Analysis
-
max time kernel
156s -
max time network
145s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
15-10-2021 19:28
Static task
static1
Behavioral task
behavioral1
Sample
invoice Ceylan 49.600€.exe
Resource
win7-en-20211014
General
-
Target
invoice Ceylan 49.600€.exe
-
Size
352KB
-
MD5
74f87a533471eaa7719df1d9b0593c2a
-
SHA1
77a20802e1e2db283ddf605a818372a72b0d8e26
-
SHA256
851b20d33b8210f3d20ab4694011a0858eeb745e248a768c1e4c214efb59464b
-
SHA512
a65587fa689531ff0d9da0c24ed9fb01adc986353491b6cb65773c66c7d5bf3773f8ae7c87ca4e2485da442c815722cdf5633e425693a8ace5f888744c868438
Malware Config
Extracted
formbook
4.1
cl8k
http://www.lightiroanwgt76.xyz/cl8k/
georgiaprfirm.com
rhinosafeinc.com
gandgpublishing.com
angelyangelarquitectos.com
formation-gallery.com
orangecountyipadrepair.com
aplearn.info
freshlucky.com
wrapfestival.com
zerosarentals.com
ff7a9vlt7.xyz
teachbing.com
mukos.xyz
baojianma.com
dermalaf.com
hannahandpatrick2022.com
yesilnoktam.xyz
theroyalhotels-kw.com
reisebazaar.online
senergypallet.com
proguardsbuilding.com
youarethemusic.com
sweetpomsforfamily.com
bluematrixcapital.com
global-constructions.com
lecoincryptofrancais.com
oralexpressions.com
sunriseiqwkij.xyz
msp2csp.com
heatherjonessold.com
meredithhamrick.com
jandefencing.com
compressionsocks1.com
xgn333.com
pamelasmithbickford.com
ourtribefive.com
voyagerclimate.com
toloroy.site
draketeamloans.com
callousrtvvbm.xyz
lightswaranwgt76.xyz
fxjg.net
97139.xyz
ismailkhayatgallery.com
archseducer.com
decocodeshop.com
cryptoex.space
dauntlesssmma.com
sword-electric.com
connextpr.com
nomundays.com
cruiser.ltd
kansasjersey.com
rewardsadvisorsite.com
sm-medical-consulting.com
grand-magic-hotel.com
tangnalihu.net
kerggon.xyz
shopdrmai.com
safety4event.com
redoakrev.com
rutaskate.com
topseniorsamxrewerds.com
saludyvida.info
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1084-64-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1084-65-0x000000000041F190-mapping.dmp formbook behavioral1/memory/1640-73-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1548 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
invoice Ceylan 49.600€.exeinvoice Ceylan 49.600€.exeNAPSTAT.EXEdescription pid process target process PID 1572 set thread context of 1084 1572 invoice Ceylan 49.600€.exe invoice Ceylan 49.600€.exe PID 1084 set thread context of 1396 1084 invoice Ceylan 49.600€.exe Explorer.EXE PID 1640 set thread context of 1396 1640 NAPSTAT.EXE Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
invoice Ceylan 49.600€.exeNAPSTAT.EXEpid process 1084 invoice Ceylan 49.600€.exe 1084 invoice Ceylan 49.600€.exe 1640 NAPSTAT.EXE 1640 NAPSTAT.EXE 1640 NAPSTAT.EXE 1640 NAPSTAT.EXE 1640 NAPSTAT.EXE 1640 NAPSTAT.EXE 1640 NAPSTAT.EXE 1640 NAPSTAT.EXE 1640 NAPSTAT.EXE 1640 NAPSTAT.EXE 1640 NAPSTAT.EXE 1640 NAPSTAT.EXE 1640 NAPSTAT.EXE 1640 NAPSTAT.EXE 1640 NAPSTAT.EXE 1640 NAPSTAT.EXE 1640 NAPSTAT.EXE 1640 NAPSTAT.EXE 1640 NAPSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
invoice Ceylan 49.600€.exeNAPSTAT.EXEpid process 1084 invoice Ceylan 49.600€.exe 1084 invoice Ceylan 49.600€.exe 1084 invoice Ceylan 49.600€.exe 1640 NAPSTAT.EXE 1640 NAPSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
invoice Ceylan 49.600€.exeNAPSTAT.EXEdescription pid process Token: SeDebugPrivilege 1084 invoice Ceylan 49.600€.exe Token: SeDebugPrivilege 1640 NAPSTAT.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1396 Explorer.EXE 1396 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1396 Explorer.EXE 1396 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
