Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
06-05-2021 12:02
Static task
static1
Behavioral task
behavioral1
Sample
NEW ODER.exe
Resource
win7v20210410
General
-
Target
NEW ODER.exe
-
Size
225KB
-
MD5
a995d24b27548f0215eaa0d87dc140c3
-
SHA1
d2adc518df40843623413b5d5310ea4069fdba2e
-
SHA256
859db52a7e6fdf6f93350d27b7917853b8b88a2536721328ff60a98f59a93b91
-
SHA512
693d6532465d4bbf3d5f67473bdc539ec255bbc6a7950ae7a170a7a2dc8eee8a7c16f471fb210d8f492aea8e038e9f794207354906c231216bfd81cfd2e897ac
Malware Config
Extracted
formbook
4.1
http://www.knighttechinca.com/dxe/
sardarfarm.com
959tremont.com
privat-livecam.net
ansel-homebakery.com
joysupermarket.com
peninsulamatchmakers.net
northsytyle.com
radioconexaoubermusic.com
relocatingrealtor.com
desyrnan.com
onlinehoortoestel.online
enpointe.online
rvvikings.com
paulpoirier.com
shitarpa.net
kerneis.net
rokitreach.com
essentiallygaia.com
prestiged.net
fuerzaagavera.com
soukid.com
moderndatingcoach.com
mentalfreedom.guru
bullishsoftware.com
sectorulb.com
outletyana.com
fptplaybox.website
artinmemory.com
buyruon.com
ljd.xyz
mondaysmatters.com
spiritsoundart.net
ixiangzu.com
lacompagniadelfardello.com
bnctly.com
sarasvati-yoga.com
0055game.com
lagrangewildliferemoval.com
umlausa.com
chaytel.com
kkkc5.com
union-green.com
philreid4cc.com
theanimehat.com
redlightlegal.com
myaustraliarewards.com
barkinlot.com
mujahidservice.online
nugeneraonline.com
sopplugin.com
makemyroom.design
ferienschweden.com
fps2020dkasphotoop.com
stylezbykay.com
royalpropertiesgurugram.com
birzulova.com
cosmicmtn.com
kissanime.press
poweringprogress.today
omsamedic.com
drunkpoetsociety.com
hostbison.com
asapdecor.com
houseofsisson.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4024-117-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2252-123-0x0000000000F80000-0x0000000000FAE000-memory.dmp formbook -
Loads dropped DLL 1 IoCs
Processes:
NEW ODER.exepid process 740 NEW ODER.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
NEW ODER.exeNEW ODER.execmmon32.exedescription pid process target process PID 740 set thread context of 4024 740 NEW ODER.exe NEW ODER.exe PID 4024 set thread context of 2724 4024 NEW ODER.exe Explorer.EXE PID 2252 set thread context of 2724 2252 cmmon32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
NEW ODER.execmmon32.exepid process 4024 NEW ODER.exe 4024 NEW ODER.exe 4024 NEW ODER.exe 4024 NEW ODER.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe 2252 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2724 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
NEW ODER.exeNEW ODER.execmmon32.exepid process 740 NEW ODER.exe 4024 NEW ODER.exe 4024 NEW ODER.exe 4024 NEW ODER.exe 2252 cmmon32.exe 2252 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
NEW ODER.execmmon32.exedescription pid process Token: SeDebugPrivilege 4024 NEW ODER.exe Token: SeDebugPrivilege 2252 cmmon32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 2724 Explorer.EXE 2724 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 2724 Explorer.EXE 2724 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2724 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
NEW ODER.exeExplorer.EXEcmmon32.exedescription pid process target process PID 740 wrote to memory of 4024 740 NEW ODER.exe NEW ODER.exe PID 740 wrote to memory of 4024 740 NEW ODER.exe NEW ODER.exe PID 740 wrote to memory of 4024 740 NEW ODER.exe NEW ODER.exe PID 740 wrote to memory of 4024 740 NEW ODER.exe NEW ODER.exe PID 2724 wrote to memory of 2252 2724 Explorer.EXE cmmon32.exe PID 2724 wrote to memory of 2252 2724 Explorer.EXE cmmon32.exe PID 2724 wrote to memory of 2252 2724 Explorer.EXE cmmon32.exe PID 2252 wrote to memory of 3272 2252 cmmon32.exe cmd.exe PID 2252 wrote to memory of 3272 2252 cmmon32.exe cmd.exe PID 2252 wrote to memory of 3272 2252 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW ODER.exe"C:\Users\Admin\AppData\Local\Temp\NEW ODER.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW ODER.exe"C:\Users\Admin\AppData\Local\Temp\NEW ODER.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\NEW ODER.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsx72B6.tmp\aj28.dllMD5
3a2c0cbf7b078a932352865c9c3ccc04
SHA179d95f00557a629f1008ef44b961437772092864
SHA256e67bc472ae4eacd5543ade899c75dc7a7d703f0e5a9663de35ad5b28808410da
SHA5125136b1538c5784abaaef9c8d81ac32c9d2f768d459d30e47d581127ee741f319a49e1bfeff5a9f4acca683f4447a1581d3ed92ac980fa80f71ee2a577df36a59
-
memory/740-115-0x0000000002290000-0x0000000002292000-memory.dmpFilesize
8KB
-
memory/2252-121-0x0000000000000000-mapping.dmp
-
memory/2252-126-0x0000000004F00000-0x0000000004F93000-memory.dmpFilesize
588KB
-
memory/2252-125-0x0000000005090000-0x00000000053B0000-memory.dmpFilesize
3.1MB
-
memory/2252-122-0x0000000001300000-0x000000000130C000-memory.dmpFilesize
48KB
-
memory/2252-123-0x0000000000F80000-0x0000000000FAE000-memory.dmpFilesize
184KB
-
memory/2724-120-0x0000000005310000-0x0000000005402000-memory.dmpFilesize
968KB
-
memory/2724-127-0x0000000005410000-0x0000000005577000-memory.dmpFilesize
1.4MB
-
memory/3272-124-0x0000000000000000-mapping.dmp
-
memory/4024-119-0x0000000000E10000-0x0000000000E24000-memory.dmpFilesize
80KB
-
memory/4024-118-0x00000000009B0000-0x0000000000CD0000-memory.dmpFilesize
3.1MB
-
memory/4024-117-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/4024-116-0x000000000041EAF0-mapping.dmp