Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
21-09-2021 11:53
Static task
static1
Behavioral task
behavioral1
Sample
09021.exe
Resource
win7v20210408
General
-
Target
09021.exe
-
Size
592KB
-
MD5
2536c125edc35ac5061b596308ff8dcd
-
SHA1
d0506e1bcdb5c8a3714ccb0fa6603173ade0baf7
-
SHA256
d9cc0ba64d20a3a60f1580c74ff1269f5b545a0abf23362cbc678b12057a6cf3
-
SHA512
f2e22c98a7a1986178413aa7661707973b6357fe3c2576f12e7b0a4817693f559a0aa6edae364b7c94875058d1e2dc91efeb4d2d05a826a060fa21cf14918521
Malware Config
Extracted
formbook
4.1
o4ms
http://www.nocodehost.com/o4ms/
fishingboatpub.com
trebor72.com
qualitycleanaustralia.com
amphilykenyx.com
jayte90.net
alveegrace.com
le-fleursoleil.com
volumoffer.com
businessbookwriters.com
alpin-art.com
firsttastetogo.com
catofc.com
ref-290.com
sbo2008.com
fortlauderdaleelevators.com
shanghaiyalian.com
majestybags.com
afcerd.com
myceliated.com
ls0a.com
chautauquapistolpermit.com
cq1937.com
riafellowship.com
sjzlyk120.com
onlinerebatemall.com
bjlmzmd.com
services-neetflix-info.info
khaapa.com
thehgboutique.com
iconndigital.com
ninjavendas.com
zeonyej.icu
iddqdtrk.com
taoy360.info
conanagent.icu
mobileflirting.online
lorrainelevis.com
bakerrepublic.com
tfi50.net
mildlobr.com
turnkeypet.com
instarmall.com
contilnetnoticias.website
symbiocrm.com
earn074.com
swapf.com
daveydavisphotography.com
notes2nobody.com
pensje.net
nanoplastiakopoma.com
inlandempiresublease.com
donaldjtryump.com
secondinningseva.com
zumohub.xyz
torbiedesigns.com
koastedco.com
lifestyleeve.com
purposepalacevenue.com
risk-managements.com
doluhediye.com
revolutionarylightworkers.com
smithridge.net
share-store.net
jastalks.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3648-126-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3648-127-0x000000000041EAB0-mapping.dmp formbook behavioral2/memory/508-135-0x0000000002B60000-0x0000000002B8E000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
09021.exe09021.exesvchost.exedescription pid process target process PID 2532 set thread context of 3648 2532 09021.exe 09021.exe PID 3648 set thread context of 392 3648 09021.exe Explorer.EXE PID 3648 set thread context of 392 3648 09021.exe Explorer.EXE PID 508 set thread context of 392 508 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
09021.exesvchost.exepid process 3648 09021.exe 3648 09021.exe 3648 09021.exe 3648 09021.exe 3648 09021.exe 3648 09021.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe 508 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 392 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
09021.exesvchost.exepid process 3648 09021.exe 3648 09021.exe 3648 09021.exe 3648 09021.exe 508 svchost.exe 508 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
09021.exesvchost.exedescription pid process Token: SeDebugPrivilege 3648 09021.exe Token: SeDebugPrivilege 508 svchost.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
09021.exe09021.exesvchost.exedescription pid process target process PID 2532 wrote to memory of 1860 2532 09021.exe schtasks.exe PID 2532 wrote to memory of 1860 2532 09021.exe schtasks.exe PID 2532 wrote to memory of 1860 2532 09021.exe schtasks.exe PID 2532 wrote to memory of 3648 2532 09021.exe 09021.exe PID 2532 wrote to memory of 3648 2532 09021.exe 09021.exe PID 2532 wrote to memory of 3648 2532 09021.exe 09021.exe PID 2532 wrote to memory of 3648 2532 09021.exe 09021.exe PID 2532 wrote to memory of 3648 2532 09021.exe 09021.exe PID 2532 wrote to memory of 3648 2532 09021.exe 09021.exe PID 3648 wrote to memory of 508 3648 09021.exe svchost.exe PID 3648 wrote to memory of 508 3648 09021.exe svchost.exe PID 3648 wrote to memory of 508 3648 09021.exe svchost.exe PID 508 wrote to memory of 1284 508 svchost.exe cmd.exe PID 508 wrote to memory of 1284 508 svchost.exe cmd.exe PID 508 wrote to memory of 1284 508 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\09021.exe"C:\Users\Admin\AppData\Local\Temp\09021.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QPfUom" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2B47.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\09021.exe"C:\Users\Admin\AppData\Local\Temp\09021.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\09021.exe"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/392-130-0x0000000004C50000-0x0000000004DA7000-memory.dmpFilesize
1.3MB
-
memory/392-139-0x0000000005F40000-0x00000000060CE000-memory.dmpFilesize
1.6MB
-
memory/392-132-0x0000000004DB0000-0x0000000004F10000-memory.dmpFilesize
1.4MB
-
memory/508-138-0x0000000003280000-0x0000000003313000-memory.dmpFilesize
588KB
-
memory/508-136-0x0000000002E00000-0x0000000002F4A000-memory.dmpFilesize
1.3MB
-
memory/508-135-0x0000000002B60000-0x0000000002B8E000-memory.dmpFilesize
184KB
-
memory/508-134-0x0000000000040000-0x000000000004C000-memory.dmpFilesize
48KB
-
memory/508-133-0x0000000000000000-mapping.dmp
-
memory/1284-137-0x0000000000000000-mapping.dmp
-
memory/1860-125-0x0000000000000000-mapping.dmp
-
memory/2532-122-0x0000000007DC0000-0x0000000007DC1000-memory.dmpFilesize
4KB
-
memory/2532-120-0x0000000005920000-0x000000000593D000-memory.dmpFilesize
116KB
-
memory/2532-117-0x0000000005D10000-0x0000000005D11000-memory.dmpFilesize
4KB
-
memory/2532-118-0x0000000005740000-0x0000000005741000-memory.dmpFilesize
4KB
-
memory/2532-119-0x00000000056D0000-0x00000000056D1000-memory.dmpFilesize
4KB
-
memory/2532-124-0x0000000007F60000-0x0000000007F91000-memory.dmpFilesize
196KB
-
memory/2532-121-0x0000000005810000-0x0000000005D0E000-memory.dmpFilesize
5.0MB
-
memory/2532-123-0x0000000007F00000-0x0000000007F60000-memory.dmpFilesize
384KB
-
memory/2532-115-0x0000000000E10000-0x0000000000E11000-memory.dmpFilesize
4KB
-
memory/3648-131-0x00000000014A0000-0x00000000014B4000-memory.dmpFilesize
80KB
-
memory/3648-127-0x000000000041EAB0-mapping.dmp
-
memory/3648-126-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3648-128-0x0000000001140000-0x0000000001460000-memory.dmpFilesize
3.1MB
-
memory/3648-129-0x0000000001460000-0x0000000001474000-memory.dmpFilesize
80KB