Analysis
-
max time kernel
153s -
max time network
146s -
platform
windows10_x64 -
resource
win10-en -
submitted
02-09-2021 11:05
Static task
static1
Behavioral task
behavioral1
Sample
Yeni siparis ekteki listede.exe
Resource
win7-en
General
-
Target
Yeni siparis ekteki listede.exe
-
Size
962KB
-
MD5
a7ab9ba241d1caa4b43ee261be601d2f
-
SHA1
ffb7515430b7f27b50e70a4f14f86e18f12f1983
-
SHA256
87946dcd976eb13af37e24ff68e36a03d2f46a9ae474f336207cf03cbbb0b508
-
SHA512
5f31695db32997f00c9a0740e139df94ab66db10f00f6231e3518f667285bb06072ce6fbcb5d4d1c6d448c56b4bec0409c91ac970c63244d81c7c860448e8fd0
Malware Config
Extracted
formbook
4.1
3nop
http://www.jakesplacebarbers.com/3nop/
videohm.com
panache-rose.com
alnooncars-kw.com
trueblue2u.com
brussels-cafe.com
ip2c.net
influenzerr.com
rbcoq.com
zzful.com
drainthe.com
sumaholesson.com
cursosaprovados.com
genotecinc.com
dbrulhart.com
theapiarystudios.com
kensyu-kan.com
dkku88.com
tikhyper.com
aztecnort.com
homebrim.com
infinitilamp.com
leelegantflower.com
floor-space.investments
vidasustentavel.online
wholehearteddaughters.com
vipandeep.com
mdwovzrrm.icu
592215.com
academicplumbing.com
bestveganbook.com
theservantleader.com
nazarickdeveloper.xyz
delta-wing.com
girlfriendsgarb.com
sezyz11.com
ca3construction.com
smartswitchhomeloan.net
luckytwo.agency
ministry-of-barbers.com
babbageacademy.com
informationside.com
packapp.net
spacecoasthondaevent.com
thehealthyimmunereset.com
pjcavaliere.info
trebdurham.com
zhixintonghe.com
gon2580.com
dottproject.net
snakby.com
keeponsports.com
debbiewilsondesigns.com
stagingsolutionsgroup.com
forummondialdelamerbizerte.com
garnier.red
tempestchs.com
zpxinxi.com
jam-nins.com
inclusiocg.com
msmenders.com
whachupichu.com
pursemore.com
thebusinessfitclub.com
scootgotti.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3948-128-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3948-129-0x000000000041ED20-mapping.dmp formbook behavioral2/memory/684-138-0x0000000000120000-0x000000000014E000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Yeni siparis ekteki listede.exeYeni siparis ekteki listede.execontrol.exedescription pid process target process PID 3556 set thread context of 3948 3556 Yeni siparis ekteki listede.exe Yeni siparis ekteki listede.exe PID 3948 set thread context of 3008 3948 Yeni siparis ekteki listede.exe Explorer.EXE PID 3948 set thread context of 3008 3948 Yeni siparis ekteki listede.exe Explorer.EXE PID 684 set thread context of 3008 684 control.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 51 IoCs
Processes:
Yeni siparis ekteki listede.exeYeni siparis ekteki listede.execontrol.exepid process 3556 Yeni siparis ekteki listede.exe 3556 Yeni siparis ekteki listede.exe 3556 Yeni siparis ekteki listede.exe 3948 Yeni siparis ekteki listede.exe 3948 Yeni siparis ekteki listede.exe 3948 Yeni siparis ekteki listede.exe 3948 Yeni siparis ekteki listede.exe 3948 Yeni siparis ekteki listede.exe 3948 Yeni siparis ekteki listede.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe 684 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3008 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Yeni siparis ekteki listede.execontrol.exepid process 3948 Yeni siparis ekteki listede.exe 3948 Yeni siparis ekteki listede.exe 3948 Yeni siparis ekteki listede.exe 3948 Yeni siparis ekteki listede.exe 684 control.exe 684 control.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Yeni siparis ekteki listede.exeYeni siparis ekteki listede.execontrol.exedescription pid process Token: SeDebugPrivilege 3556 Yeni siparis ekteki listede.exe Token: SeDebugPrivilege 3948 Yeni siparis ekteki listede.exe Token: SeDebugPrivilege 684 control.