Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
19-10-2021 06:36
Static task
static1
Behavioral task
behavioral1
Sample
Document RFQ#8086A_461A_0000086_300_3550_2021.exe
Resource
win7-en-20210920
General
-
Target
Document RFQ#8086A_461A_0000086_300_3550_2021.exe
-
Size
510KB
-
MD5
a445dd187c6dc7254da6d2f0d893f2fb
-
SHA1
c0548d4ed4a9c2b68fbcf592e9a892fa587d5b0e
-
SHA256
2a2187ae775f286c2400957b71aac1c550779fc6652a710d126546d4d4879f0f
-
SHA512
ec8fb387474fe1a737ea46d67e5b2e363ecb6c35634e1af63e465fb487c8ae2b7684d128d8ea982d6234110dee83a4601b6fba64f05765a41927f580520c527e
Malware Config
Extracted
formbook
4.1
g8ni
http://www.er5544.com/g8ni/
nickmowat.com
garethjame.biz
colibrilift.com
vulnerabilitylabs.one
neuro-ai-web-ru.website
16mcnaestreetmooneeponds.com
bestofstmaarten.net
meditelier.com
ragnarduke.com
escueladecampo.com
vongtayvn.com
inmemoriamaan.com
yourpeoplemanager.com
r6-gytr.com
agreeablebeauty.com
snpconfirms.com
tribalurq.quest
purafuse.com
cisco-training-course.com
wery.top
haiyaa.tech
schtefo.net
kenytc.com
energypopcorn.com
0urls.top
artiatec.com
enqum.com
nextcloud.solutions
stateaffairsng.com
727bpay.com
matchmakerfiji.com
qingdouge.com
nusrattelbdoffical.xyz
seo-clicks7.com
aspirateurs.net
autosandmorestore.com
moje-akvarium.net
uehddw.com
geschmacksakademie.com
gendarmerie.email
buynftinc.com
mission-nao.com
webmakers.xyz
federationwholesale.com
tjbieying.com
finestpoints.com
premiersloyko.xyz
carlislepartssurvey.com
hackernfts.com
abitvip.com
iphone13mini.supplies
thenorthfacedeal.online
swlhvipbj.com
elguije.com
auto2pl.com
route112mitsubishi.com
zilliq.com
pumateam04.com
xtzztf.com
sacmaudantoc.xyz
kalafwalker.com
jumeaux-numeriques.com
purposefulwork.com
jacquelineblog.info
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/368-125-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/368-126-0x000000000041F0C0-mapping.dmp formbook behavioral2/memory/1216-133-0x0000000001080000-0x00000000010AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Document RFQ#8086A_461A_0000086_300_3550_2021.exeDocument RFQ#8086A_461A_0000086_300_3550_2021.exehelp.exedescription pid process target process PID 4140 set thread context of 368 4140 Document RFQ#8086A_461A_0000086_300_3550_2021.exe Document RFQ#8086A_461A_0000086_300_3550_2021.exe PID 368 set thread context of 2672 368 Document RFQ#8086A_461A_0000086_300_3550_2021.exe Explorer.EXE PID 1216 set thread context of 2672 1216 help.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
Document RFQ#8086A_461A_0000086_300_3550_2021.exeDocument RFQ#8086A_461A_0000086_300_3550_2021.exehelp.exepid process 4140 Document RFQ#8086A_461A_0000086_300_3550_2021.exe 4140 Document RFQ#8086A_461A_0000086_300_3550_2021.exe 4140 Document RFQ#8086A_461A_0000086_300_3550_2021.exe 4140 Document RFQ#8086A_461A_0000086_300_3550_2021.exe 4140 Document RFQ#8086A_461A_0000086_300_3550_2021.exe 4140 Document RFQ#8086A_461A_0000086_300_3550_2021.exe 4140 Document RFQ#8086A_461A_0000086_300_3550_2021.exe 4140 Document RFQ#8086A_461A_0000086_300_3550_2021.exe 368 Document RFQ#8086A_461A_0000086_300_3550_2021.exe 368 Document RFQ#8086A_461A_0000086_300_3550_2021.exe 368 Document RFQ#8086A_461A_0000086_300_3550_2021.exe 368 Document RFQ#8086A_461A_0000086_300_3550_2021.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe 1216 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2672 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Document RFQ#8086A_461A_0000086_300_3550_2021.exehelp.exepid process 368 Document RFQ#8086A_461A_0000086_300_3550_2021.exe 368 Document RFQ#8086A_461A_0000086_300_3550_2021.exe 368 Document RFQ#8086A_461A_0000086_300_3550_2021.exe 1216 help.exe 1216 help.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Document RFQ#8086A_461A_0000086_300_3550_2021.exeDocument RFQ#8086A_461A_0000086_300_3550_2021.exehelp.exedescription pid process Token: SeDebugPrivilege 4140 Document RFQ#8086A_461A_0000086_300_3550_2021.exe Token: SeDebugPrivilege 368 Document RFQ#8086A_461A_0000086_300_3550_2021.exe Token: SeDebugPrivilege 1216 help.