Analysis
-
max time kernel
151s -
max time network
144s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
23-07-2021 10:06
Static task
static1
Behavioral task
behavioral1
Sample
invoice.lzh.exe
Resource
win7v20210408
General
-
Target
invoice.lzh.exe
-
Size
530KB
-
MD5
d8135073743eead59a3ecde61bf051ca
-
SHA1
11a89d02e31a429b48295da8cd1c760a7ceae38d
-
SHA256
b506bb786b2b45d252f9886ad94e63cb60b60544dade0680b096f80c84cada7a
-
SHA512
15fe12c916712fab35377a7459da35624b5ed3d218c0bb7beab17a932a1883a333e0679122ce70130278d34dba9fc2d2033c8cec4024646bd73ab8702b28210b
Malware Config
Extracted
formbook
4.1
http://www.knighttechinca.com/dxe/
sardarfarm.com
959tremont.com
privat-livecam.net
ansel-homebakery.com
joysupermarket.com
peninsulamatchmakers.net
northsytyle.com
radioconexaoubermusic.com
relocatingrealtor.com
desyrnan.com
onlinehoortoestel.online
enpointe.online
rvvikings.com
paulpoirier.com
shitarpa.net
kerneis.net
rokitreach.com
essentiallygaia.com
prestiged.net
fuerzaagavera.com
soukid.com
moderndatingcoach.com
mentalfreedom.guru
bullishsoftware.com
sectorulb.com
outletyana.com
fptplaybox.website
artinmemory.com
buyruon.com
ljd.xyz
mondaysmatters.com
spiritsoundart.net
ixiangzu.com
lacompagniadelfardello.com
bnctly.com
sarasvati-yoga.com
0055game.com
lagrangewildliferemoval.com
umlausa.com
chaytel.com
kkkc5.com
union-green.com
philreid4cc.com
theanimehat.com
redlightlegal.com
myaustraliarewards.com
barkinlot.com
mujahidservice.online
nugeneraonline.com
sopplugin.com
makemyroom.design
ferienschweden.com
fps2020dkasphotoop.com
stylezbykay.com
royalpropertiesgurugram.com
birzulova.com
cosmicmtn.com
kissanime.press
poweringprogress.today
omsamedic.com
drunkpoetsociety.com
hostbison.com
asapdecor.com
houseofsisson.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/900-70-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/900-71-0x000000000041EAF0-mapping.dmp formbook behavioral1/memory/1852-79-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1328 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
invoice.lzh.exeinvoice.lzh.exeraserver.exedescription pid process target process PID 1348 set thread context of 900 1348 invoice.lzh.exe invoice.lzh.exe PID 900 set thread context of 1220 900 invoice.lzh.exe Explorer.EXE PID 1852 set thread context of 1220 1852 raserver.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
invoice.lzh.exeinvoice.lzh.exeraserver.exepid process 1348 invoice.lzh.exe 900 invoice.lzh.exe 900 invoice.lzh.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
invoice.lzh.exeraserver.exepid process 900 invoice.lzh.exe 900 invoice.lzh.exe 900 invoice.lzh.exe 1852 raserver.exe 1852 raserver.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
invoice.lzh.exeinvoice.lzh.exeraserver.exedescription pid process Token: SeDebugPrivilege 1348 invoice.lzh.exe Token: SeDebugPrivilege 900 invoice.lzh.exe Token: SeDebugPrivilege 1852 raserver.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
