Overview
overview
10Static
static
8BANK RECEIPT.exe
windows7_x64
10BANK RECEIPT.exe
windows10_x64
10BOL.xlsm
windows7_x64
10BOL.xlsm
windows10_x64
10Inv_399139_86191.xlsm
windows7_x64
10Inv_399139_86191.xlsm
windows10_x64
10Ordine 400...xs.exe
windows7_x64
10Ordine 400...xs.exe
windows10_x64
10PO.exe
windows7_x64
10PO.exe
windows10_x64
10STATEMENT ...NT.exe
windows7_x64
10STATEMENT ...NT.exe
windows10_x64
10SWIFT-MT10...df.exe
windows7_x64
10SWIFT-MT10...df.exe
windows10_x64
10inquiries ...B .exe
windows7_x64
10inquiries ...B .exe
windows10_x64
10Analysis
-
max time kernel
153s -
max time network
144s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
06-05-2021 22:02
Static task
static1
Behavioral task
behavioral1
Sample
BANK RECEIPT.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
BANK RECEIPT.exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
BOL.xlsm
Resource
win7v20210408
Behavioral task
behavioral4
Sample
BOL.xlsm
Resource
win10v20210410
Behavioral task
behavioral5
Sample
Inv_399139_86191.xlsm
Resource
win7v20210408
Behavioral task
behavioral6
Sample
Inv_399139_86191.xlsm
Resource
win10v20210410
Behavioral task
behavioral7
Sample
Ordine 400225.xlxs.exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
Ordine 400225.xlxs.exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
PO.exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
PO.exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
STATEMENT OF ACCOUNT.exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
STATEMENT OF ACCOUNT.exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
SWIFT-MT103_10262020.pdf.exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
SWIFT-MT103_10262020.pdf.exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
inquiries for WCB .exe
Resource
win7v20210408
General
-
Target
BANK RECEIPT.exe
-
Size
280KB
-
MD5
6317a0b98ebd6f0ba716fc1b73b4bf31
-
SHA1
6f593ad2588b2ca2e561f0b47c9654df9fd95932
-
SHA256
a2e99d0aabd8f0ad83b885eccf313563526a58b2da435bf34dad29294c712efe
-
SHA512
e29265b8cc385be1c86751dd04dd2a70d727e8e298cd0d0ca250c2c6515c8d1c189511c564de11cf9c3c85d3efed1e23f7ad4b91bcca156b6b7c4341195f449a
Malware Config
Extracted
formbook
4.1
http://www.knighttechinca.com/dxe/
sardarfarm.com
959tremont.com
privat-livecam.net
ansel-homebakery.com
joysupermarket.com
peninsulamatchmakers.net
northsytyle.com
radioconexaoubermusic.com
relocatingrealtor.com
desyrnan.com
onlinehoortoestel.online
enpointe.online
rvvikings.com
paulpoirier.com
shitarpa.net
kerneis.net
rokitreach.com
essentiallygaia.com
prestiged.net
fuerzaagavera.com
soukid.com
moderndatingcoach.com
mentalfreedom.guru
bullishsoftware.com
sectorulb.com
outletyana.com
fptplaybox.website
artinmemory.com
buyruon.com
ljd.xyz
mondaysmatters.com
spiritsoundart.net
ixiangzu.com
lacompagniadelfardello.com
bnctly.com
sarasvati-yoga.com
0055game.com
lagrangewildliferemoval.com
umlausa.com
chaytel.com
kkkc5.com
union-green.com
philreid4cc.com
theanimehat.com
redlightlegal.com
myaustraliarewards.com
barkinlot.com
mujahidservice.online
nugeneraonline.com
sopplugin.com
makemyroom.design
ferienschweden.com
fps2020dkasphotoop.com
stylezbykay.com
royalpropertiesgurugram.com
birzulova.com
cosmicmtn.com
kissanime.press
poweringprogress.today
omsamedic.com
drunkpoetsociety.com
hostbison.com
asapdecor.com
houseofsisson.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2044-64-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/848-74-0x00000000000C0000-0x00000000000EE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1512 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
BANK RECEIPT.exepid process 1684 BANK RECEIPT.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
BANK RECEIPT.exeBANK RECEIPT.execontrol.exedescription pid process target process PID 1684 set thread context of 2044 1684 BANK RECEIPT.exe BANK RECEIPT.exe PID 2044 set thread context of 1228 2044 BANK RECEIPT.exe Explorer.EXE PID 2044 set thread context of 1228 2044 BANK RECEIPT.exe Explorer.EXE PID 848 set thread context of 1228 848 control.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
