Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
23-07-2021 10:06
Static task
static1
Behavioral task
behavioral1
Sample
invoice.lzh.exe
Resource
win7v20210408
General
-
Target
invoice.lzh.exe
-
Size
530KB
-
MD5
d8135073743eead59a3ecde61bf051ca
-
SHA1
11a89d02e31a429b48295da8cd1c760a7ceae38d
-
SHA256
b506bb786b2b45d252f9886ad94e63cb60b60544dade0680b096f80c84cada7a
-
SHA512
15fe12c916712fab35377a7459da35624b5ed3d218c0bb7beab17a932a1883a333e0679122ce70130278d34dba9fc2d2033c8cec4024646bd73ab8702b28210b
Malware Config
Extracted
formbook
4.1
http://www.knighttechinca.com/dxe/
sardarfarm.com
959tremont.com
privat-livecam.net
ansel-homebakery.com
joysupermarket.com
peninsulamatchmakers.net
northsytyle.com
radioconexaoubermusic.com
relocatingrealtor.com
desyrnan.com
onlinehoortoestel.online
enpointe.online
rvvikings.com
paulpoirier.com
shitarpa.net
kerneis.net
rokitreach.com
essentiallygaia.com
prestiged.net
fuerzaagavera.com
soukid.com
moderndatingcoach.com
mentalfreedom.guru
bullishsoftware.com
sectorulb.com
outletyana.com
fptplaybox.website
artinmemory.com
buyruon.com
ljd.xyz
mondaysmatters.com
spiritsoundart.net
ixiangzu.com
lacompagniadelfardello.com
bnctly.com
sarasvati-yoga.com
0055game.com
lagrangewildliferemoval.com
umlausa.com
chaytel.com
kkkc5.com
union-green.com
philreid4cc.com
theanimehat.com
redlightlegal.com
myaustraliarewards.com
barkinlot.com
mujahidservice.online
nugeneraonline.com
sopplugin.com
makemyroom.design
ferienschweden.com
fps2020dkasphotoop.com
stylezbykay.com
royalpropertiesgurugram.com
birzulova.com
cosmicmtn.com
kissanime.press
poweringprogress.today
omsamedic.com
drunkpoetsociety.com
hostbison.com
asapdecor.com
houseofsisson.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1160-129-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/1160-130-0x000000000041EAF0-mapping.dmp formbook behavioral2/memory/2120-137-0x0000000000AC0000-0x0000000000AEE000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
invoice.lzh.exeinvoice.lzh.exeraserver.exedescription pid process target process PID 632 set thread context of 1160 632 invoice.lzh.exe invoice.lzh.exe PID 1160 set thread context of 2428 1160 invoice.lzh.exe Explorer.EXE PID 2120 set thread context of 2428 2120 raserver.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 47 IoCs
Processes:
invoice.lzh.exeinvoice.lzh.exeraserver.exepid process 632 invoice.lzh.exe 1160 invoice.lzh.exe 1160 invoice.lzh.exe 1160 invoice.lzh.exe 1160 invoice.lzh.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe 2120 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2428 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
invoice.lzh.exeraserver.exepid process 1160 invoice.lzh.exe 1160 invoice.lzh.exe 1160 invoice.lzh.exe 2120 raserver.exe 2120 raserver.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
invoice.lzh.exeinvoice.lzh.exeraserver.exedescription pid process Token: SeDebugPrivilege 632 invoice.lzh.exe Token: SeDebugPrivilege 1160 invoice.lzh.exe Token: SeDebugPrivilege 2120 raserver.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2428 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