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Document RFQ#8086A_461A_0000086_300_3550_2021.exeExplorer.EXEhelp.exedescription pid process target process PID 4140 wrote to memory of 804 4140 Document RFQ#8086A_461A_0000086_300_3550_2021.exe schtasks.exe PID 4140 wrote to memory of 804 4140 Document RFQ#8086A_461A_0000086_300_3550_2021.exe schtasks.exe PID 4140 wrote to memory of 804 4140 Document RFQ#8086A_461A_0000086_300_3550_2021.exe schtasks.exe PID 4140 wrote to memory of 852 4140 Document RFQ#8086A_461A_0000086_300_3550_2021.exe Document RFQ#8086A_461A_0000086_300_3550_2021.exe PID 4140 wrote to memory of 852 4140 Document RFQ#8086A_461A_0000086_300_3550_2021.exe Document RFQ#8086A_461A_0000086_300_3550_2021.exe PID 4140 wrote to memory of 852 4140 Document RFQ#8086A_461A_0000086_300_3550_2021.exe Document RFQ#8086A_461A_0000086_300_3550_2021.exe PID 4140 wrote to memory of 368 4140 Document RFQ#8086A_461A_0000086_300_3550_2021.exe Document RFQ#8086A_461A_0000086_300_3550_2021.exe PID 4140 wrote to memory of 368 4140 Document RFQ#8086A_461A_0000086_300_3550_2021.exe Document RFQ#8086A_461A_0000086_300_3550_2021.exe PID 4140 wrote to memory of 368 4140 Document RFQ#8086A_461A_0000086_300_3550_2021.exe Document RFQ#8086A_461A_0000086_300_3550_2021.exe PID 4140 wrote to memory of 368 4140 Document RFQ#8086A_461A_0000086_300_3550_2021.exe Document RFQ#8086A_461A_0000086_300_3550_2021.exe PID 4140 wrote to memory of 368 4140 Document RFQ#8086A_461A_0000086_300_3550_2021.exe Document RFQ#8086A_461A_0000086_300_3550_2021.exe PID 4140 wrote to memory of 368 4140 Document RFQ#8086A_461A_0000086_300_3550_2021.exe Document RFQ#8086A_461A_0000086_300_3550_2021.exe PID 2672 wrote to memory of 1216 2672 Explorer.EXE help.exe PID 2672 wrote to memory of 1216 2672 Explorer.EXE help.exe PID 2672 wrote to memory of 1216 2672 Explorer.EXE help.exe PID 1216 wrote to memory of 1452 1216 help.exe cmd.exe PID 1216 wrote to memory of 1452 1216 help.exe cmd.exe PID 1216 wrote to memory of 1452 1216 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Document RFQ#8086A_461A_0000086_300_3550_2021.exe"C:\Users\Admin\AppData\Local\Temp\Document RFQ#8086A_461A_0000086_300_3550_2021.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLhDhkGdnNl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBAA1.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Document RFQ#8086A_461A_0000086_300_3550_2021.exe"C:\Users\Admin\AppData\Local\Temp\Document RFQ#8086A_461A_0000086_300_3550_2021.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Document RFQ#8086A_461A_0000086_300_3550_2021.exe"C:\Users\Admin\AppData\Local\Temp\Document RFQ#8086A_461A_0000086_300_3550_2021.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Document RFQ#8086A_461A_0000086_300_3550_2021.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/368-128-0x00000000018E0000-0x0000000001C00000-memory.dmpFilesize
3.1MB
-
memory/368-129-0x0000000001300000-0x000000000144A000-memory.dmpFilesize
1.3MB
-
memory/368-126-0x000000000041F0C0-mapping.dmp
-
memory/368-125-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/804-124-0x0000000000000000-mapping.dmp
-
memory/1216-133-0x0000000001080000-0x00000000010AF000-memory.dmpFilesize
188KB
-
memory/1216-136-0x0000000003650000-0x00000000036E3000-memory.dmpFilesize
588KB
-
memory/1216-135-0x0000000003850000-0x0000000003B70000-memory.dmpFilesize
3.1MB
-
memory/1216-132-0x00000000011C0000-0x00000000011C7000-memory.dmpFilesize
28KB
-
memory/1216-131-0x0000000000000000-mapping.dmp
-
memory/1452-134-0x0000000000000000-mapping.dmp
-
memory/2672-130-0x00000000032C0000-0x00000000033B2000-memory.dmpFilesize
968KB
-
memory/2672-137-0x00000000058D0000-0x0000000005A18000-memory.dmpFilesize
1.3MB
-
memory/4140-117-0x0000000007F00000-0x0000000007F01000-memory.dmpFilesize
4KB
-
memory/4140-122-0x000000000DA10000-0x000000000DA11000-memory.dmpFilesize
4KB
-
memory/4140-115-0x0000000000D20000-0x0000000000D21000-memory.dmpFilesize
4KB
-
memory/4140-118-0x0000000007AB0000-0x0000000007AB1000-memory.dmpFilesize
4KB
-
memory/4140-119-0x0000000007B50000-0x0000000007B51000-memory.dmpFilesize
4KB
-
memory/4140-120-0x0000000007A00000-0x0000000007EFE000-memory.dmpFilesize
5.0MB
-
memory/4140-121-0x0000000007DF0000-0x0000000007DF8000-memory.dmpFilesize
32KB
-
memory/4140-123-0x000000000D9C0000-0x000000000DA10000-memory.dmpFilesize
320KB