Analysis
- max time kernel
150s - max time network
141s - platform
windows10_x64 - resource
win10v20210410 - submitted
13/06/2021, 08:30
Static task
static1
Behavioral task
behavioral1
Sample
54333218976.exe
Resource
win7v20210410
windows7_x64
General
- Target 54333218976.exe
- Size 236KB
- Sample210613-qpy1e5fp86
- SHA256 5e6b89915432b64a3205f68d49db2ffc02007600a2a82a439aff431a95fcbeef
- MD5 26764c44a036d887bda704555e48db4a
- SHA1 aff8264f6f129321925cab9eaff2b439a974fa9d
- SHA512 f47ca8947a71f3dc28b7a84264bbf7819f303f9ecb6684825ced9942bc037aa9e12136b0e55e7bc253e3b234c86e6fd3233828ea131908cca7979191cacb6b5e
- MD5 SHA1 SHA512
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.111bjs.com/ccr/
-
abdullahlodhi.com
-
jevya.com
-
knoxvillerestaurant.com
-
mekarauroko7389.com
-
cricketspowder.net
-
johannchirinos.com
-
orangeorganical.com
-
libero-tt.com
-
lorenaegianluca.com
-
wintab.net
-
modernmillievintage.com
-
zgdqcyw.com
-
jeffabildgaardmd.com
-
nurulfikrimakassar.com
-
findyourchef.com
-
innovationsservicegroup.com
-
destek-taleplerimiz.com
-
whfqqco.icu
-
kosmetikmadeingermany.com
-
dieteticos.net
-
savarsineklik.com
-
newfashiontrends.com
-
e-mobilitysolutions.com
-
spaced.ltd
-
amjadalitrading.com
-
thejstutor.com
-
zzhqp.com
-
exoticomistico.com
-
oklahomasundayschool.com
-
grwfrog.com
-
elementsfitnessamdwellbeing.com
-
auldontoyworld.com
-
cumhuriyetcidemokratparti.kim
-
thetruthinternational.com
-
adimadimingilizce.com
-
retreatwinds.com
-
duoteshop.com
-
jasonkokrak.com
-
latindancextreme.com
-
agavedeals.com
-
motz.xyz
-
kspecialaroma.com
-
yuejinjc.com
-
print12580.com
-
ampsports.tennis
-
affordablebathroomsarizona.com
-
casnop.com
-
driftwestcoastmarket.com
-
bjsjygg.com
-
gwpjamshedpur.com
-
reserveacalifornia.com
-
caobv.com
-
culturaenmistacones.com
-
back-upstore.com
-
jjsmiths.com
-
iamxc.com
-
siobhankrittiya.com
-
digitalakanksha.com
-
koatku.com
-
shamushalkowich.com
-
merplerps.com
-
fishexpertise.com
-
sweetheartmart.com
-
nqs.xyz
Signatures
- Formbook Payload 2 IoCs
resource yara_rule behavioral2/memory/1656-117-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2880-123-0x0000000000C30000-0x0000000000C5E000-memory.dmp formbook - Loads dropped DLL 2 IoCs
pid Process 3176 54333218976.exe 3176 54333218976.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3176 set thread context of 1656 3176 54333218976.exe 75 PID 1656 set thread context of 2984 1656 54333218976.exe 10 PID 2880 set thread context of 2984 2880 wlanext.exe 10 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3176 54333218976.exe 3176 54333218976.exe 3176 54333218976.exe 3176 54333218976.exe 3176 54333218976.exe 3176 54333218976.exe 3176 54333218976.exe 3176 54333218976.exe 1656 54333218976.exe 1656 54333218976.exe 1656 54333218976.exe 1656 54333218976.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe 2880 wlanext.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2984 Explorer.EXE - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 3176 54333218976.exe 1656 54333218976.exe 1656 54333218976.exe 1656 54333218976.exe 2880 wlanext.exe 2880 wlanext.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 1656 54333218976.exe Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeDebugPrivilege 2880 wlanext.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2984 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3176 wrote to memory of 1656 3176 54333218976.exe 75 PID 3176 wrote to memory of 1656 3176 54333218976.exe 75 PID 3176 wrote to memory of 1656 3176 54333218976.exe 75 PID 3176 wrote to memory of 1656 3176 54333218976.exe 75 PID 2984 wrote to memory of 2880 2984 Explorer.EXE 77 PID 2984 wrote to memory of 2880 2984 Explorer.EXE 77 PID 2984 wrote to memory of 2880 2984 Explorer.EXE 77 PID 2880 wrote to memory of 2768 2880 wlanext.exe 80 PID 2880 wrote to memory of 2768 2880 wlanext.exe 80 PID 2880 wrote to memory of 2768 2880 wlanext.exe 80
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\54333218976.exe"C:\Users\Admin\AppData\Local\Temp\54333218976.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\54333218976.exe"C:\Users\Admin\AppData\Local\Temp\54333218976.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1656
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\54333218976.exe"3⤵PID:2768
-
-