Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
18-10-2021 07:59
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe
Resource
win7-en-20210920
General
-
Target
SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe
-
Size
417KB
-
MD5
cdda5b2580b9392c15f9dbf31e194a48
-
SHA1
8f74a7b387f298192730c46b837d6821d50a915b
-
SHA256
5c4023944c61d2985cc5c50811481eb3cd64d4e3caba1e4f96d8fcc7adf7c72a
-
SHA512
d0d2cfae7ca0da54d30dd32aa02639affb538e2b025a58a0558b258e4ae9a35b159b46259429b04d7aaa5d74d32bd35630782f777a6c2c40b2cdfcdcdaeb12c9
Malware Config
Extracted
formbook
4.1
mynd
http://www.dtcu0ng.com/mynd/
bbluedot3dwdbuy.com
aucworks.com
seekselflove.com
thebrandolphcollection.com
saint-daniel.info
covidtestcharleston.com
buniy.com
welprosol.com
focusedbusinesspartners.com
ichikawa.ltd
nieght.com
beediecandleco.com
gracobby.com
nowipe.club
meherconsultancy.com
didonghanquocxachtay.online
snovythailand.com
onetimecreditscore.net
hayosiapa.com
dumpstersforsellers.com
kopfimtopf.com
churchofmanifestation.com
scoopeer.com
givrees.com
giftmystyle.com
enovadis.com
blackcreativeslab.com
juamd.com
yaktaichicks.com
tamquin.net
themaskedstitcher.com
puresed.com
magadir.com
hiptopip.com
surgicalcaseoa.com
yanrk-ht586c.com
online-us.online
salonsuitesofcharleston.com
treeremovalcocoa.com
thewhiskeydisco.com
speaknativechinese.com
e-nokutan.com
mantra613.com
flatrenovation.site
servingdivisiion.com
jemimabdebrito.com
patrington-healthandfitness.com
pandemiyardimbildirim-tr.com
espejitia.com
natasciaedera.com
allcostpk.com
r10288.com
sabzi.uk
astitchinthyme.com
uniq-logistic.online
refreshingtherapy.com
pppdebtrisk.com
jejucash.net
ftfss.com
saintesproe.com
zfcarwholesalers.com
raben-p.site
sundaymorning.media
gatezless.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/436-125-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/436-126-0x000000000041EB00-mapping.dmp formbook behavioral2/memory/816-134-0x0000000002D80000-0x0000000002DAE000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exeRegSvcs.exesvchost.exedescription pid process target process PID 4164 set thread context of 436 4164 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 436 set thread context of 3040 436 RegSvcs.exe Explorer.EXE PID 816 set thread context of 3040 816 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exeRegSvcs.exesvchost.exepid process 4164 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe 4164 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe 4164 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe 4164 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe 436 RegSvcs.exe 436 RegSvcs.exe 436 RegSvcs.exe 436 RegSvcs.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3040 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exesvchost.exepid process 436 RegSvcs.exe 436 RegSvcs.exe 436 RegSvcs.exe 816 svchost.exe 816 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exeRegSvcs.exesvchost.exedescription pid process Token: SeDebugPrivilege 4164 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe Token: SeDebugPrivilege 436 RegSvcs.exe Token: SeDebugPrivilege 816 svchost.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exeExplorer.EXEsvchost.exedescription pid process target process PID 4164 wrote to memory of 3196 4164 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe schtasks.exe PID 4164 wrote to memory of 3196 4164 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe schtasks.exe PID 4164 wrote to memory of 3196 4164 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe schtasks.exe PID 4164 wrote to memory of 4672 4164 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 4164 wrote to memory of 4672 4164 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 4164 wrote to memory of 4672 4164 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 4164 wrote to memory of 436 4164 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 4164 wrote to memory of 436 4164 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 4164 wrote to memory of 436 4164 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 4164 wrote to memory of 436 4164 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 4164 wrote to memory of 436 4164 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 4164 wrote to memory of 436 4164 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 3040 wrote to memory of 816 3040 Explorer.EXE svchost.exe PID 3040 wrote to memory of 816 3040 Explorer.EXE svchost.exe PID 3040 wrote to memory of 816 3040 Explorer.EXE svchost.exe PID 816 wrote to memory of 320 816 svchost.exe cmd.exe PID 816 wrote to memory of 320 816 svchost.exe cmd.exe PID 816 wrote to memory of 320 816 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dXrTRQPXdHjjEj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp83C2.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/320-132-0x0000000000000000-mapping.dmp
-
memory/436-126-0x000000000041EB00-mapping.dmp
-
memory/436-128-0x0000000001730000-0x0000000001A50000-memory.dmpFilesize
3.1MB
-
memory/436-125-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/436-129-0x0000000001A90000-0x0000000001AA4000-memory.dmpFilesize
80KB
-
memory/816-131-0x0000000000000000-mapping.dmp
-
memory/816-134-0x0000000002D80000-0x0000000002DAE000-memory.dmpFilesize
184KB
-
memory/816-136-0x0000000003260000-0x00000000032F3000-memory.dmpFilesize
588KB
-
memory/816-135-0x0000000003820000-0x0000000003B40000-memory.dmpFilesize
3.1MB
-
memory/816-133-0x0000000000880000-0x000000000088C000-memory.dmpFilesize
48KB
-
memory/3040-130-0x0000000006650000-0x000000000679A000-memory.dmpFilesize
1.3MB
-
memory/3040-137-0x0000000002E80000-0x0000000002F37000-memory.dmpFilesize
732KB
-
memory/3196-124-0x0000000000000000-mapping.dmp
-
memory/4164-120-0x0000000004F20000-0x0000000004F21000-memory.dmpFilesize
4KB
-
memory/4164-118-0x0000000004E80000-0x0000000004E81000-memory.dmpFilesize
4KB
-
memory/4164-117-0x0000000005450000-0x0000000005451000-memory.dmpFilesize
4KB
-
memory/4164-122-0x0000000005430000-0x0000000005438000-memory.dmpFilesize
32KB
-
memory/4164-121-0x0000000007350000-0x0000000007351000-memory.dmpFilesize
4KB
-
memory/4164-115-0x00000000004A0000-0x00000000004A1000-memory.dmpFilesize
4KB
-
memory/4164-123-0x0000000007640000-0x0000000007690000-memory.dmpFilesize
320KB
-
memory/4164-119-0x0000000004F50000-0x000000000544E000-memory.dmpFilesize
5.0MB