10BOL.xlsm
windows7_x64
10BOL.xlsm
windows10_x64
10Inv_399139_86191.xlsm
windows7_x64
10Inv_399139_86191.xlsm
windows10_x64
10Ordine 400...xs.exe
windows7_x64
10Ordine 400...xs.exe
windows10_x64
10PO.exe
windows7_x64
10PO.exe
windows10_x64
10STATEMENT ...NT.exe
windows7_x64
10STATEMENT ...NT.exe
windows10_x64
10SWIFT-MT10...df.exe
windows7_x64
10SWIFT-MT10...df.exe
windows10_x64
10inquiries ...B .exe
windows7_x64
10inquiries ...B .exe
windows10_x64
10Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
06-05-2021 21:56
Static task
static1
Behavioral task
behavioral1
Sample
BANK RECEIPT.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
BANK RECEIPT.exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
BOL.xlsm
Resource
win7v20210408
Behavioral task
behavioral4
Sample
BOL.xlsm
Resource
win10v20210410
Behavioral task
behavioral5
Sample
Inv_399139_86191.xlsm
Resource
win7v20210408
Behavioral task
behavioral6
Sample
Inv_399139_86191.xlsm
Resource
win10v20210410
Behavioral task
behavioral7
Sample
Ordine 400225.xlxs.exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
Ordine 400225.xlxs.exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
PO.exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
PO.exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
STATEMENT OF ACCOUNT.exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
STATEMENT OF ACCOUNT.exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
SWIFT-MT103_10262020.pdf.exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
SWIFT-MT103_10262020.pdf.exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
inquiries for WCB .exe
Resource
win7v20210408
General
-
Target
BANK RECEIPT.exe
-
Size
280KB
-
MD5
6317a0b98ebd6f0ba716fc1b73b4bf31
-
SHA1
6f593ad2588b2ca2e561f0b47c9654df9fd95932
-
SHA256
a2e99d0aabd8f0ad83b885eccf313563526a58b2da435bf34dad29294c712efe
-
SHA512
e29265b8cc385be1c86751dd04dd2a70d727e8e298cd0d0ca250c2c6515c8d1c189511c564de11cf9c3c85d3efed1e23f7ad4b91bcca156b6b7c4341195f449a
Malware Config
Extracted
formbook
4.1
http://www.knighttechinca.com/dxe/
sardarfarm.com
959tremont.com
privat-livecam.net
ansel-homebakery.com
joysupermarket.com
peninsulamatchmakers.net
northsytyle.com
radioconexaoubermusic.com
relocatingrealtor.com
desyrnan.com
onlinehoortoestel.online
enpointe.online
rvvikings.com
paulpoirier.com
shitarpa.net
kerneis.net
rokitreach.com
essentiallygaia.com
prestiged.net
fuerzaagavera.com
soukid.com
moderndatingcoach.com
mentalfreedom.guru
bullishsoftware.com
sectorulb.com
outletyana.com
fptplaybox.website
artinmemory.com
buyruon.com
ljd.xyz
mondaysmatters.com
spiritsoundart.net
ixiangzu.com
lacompagniadelfardello.com
bnctly.com
sarasvati-yoga.com
0055game.com
lagrangewildliferemoval.com
umlausa.com
chaytel.com
kkkc5.com
union-green.com
philreid4cc.com
theanimehat.com
redlightlegal.com
myaustraliarewards.com
barkinlot.com
mujahidservice.online
nugeneraonline.com
sopplugin.com
makemyroom.design
ferienschweden.com
fps2020dkasphotoop.com
stylezbykay.com
royalpropertiesgurugram.com
birzulova.com
cosmicmtn.com
kissanime.press
poweringprogress.today
omsamedic.com
drunkpoetsociety.com
hostbison.com
asapdecor.com
houseofsisson.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1988-64-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/748-73-0x0000000000090000-0x00000000000BE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1764 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
BANK RECEIPT.exepid process 1840 BANK RECEIPT.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
BANK RECEIPT.exeBANK RECEIPT.exewuapp.exedescription pid process target process PID 1840 set thread context of 1988 1840 BANK RECEIPT.exe BANK RECEIPT.exe PID 1988 set thread context of 1212 1988 BANK RECEIPT.exe Explorer.EXE PID 1988 set thread context of 1212 1988 BANK RECEIPT.exe Explorer.EXE PID 748 set thread context of 1212 748 wuapp.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