invoice.lzh.exeExplorer.EXEraserver.exedescription pid process target process PID 632 wrote to memory of 2940 632 invoice.lzh.exe schtasks.exe PID 632 wrote to memory of 2940 632 invoice.lzh.exe schtasks.exe PID 632 wrote to memory of 2940 632 invoice.lzh.exe schtasks.exe PID 632 wrote to memory of 1160 632 invoice.lzh.exe invoice.lzh.exe PID 632 wrote to memory of 1160 632 invoice.lzh.exe invoice.lzh.exe PID 632 wrote to memory of 1160 632 invoice.lzh.exe invoice.lzh.exe PID 632 wrote to memory of 1160 632 invoice.lzh.exe invoice.lzh.exe PID 632 wrote to memory of 1160 632 invoice.lzh.exe invoice.lzh.exe PID 632 wrote to memory of 1160 632 invoice.lzh.exe invoice.lzh.exe PID 2428 wrote to memory of 2120 2428 Explorer.EXE raserver.exe PID 2428 wrote to memory of 2120 2428 Explorer.EXE raserver.exe PID 2428 wrote to memory of 2120 2428 Explorer.EXE raserver.exe PID 2120 wrote to memory of 2188 2120 raserver.exe cmd.exe PID 2120 wrote to memory of 2188 2120 raserver.exe cmd.exe PID 2120 wrote to memory of 2188 2120 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\invoice.lzh.exe"C:\Users\Admin\AppData\Local\Temp\invoice.lzh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HPjuSZknbJLLSG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp47D7.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\invoice.lzh.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\invoice.lzh.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp47D7.tmpMD5
0937496bb1581c7211066f8080084965
SHA11becb26c71f9202394715abc66122cd841189aa6
SHA25657e3987d3eb4401213c508df574dd57c78848d3014ba233d7ee92653f756ad78
SHA512eb5036cc052571b4b861ca4cb994d34aa677183c139be5ca96d5e1c837e9c7470dec240f1e520d9abde626ac09a3c3f4252dea44bba912de1f23e6941f7d19c4
-
memory/632-125-0x00000000058B0000-0x0000000005939000-memory.dmpFilesize
548KB
-
memory/632-118-0x000000000A710000-0x000000000A711000-memory.dmpFilesize
4KB
-
memory/632-126-0x0000000005820000-0x0000000005859000-memory.dmpFilesize
228KB
-
memory/632-119-0x0000000002C70000-0x0000000002C71000-memory.dmpFilesize
4KB
-
memory/632-120-0x0000000005280000-0x0000000005281000-memory.dmpFilesize
4KB
-
memory/632-121-0x0000000005283000-0x0000000005285000-memory.dmpFilesize
8KB
-
memory/632-122-0x000000000EA90000-0x000000000EA91000-memory.dmpFilesize
4KB
-
memory/632-123-0x0000000005390000-0x0000000005392000-memory.dmpFilesize
8KB
-
memory/632-116-0x00000000051F0000-0x0000000005256000-memory.dmpFilesize
408KB
-
memory/632-114-0x0000000000920000-0x0000000000921000-memory.dmpFilesize
4KB
-
memory/632-124-0x0000000005440000-0x0000000005441000-memory.dmpFilesize
4KB
-
memory/632-117-0x000000000AC10000-0x000000000AC11000-memory.dmpFilesize
4KB
-
memory/1160-129-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1160-130-0x000000000041EAF0-mapping.dmp
-
memory/1160-132-0x0000000001250000-0x0000000001264000-memory.dmpFilesize
80KB
-
memory/1160-131-0x0000000001310000-0x0000000001630000-memory.dmpFilesize
3.1MB
-
memory/2120-137-0x0000000000AC0000-0x0000000000AEE000-memory.dmpFilesize
184KB
-
memory/2120-138-0x0000000004A50000-0x0000000004D70000-memory.dmpFilesize
3.1MB
-
memory/2120-134-0x0000000000000000-mapping.dmp
-
memory/2120-136-0x0000000001160000-0x000000000117F000-memory.dmpFilesize
124KB
-
memory/2120-139-0x0000000004940000-0x00000000049D3000-memory.dmpFilesize
588KB
-
memory/2188-135-0x0000000000000000-mapping.dmp
-
memory/2428-133-0x0000000005E10000-0x0000000005F15000-memory.dmpFilesize
1.0MB
-
memory/2428-140-0x0000000005F20000-0x00000000060AA000-memory.dmpFilesize
1.5MB
-
memory/2940-127-0x0000000000000000-mapping.dmp