invoice Ceylan 49.600€.exeExplorer.EXENAPSTAT.EXEdescription pid process target process PID 1572 wrote to memory of 692 1572 invoice Ceylan 49.600€.exe schtasks.exe PID 1572 wrote to memory of 692 1572 invoice Ceylan 49.600€.exe schtasks.exe PID 1572 wrote to memory of 692 1572 invoice Ceylan 49.600€.exe schtasks.exe PID 1572 wrote to memory of 692 1572 invoice Ceylan 49.600€.exe schtasks.exe PID 1572 wrote to memory of 1084 1572 invoice Ceylan 49.600€.exe invoice Ceylan 49.600€.exe PID 1572 wrote to memory of 1084 1572 invoice Ceylan 49.600€.exe invoice Ceylan 49.600€.exe PID 1572 wrote to memory of 1084 1572 invoice Ceylan 49.600€.exe invoice Ceylan 49.600€.exe PID 1572 wrote to memory of 1084 1572 invoice Ceylan 49.600€.exe invoice Ceylan 49.600€.exe PID 1572 wrote to memory of 1084 1572 invoice Ceylan 49.600€.exe invoice Ceylan 49.600€.exe PID 1572 wrote to memory of 1084 1572 invoice Ceylan 49.600€.exe invoice Ceylan 49.600€.exe PID 1572 wrote to memory of 1084 1572 invoice Ceylan 49.600€.exe invoice Ceylan 49.600€.exe PID 1396 wrote to memory of 1640 1396 Explorer.EXE NAPSTAT.EXE PID 1396 wrote to memory of 1640 1396 Explorer.EXE NAPSTAT.EXE PID 1396 wrote to memory of 1640 1396 Explorer.EXE NAPSTAT.EXE PID 1396 wrote to memory of 1640 1396 Explorer.EXE NAPSTAT.EXE PID 1640 wrote to memory of 1548 1640 NAPSTAT.EXE cmd.exe PID 1640 wrote to memory of 1548 1640 NAPSTAT.EXE cmd.exe PID 1640 wrote to memory of 1548 1640 NAPSTAT.EXE cmd.exe PID 1640 wrote to memory of 1548 1640 NAPSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\invoice Ceylan 49.600€.exe"C:\Users\Admin\AppData\Local\Temp\invoice Ceylan 49.600€.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sIYfcmrdwEC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD671.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\invoice Ceylan 49.600€.exe"C:\Users\Admin\AppData\Local\Temp\invoice Ceylan 49.600€.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\invoice Ceylan 49.600€.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/692-61-0x0000000000000000-mapping.dmp
-
memory/1084-67-0x0000000000840000-0x0000000000B43000-memory.dmpFilesize
3.0MB
-
memory/1084-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1084-65-0x000000000041F190-mapping.dmp
-
memory/1084-68-0x00000000002B0000-0x00000000002C4000-memory.dmpFilesize
80KB
-
memory/1084-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1084-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1396-76-0x0000000007E20000-0x0000000007F9B000-memory.dmpFilesize
1.5MB
-
memory/1396-69-0x0000000006AF0000-0x0000000006C6F000-memory.dmpFilesize
1.5MB
-
memory/1548-71-0x0000000000000000-mapping.dmp
-
memory/1572-57-0x0000000074A31000-0x0000000074A33000-memory.dmpFilesize
8KB
-
memory/1572-59-0x0000000000550000-0x0000000000555000-memory.dmpFilesize
20KB
-
memory/1572-58-0x0000000004E50000-0x0000000004E51000-memory.dmpFilesize
4KB
-
memory/1572-60-0x0000000004790000-0x00000000047E0000-memory.dmpFilesize
320KB
-
memory/1572-55-0x0000000000EB0000-0x0000000000EB1000-memory.dmpFilesize
4KB
-
memory/1640-70-0x0000000000000000-mapping.dmp
-
memory/1640-72-0x00000000001A0000-0x00000000001E6000-memory.dmpFilesize
280KB
-
memory/1640-73-0x00000000000C0000-0x00000000000EF000-memory.dmpFilesize
188KB
-
memory/1640-74-0x0000000001E50000-0x0000000002153000-memory.dmpFilesize
3.0MB
-
memory/1640-75-0x0000000001D70000-0x0000000001E03000-memory.dmpFilesize
588KB