BANK RECEIPT.exewuapp.exepid process 1988 BANK RECEIPT.exe 1988 BANK RECEIPT.exe 1988 BANK RECEIPT.exe 748 wuapp.exe 748 wuapp.exe 748 wuapp.exe 748 wuapp.exe 748 wuapp.exe 748 wuapp.exe 748 wuapp.exe 748 wuapp.exe 748 wuapp.exe 748 wuapp.exe 748 wuapp.exe 748 wuapp.exe 748 wuapp.exe 748 wuapp.exe 748 wuapp.exe 748 wuapp.exe 748 wuapp.exe 748 wuapp.exe 748 wuapp.exe 748 wuapp.exe 748 wuapp.exe 748 wuapp.exe 748 wuapp.exe 748 wuapp.exe 748 wuapp.exe 748 wuapp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
BANK RECEIPT.exeBANK RECEIPT.exewuapp.exepid process 1840 BANK RECEIPT.exe 1988 BANK RECEIPT.exe 1988 BANK RECEIPT.exe 1988 BANK RECEIPT.exe 1988 BANK RECEIPT.exe 748 wuapp.exe 748 wuapp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
BANK RECEIPT.exewuapp.exedescription pid process Token: SeDebugPrivilege 1988 BANK RECEIPT.exe Token: SeDebugPrivilege 748 wuapp.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
BANK RECEIPT.exeBANK RECEIPT.exewuapp.exedescription pid process target process PID 1840 wrote to memory of 1988 1840 BANK RECEIPT.exe BANK RECEIPT.exe PID 1840 wrote to memory of 1988 1840 BANK RECEIPT.exe BANK RECEIPT.exe PID 1840 wrote to memory of 1988 1840 BANK RECEIPT.exe BANK RECEIPT.exe PID 1840 wrote to memory of 1988 1840 BANK RECEIPT.exe BANK RECEIPT.exe PID 1840 wrote to memory of 1988 1840 BANK RECEIPT.exe BANK RECEIPT.exe PID 1988 wrote to memory of 748 1988 BANK RECEIPT.exe wuapp.exe PID 1988 wrote to memory of 748 1988 BANK RECEIPT.exe wuapp.exe PID 1988 wrote to memory of 748 1988 BANK RECEIPT.exe wuapp.exe PID 1988 wrote to memory of 748 1988 BANK RECEIPT.exe wuapp.exe PID 1988 wrote to memory of 748 1988 BANK RECEIPT.exe wuapp.exe PID 1988 wrote to memory of 748 1988 BANK RECEIPT.exe wuapp.exe PID 1988 wrote to memory of 748 1988 BANK RECEIPT.exe wuapp.exe PID 748 wrote to memory of 1764 748 wuapp.exe cmd.exe PID 748 wrote to memory of 1764 748 wuapp.exe cmd.exe PID 748 wrote to memory of 1764 748 wuapp.exe cmd.exe PID 748 wrote to memory of 1764 748 wuapp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\BANK RECEIPT.exe"C:\Users\Admin\AppData\Local\Temp\BANK RECEIPT.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BANK RECEIPT.exe"C:\Users\Admin\AppData\Local\Temp\BANK RECEIPT.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\BANK RECEIPT.exe"5⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nss8A76.tmp\2g6ght2plrugud.dllMD5
64ade443342d3aa3790c2846abf93959
SHA1d6668f6881d40dc3dc3d1f627f2721e1d333e698
SHA256ea1deb95fa6614524006ee3260957aef27ebd563f609dde680cace5f2ea09e45
SHA5122fdce6c768ded710d6d011be5317b184a09e10058145bdff545e83df63f5e0f46db4f679161174397b37d0fb2f43abe7275405845742e4a73bc6ef995edf4845
-
memory/748-72-0x0000000000890000-0x000000000089B000-memory.dmpFilesize
44KB
-
memory/748-75-0x00000000002D0000-0x0000000000363000-memory.dmpFilesize
588KB
-
memory/748-74-0x0000000002100000-0x0000000002403000-memory.dmpFilesize
3.0MB
-
memory/748-73-0x0000000000090000-0x00000000000BE000-memory.dmpFilesize
184KB
-
memory/748-70-0x0000000000000000-mapping.dmp
-
memory/1212-76-0x0000000005030000-0x0000000005134000-memory.dmpFilesize
1.0MB
-
memory/1212-66-0x00000000043D0000-0x00000000044D0000-memory.dmpFilesize
1024KB
-
memory/1212-69-0x0000000006E90000-0x000000000703B000-memory.dmpFilesize
1.7MB
-
memory/1764-71-0x0000000000000000-mapping.dmp
-
memory/1840-63-0x00000000003D0000-0x00000000003D2000-memory.dmpFilesize
8KB
-
memory/1840-60-0x0000000074D91000-0x0000000074D93000-memory.dmpFilesize
8KB
-
memory/1988-65-0x0000000000480000-0x0000000000494000-memory.dmpFilesize
80KB
-
memory/1988-68-0x00000000006D0000-0x00000000006E4000-memory.dmpFilesize
80KB
-
memory/1988-67-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/1988-64-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1988-62-0x000000000041EAF0-mapping.dmp