BANK RECEIPT.execontrol.exepid process 2044 BANK RECEIPT.exe 2044 BANK RECEIPT.exe 2044 BANK RECEIPT.exe 848 control.exe 848 control.exe 848 control.exe 848 control.exe 848 control.exe 848 control.exe 848 control.exe 848 control.exe 848 control.exe 848 control.exe 848 control.exe 848 control.exe 848 control.exe 848 control.exe 848 control.exe 848 control.exe 848 control.exe 848 control.exe 848 control.exe 848 control.exe 848 control.exe 848 control.exe 848 control.exe 848 control.exe 848 control.exe 848 control.exe 848 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
BANK RECEIPT.exeBANK RECEIPT.execontrol.exepid process 1684 BANK RECEIPT.exe 2044 BANK RECEIPT.exe 2044 BANK RECEIPT.exe 2044 BANK RECEIPT.exe 2044 BANK RECEIPT.exe 848 control.exe 848 control.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
BANK RECEIPT.execontrol.exedescription pid process Token: SeDebugPrivilege 2044 BANK RECEIPT.exe Token: SeDebugPrivilege 848 control.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
BANK RECEIPT.exeExplorer.EXEcontrol.exedescription pid process target process PID 1684 wrote to memory of 2044 1684 BANK RECEIPT.exe BANK RECEIPT.exe PID 1684 wrote to memory of 2044 1684 BANK RECEIPT.exe BANK RECEIPT.exe PID 1684 wrote to memory of 2044 1684 BANK RECEIPT.exe BANK RECEIPT.exe PID 1684 wrote to memory of 2044 1684 BANK RECEIPT.exe BANK RECEIPT.exe PID 1684 wrote to memory of 2044 1684 BANK RECEIPT.exe BANK RECEIPT.exe PID 1228 wrote to memory of 848 1228 Explorer.EXE control.exe PID 1228 wrote to memory of 848 1228 Explorer.EXE control.exe PID 1228 wrote to memory of 848 1228 Explorer.EXE control.exe PID 1228 wrote to memory of 848 1228 Explorer.EXE control.exe PID 848 wrote to memory of 1512 848 control.exe cmd.exe PID 848 wrote to memory of 1512 848 control.exe cmd.exe PID 848 wrote to memory of 1512 848 control.exe cmd.exe PID 848 wrote to memory of 1512 848 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BANK RECEIPT.exe"C:\Users\Admin\AppData\Local\Temp\BANK RECEIPT.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BANK RECEIPT.exe"C:\Users\Admin\AppData\Local\Temp\BANK RECEIPT.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\BANK RECEIPT.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsx93B9.tmp\2g6ght2plrugud.dllMD5
64ade443342d3aa3790c2846abf93959
SHA1d6668f6881d40dc3dc3d1f627f2721e1d333e698
SHA256ea1deb95fa6614524006ee3260957aef27ebd563f609dde680cace5f2ea09e45
SHA5122fdce6c768ded710d6d011be5317b184a09e10058145bdff545e83df63f5e0f46db4f679161174397b37d0fb2f43abe7275405845742e4a73bc6ef995edf4845
-
memory/848-73-0x0000000000160000-0x000000000017F000-memory.dmpFilesize
124KB
-
memory/848-76-0x0000000000430000-0x00000000004C3000-memory.dmpFilesize
588KB
-
memory/848-75-0x00000000020F0000-0x00000000023F3000-memory.dmpFilesize
3.0MB
-
memory/848-74-0x00000000000C0000-0x00000000000EE000-memory.dmpFilesize
184KB
-
memory/848-70-0x0000000000000000-mapping.dmp
-
memory/1228-77-0x0000000004F40000-0x0000000005056000-memory.dmpFilesize
1.1MB
-
memory/1228-67-0x00000000073C0000-0x000000000751E000-memory.dmpFilesize
1.4MB
-
memory/1228-69-0x0000000004220000-0x0000000004320000-memory.dmpFilesize
1024KB
-
memory/1512-72-0x0000000000000000-mapping.dmp
-
memory/1684-62-0x00000000004D0000-0x00000000004D2000-memory.dmpFilesize
8KB
-
memory/1684-60-0x0000000075B31000-0x0000000075B33000-memory.dmpFilesize
8KB
-
memory/2044-65-0x00000000008E0000-0x0000000000BE3000-memory.dmpFilesize
3.0MB
-
memory/2044-68-0x00000000003A0000-0x00000000003B4000-memory.dmpFilesize
80KB
-
memory/2044-64-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2044-66-0x0000000000340000-0x0000000000354000-memory.dmpFilesize
80KB
-
memory/2044-63-0x000000000041EAF0-mapping.dmp