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3008 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Yeni siparis ekteki listede.exeYeni siparis ekteki listede.execontrol.exedescription pid process target process PID 3556 wrote to memory of 1324 3556 Yeni siparis ekteki listede.exe schtasks.exe PID 3556 wrote to memory of 1324 3556 Yeni siparis ekteki listede.exe schtasks.exe PID 3556 wrote to memory of 1324 3556 Yeni siparis ekteki listede.exe schtasks.exe PID 3556 wrote to memory of 2108 3556 Yeni siparis ekteki listede.exe Yeni siparis ekteki listede.exe PID 3556 wrote to memory of 2108 3556 Yeni siparis ekteki listede.exe Yeni siparis ekteki listede.exe PID 3556 wrote to memory of 2108 3556 Yeni siparis ekteki listede.exe Yeni siparis ekteki listede.exe PID 3556 wrote to memory of 3948 3556 Yeni siparis ekteki listede.exe Yeni siparis ekteki listede.exe PID 3556 wrote to memory of 3948 3556 Yeni siparis ekteki listede.exe Yeni siparis ekteki listede.exe PID 3556 wrote to memory of 3948 3556 Yeni siparis ekteki listede.exe Yeni siparis ekteki listede.exe PID 3556 wrote to memory of 3948 3556 Yeni siparis ekteki listede.exe Yeni siparis ekteki listede.exe PID 3556 wrote to memory of 3948 3556 Yeni siparis ekteki listede.exe Yeni siparis ekteki listede.exe PID 3556 wrote to memory of 3948 3556 Yeni siparis ekteki listede.exe Yeni siparis ekteki listede.exe PID 3948 wrote to memory of 684 3948 Yeni siparis ekteki listede.exe control.exe PID 3948 wrote to memory of 684 3948 Yeni siparis ekteki listede.exe control.exe PID 3948 wrote to memory of 684 3948 Yeni siparis ekteki listede.exe control.exe PID 684 wrote to memory of 3796 684 control.exe cmd.exe PID 684 wrote to memory of 3796 684 control.exe cmd.exe PID 684 wrote to memory of 3796 684 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\Yeni siparis ekteki listede.exe"C:\Users\Admin\AppData\Local\Temp\Yeni siparis ekteki listede.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EbwSfSItxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6547.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Yeni siparis ekteki listede.exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Yeni siparis ekteki listede.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Yeni siparis ekteki listede.exe"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6547.tmpMD5
08463178366a86ee199d649cf00a7475
SHA1c904c84924e241b754728ce7fb75cbd277f7e6c2
SHA25692ed9d1e715126ab62bf46bb9abeecdb546b2a661a560af8085a6c4ff75bff1a
SHA5124a8282d6561ffb1cdd73e46725949ed33dc3cdfbc71d4cdc3175bc292ac11bbc78d47ce5095debef84b4df2261eaec5a6bddd9bc378db88841c5574550300597
-
memory/684-139-0x0000000000D70000-0x0000000001090000-memory.dmpFilesize
3.1MB
-
memory/684-135-0x0000000000000000-mapping.dmp
-
memory/684-138-0x0000000000120000-0x000000000014E000-memory.dmpFilesize
184KB
-
memory/684-137-0x00000000010E0000-0x0000000001100000-memory.dmpFilesize
128KB
-
memory/684-140-0x0000000004500000-0x0000000004593000-memory.dmpFilesize
588KB
-
memory/1324-126-0x0000000000000000-mapping.dmp
-
memory/3008-132-0x0000000004B90000-0x0000000004C81000-memory.dmpFilesize
964KB
-
memory/3008-141-0x0000000005AF0000-0x0000000005C4C000-memory.dmpFilesize
1.4MB
-
memory/3008-134-0x0000000004C90000-0x0000000004DE9000-memory.dmpFilesize
1.3MB
-
memory/3556-121-0x0000000004CF0000-0x0000000004CF1000-memory.dmpFilesize
4KB
-
memory/3556-120-0x00000000049D0000-0x00000000049D1000-memory.dmpFilesize
4KB
-
memory/3556-115-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/3556-124-0x0000000006750000-0x00000000067EB000-memory.dmpFilesize
620KB
-
memory/3556-122-0x0000000004990000-0x0000000004A2C000-memory.dmpFilesize
624KB
-
memory/3556-125-0x00000000064D0000-0x0000000006519000-memory.dmpFilesize
292KB
-
memory/3556-123-0x00000000022C0000-0x00000000022CE000-memory.dmpFilesize
56KB
-
memory/3556-119-0x0000000004AD0000-0x0000000004AD1000-memory.dmpFilesize
4KB
-
memory/3556-118-0x0000000004FD0000-0x0000000004FD1000-memory.dmpFilesize
4KB
-
memory/3556-117-0x0000000004A30000-0x0000000004A31000-memory.dmpFilesize
4KB
-
memory/3796-136-0x0000000000000000-mapping.dmp
-
memory/3948-128-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3948-133-0x0000000001BC0000-0x0000000001BD4000-memory.dmpFilesize
80KB
-
memory/3948-131-0x0000000001B80000-0x0000000001B94000-memory.dmpFilesize
80KB
-
memory/3948-130-0x0000000001820000-0x0000000001B40000-memory.dmpFilesize
3.1MB
-
memory/3948-129-0x000000000041ED20-mapping.dmp