invoice.lzh.exeExplorer.EXEraserver.exedescription pid process target process PID 1348 wrote to memory of 1132 1348 invoice.lzh.exe schtasks.exe PID 1348 wrote to memory of 1132 1348 invoice.lzh.exe schtasks.exe PID 1348 wrote to memory of 1132 1348 invoice.lzh.exe schtasks.exe PID 1348 wrote to memory of 1132 1348 invoice.lzh.exe schtasks.exe PID 1348 wrote to memory of 900 1348 invoice.lzh.exe invoice.lzh.exe PID 1348 wrote to memory of 900 1348 invoice.lzh.exe invoice.lzh.exe PID 1348 wrote to memory of 900 1348 invoice.lzh.exe invoice.lzh.exe PID 1348 wrote to memory of 900 1348 invoice.lzh.exe invoice.lzh.exe PID 1348 wrote to memory of 900 1348 invoice.lzh.exe invoice.lzh.exe PID 1348 wrote to memory of 900 1348 invoice.lzh.exe invoice.lzh.exe PID 1348 wrote to memory of 900 1348 invoice.lzh.exe invoice.lzh.exe PID 1220 wrote to memory of 1852 1220 Explorer.EXE raserver.exe PID 1220 wrote to memory of 1852 1220 Explorer.EXE raserver.exe PID 1220 wrote to memory of 1852 1220 Explorer.EXE raserver.exe PID 1220 wrote to memory of 1852 1220 Explorer.EXE raserver.exe PID 1852 wrote to memory of 1328 1852 raserver.exe cmd.exe PID 1852 wrote to memory of 1328 1852 raserver.exe cmd.exe PID 1852 wrote to memory of 1328 1852 raserver.exe cmd.exe PID 1852 wrote to memory of 1328 1852 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\invoice.lzh.exe"C:\Users\Admin\AppData\Local\Temp\invoice.lzh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HPjuSZknbJLLSG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp44AE.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\invoice.lzh.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\invoice.lzh.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp44AE.tmpMD5
91e026ee4c37f75e2b82b11583fb01c4
SHA1a8481000baebe3329cae20cea551437fa3d91a26
SHA256c5b681c1808c6d7e08898f987efe9cdcf2242fc59c019c74bd6b53e68780599c
SHA5120d53b4614db00e1053c44baec190626ebefd39d059759f8c768d5374a7174875a9387e71768d1599e5d305394b71c7b70692cfc35c2f6edd128164d2685e0436
-
memory/900-70-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/900-73-0x00000000001D0000-0x00000000001E4000-memory.dmpFilesize
80KB
-
memory/900-72-0x00000000009C0000-0x0000000000CC3000-memory.dmpFilesize
3.0MB
-
memory/900-71-0x000000000041EAF0-mapping.dmp
-
memory/1132-68-0x0000000000000000-mapping.dmp
-
memory/1220-82-0x0000000003EB0000-0x0000000003F61000-memory.dmpFilesize
708KB
-
memory/1220-74-0x00000000062C0000-0x0000000006454000-memory.dmpFilesize
1.6MB
-
memory/1328-77-0x0000000000000000-mapping.dmp
-
memory/1348-66-0x0000000004A70000-0x0000000004AF9000-memory.dmpFilesize
548KB
-
memory/1348-67-0x0000000001F90000-0x0000000001FC9000-memory.dmpFilesize
228KB
-
memory/1348-60-0x0000000010F20000-0x0000000010F21000-memory.dmpFilesize
4KB
-
memory/1348-65-0x0000000004A35000-0x0000000004A46000-memory.dmpFilesize
68KB
-
memory/1348-64-0x0000000000380000-0x0000000000382000-memory.dmpFilesize
8KB
-
memory/1348-63-0x0000000004A30000-0x0000000004A31000-memory.dmpFilesize
4KB
-
memory/1348-62-0x00000000006D0000-0x0000000000736000-memory.dmpFilesize
408KB
-
memory/1852-75-0x0000000000000000-mapping.dmp
-
memory/1852-76-0x00000000762C1000-0x00000000762C3000-memory.dmpFilesize
8KB
-
memory/1852-78-0x00000000001C0000-0x00000000001DC000-memory.dmpFilesize
112KB
-
memory/1852-79-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/1852-80-0x0000000001EF0000-0x00000000021F3000-memory.dmpFilesize
3.0MB
-
memory/1852-81-0x0000000001DC0000-0x0000000001E53000-memory.dmpFilesize
588KB