Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
06-05-2021 07:11
Static task
static1
Behavioral task
behavioral1
Sample
new order.exe
Resource
win7v20210410
General
-
Target
new order.exe
-
Size
225KB
-
MD5
5c24de06380c0c24db91bb3ab6eeace3
-
SHA1
74de5b1eac0982786136b4ecb4bc664bd9d26636
-
SHA256
b3c5b3cf581d15fcbacf67b4bdba199bfe7089704875746109b3206eb07b99e2
-
SHA512
1ae9df468dbcaa9c1838fc4327d488843941e18e84affbdfd1d86d0b20f16c360853eff4373049e5628ee55c4e20da445dacc65c1fc4d3df56812b04733bc75b
Malware Config
Extracted
formbook
4.1
http://www.knighttechinca.com/dxe/
sardarfarm.com
959tremont.com
privat-livecam.net
ansel-homebakery.com
joysupermarket.com
peninsulamatchmakers.net
northsytyle.com
radioconexaoubermusic.com
relocatingrealtor.com
desyrnan.com
onlinehoortoestel.online
enpointe.online
rvvikings.com
paulpoirier.com
shitarpa.net
kerneis.net
rokitreach.com
essentiallygaia.com
prestiged.net
fuerzaagavera.com
soukid.com
moderndatingcoach.com
mentalfreedom.guru
bullishsoftware.com
sectorulb.com
outletyana.com
fptplaybox.website
artinmemory.com
buyruon.com
ljd.xyz
mondaysmatters.com
spiritsoundart.net
ixiangzu.com
lacompagniadelfardello.com
bnctly.com
sarasvati-yoga.com
0055game.com
lagrangewildliferemoval.com
umlausa.com
chaytel.com
kkkc5.com
union-green.com
philreid4cc.com
theanimehat.com
redlightlegal.com
myaustraliarewards.com
barkinlot.com
mujahidservice.online
nugeneraonline.com
sopplugin.com
makemyroom.design
ferienschweden.com
fps2020dkasphotoop.com
stylezbykay.com
royalpropertiesgurugram.com
birzulova.com
cosmicmtn.com
kissanime.press
poweringprogress.today
omsamedic.com
drunkpoetsociety.com
hostbison.com
asapdecor.com
houseofsisson.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1488-117-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2956-124-0x00000000006A0000-0x00000000006CE000-memory.dmp formbook -
Loads dropped DLL 1 IoCs
Processes:
new order.exepid process 3928 new order.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
new order.exenew order.exeNETSTAT.EXEdescription pid process target process PID 3928 set thread context of 1488 3928 new order.exe new order.exe PID 1488 set thread context of 3064 1488 new order.exe Explorer.EXE PID 2956 set thread context of 3064 2956 NETSTAT.EXE Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 2956 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
new order.exeNETSTAT.EXEpid process 1488 new order.exe 1488 new order.exe 1488 new order.exe 1488 new order.exe 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE 2956 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3064 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
new order.exenew order.exeNETSTAT.EXEpid process 3928 new order.exe 1488 new order.exe 1488 new order.exe 1488 new order.exe 2956 NETSTAT.EXE 2956 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
new order.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 1488 new order.exe Token: SeDebugPrivilege 2956 NETSTAT.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3064 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
new order.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 3928 wrote to memory of 1488 3928 new order.exe new order.exe PID 3928 wrote to memory of 1488 3928 new order.exe new order.exe PID 3928 wrote to memory of 1488 3928 new order.exe new order.exe PID 3928 wrote to memory of 1488 3928 new order.exe new order.exe PID 3064 wrote to memory of 2956 3064 Explorer.EXE NETSTAT.EXE PID 3064 wrote to memory of 2956 3064 Explorer.EXE NETSTAT.EXE PID 3064 wrote to memory of 2956 3064 Explorer.EXE NETSTAT.EXE PID 2956 wrote to memory of 3676 2956 NETSTAT.EXE cmd.exe PID 2956 wrote to memory of 3676 2956 NETSTAT.EXE cmd.exe PID 2956 wrote to memory of 3676 2956 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\new order.exe"C:\Users\Admin\AppData\Local\Temp\new order.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\new order.exe"C:\Users\Admin\AppData\Local\Temp\new order.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\new order.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsb164E.tmp\fiq3i6.dllMD5
11955007c9dd82171650f0b0f5a5103f
SHA1fd41b1d885975db292d2c5a0e271f884f8868ddb
SHA256c98f6514cdd9f453b87f53db4b77282d067e78e30c39a5dc731cc8e70dbac1c1
SHA512cc521deb22844b2082bc47034948031b76f4fa698f15961bc016604c71834104f5fbdb058cbe2ab7b4d7676a4af12c1873db36a56979c4ad02912385ab4bdbc4
-
memory/1488-118-0x0000000000B60000-0x0000000000E80000-memory.dmpFilesize
3.1MB
-
memory/1488-116-0x000000000041EAF0-mapping.dmp
-
memory/1488-117-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1488-119-0x00000000005C0000-0x00000000005D4000-memory.dmpFilesize
80KB
-
memory/2956-124-0x00000000006A0000-0x00000000006CE000-memory.dmpFilesize
184KB
-
memory/2956-121-0x0000000000000000-mapping.dmp
-
memory/2956-125-0x0000000002E60000-0x0000000003180000-memory.dmpFilesize
3.1MB
-
memory/2956-123-0x0000000000CB0000-0x0000000000CBB000-memory.dmpFilesize
44KB
-
memory/2956-126-0x0000000000BE0000-0x0000000000C73000-memory.dmpFilesize
588KB
-
memory/3064-120-0x0000000004DB0000-0x0000000004EEE000-memory.dmpFilesize
1.2MB
-
memory/3064-127-0x0000000005E40000-0x0000000005FB6000-memory.dmpFilesize
1.5MB
-
memory/3676-122-0x0000000000000000-mapping.dmp
-
memory/3928-115-0x0000000002180000-0x00000000021A4000-memory.dmpFilesize
144KB