Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
15-10-2021 18:08
Static task
static1
Behavioral task
behavioral1
Sample
c052190b60d83304962baa2f4381ee06.exe
Resource
win7-en-20210920
General
-
Target
c052190b60d83304962baa2f4381ee06.exe
-
Size
246KB
-
MD5
c052190b60d83304962baa2f4381ee06
-
SHA1
1b9be49206b5c9c88847ba83ff4971902ff033b9
-
SHA256
9f59a9c7a38d8031c5b0829da6c4c10951b1de67adada4f567449d4b6ea8d83c
-
SHA512
04d5f431c75292820305470e1dbc16f08b3644583a24ad8c92a8a66b91f622a12dc514eb55dda52aa34248cb92460f43c939dc2d40c50ebe96a8f7abac2ec26c
Malware Config
Extracted
formbook
4.1
nk6l
http://www.rthearts.com/nk6l/
cbnextra.com
entitysystemsinc.com
55midwoodave.com
ebelizzi.com
khojcity.com
1527brokenoakdrive.site
housinghproperties.com
ratiousa.com
lrcrepresentacoes.net
tocoec.net
khadamatdemnate.com
davidkastner.xyz
gardeniaresort.com
qiantangguoji.com
visaprepaidprocessinq.com
cristinamadara.com
semapisus.xyz
mpwebagency.net
alibabasdeli.com
gigasupplies.com
quantumskillset.com
eajui136.xyz
patsanchezelpaso.com
trined.mobi
amaturz.info
approveprvqsx.xyz
fronterapost.house
clairewashere.site
xn--3jst70hg8f.com
thursdaynightthriller.com
primacykapjlt.xyz
vaginette.site
olitusd.com
paypal-caseid521.com
preose.xyz
ferbsqlv28.club
iffiliatefreedom.com
okdahotel.com
cochuzyan.xyz
hotyachts.net
diamond-beauties.com
storyofsol.com
xianshucai.net
venusmedicalarts.com
energiaorgonu.com
savannah.biz
poeticdaily.com
wilddalmatian.com
kdydkyqksqucyuyen.com
meanmod.xyz
kaka.digital
viewcision.com
wowzerbackupandrestore-us.com
hydrogendatapower.com
427521.com
ponto-bras.space
chevalsk.com
hnftdl.com
nanasyhogar.com
createacarepack.com
wildkraeuter-wochenende.com
uchihomedeco.com
quintongiang.com
mnbvending.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/596-55-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/596-56-0x000000000041F0F0-mapping.dmp formbook -
Loads dropped DLL 1 IoCs
Processes:
c052190b60d83304962baa2f4381ee06.exepid process 1556 c052190b60d83304962baa2f4381ee06.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c052190b60d83304962baa2f4381ee06.exedescription pid process target process PID 1556 set thread context of 596 1556 c052190b60d83304962baa2f4381ee06.exe c052190b60d83304962baa2f4381ee06.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
c052190b60d83304962baa2f4381ee06.exepid process 596 c052190b60d83304962baa2f4381ee06.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
c052190b60d83304962baa2f4381ee06.exedescription pid process target process PID 1556 wrote to memory of 596 1556 c052190b60d83304962baa2f4381ee06.exe c052190b60d83304962baa2f4381ee06.exe PID 1556 wrote to memory of 596 1556 c052190b60d83304962baa2f4381ee06.exe c052190b60d83304962baa2f4381ee06.exe PID 1556 wrote to memory of 596 1556 c052190b60d83304962baa2f4381ee06.exe c052190b60d83304962baa2f4381ee06.exe PID 1556 wrote to memory of 596 1556 c052190b60d83304962baa2f4381ee06.exe c052190b60d83304962baa2f4381ee06.exe PID 1556 wrote to memory of 596 1556 c052190b60d83304962baa2f4381ee06.exe c052190b60d83304962baa2f4381ee06.exe PID 1556 wrote to memory of 596 1556 c052190b60d83304962baa2f4381ee06.exe c052190b60d83304962baa2f4381ee06.exe PID 1556 wrote to memory of 596 1556 c052190b60d83304962baa2f4381ee06.exe c052190b60d83304962baa2f4381ee06.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c052190b60d83304962baa2f4381ee06.exe"C:\Users\Admin\AppData\Local\Temp\c052190b60d83304962baa2f4381ee06.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c052190b60d83304962baa2f4381ee06.exe"C:\Users\Admin\AppData\Local\Temp\c052190b60d83304962baa2f4381ee06.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nstB81A.tmp\pjzghir.dllMD5
42913016238730a9aed1e2246f26e944
SHA123af57bdd8fcef04ff222d4945a92e27685e0f53
SHA2560e379293c9b084834bbc33561278ec9c8df126ba38e99f79640d5e76a7838745
SHA51286c5b94353a6bfa0c7a5a519af32ec198c48da8f12244cbca71091033e47b56f17267d73d5d2192cb34fef1005061ee3e4e4c1f508c3dd3748a22415f15bed32
-
memory/596-55-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/596-56-0x000000000041F0F0-mapping.dmp
-
memory/596-57-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/1556-53-0x00000000757B1000-0x00000000757B3000-memory.dmpFilesize
8KB