Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
21-10-2021 13:54
Static task
static1
Behavioral task
behavioral1
Sample
pos.exe
Resource
win7-en-20211014
General
-
Target
pos.exe
-
Size
454KB
-
MD5
0082bb1c3ac5dc499f6db3d45de0ab3e
-
SHA1
90eb55324f4068a4fde1da25ca7a3eff65d17e1e
-
SHA256
1bb913d6f594107a8c8d4d64f9a3de85c602813d9ad93189b9949fbc8a93aa32
-
SHA512
e42c5af62527c2193d3f49f93918535b656f9d0a34065657df8273e606405b551e9f939450a134c20c58429951fbe7a27c14e19e66eeee57446349eaf7e30384
Malware Config
Extracted
formbook
4.1
u1bs
http://www.vgmpradio.com/u1bs/
ln-safe-keepingmisva4.xyz
rtfh.xyz
awolin.link
metadlf.com
cardboardcasual.com
psicoterapiahablada.com
spaminator.xyz
hnjqzl.top
dentalyinovasi.site
biosynblas.com
zvyk.store
shreevishwakarmaservices.com
showersplash.com
norbert-roth.com
londoncapitaltraders.com
istanbuldonerkebabheroncity.com
realdiscountsnow.com
marlinplumbingwnc.com
magazinadziavane.com
qantv.com
redcardinaldaycare.com
fevxok.com
avp-travaux.com
spielload.com
countrymen.net
loverizzi.online
verbandverse.com
esssc.icu
thealphabrains.com
sleep-lab.pro
fancysquat.com
santasdasd.com
28ssc4.icu
gordonmicah.xyz
readyviewerone.com
242plaza.com
lc-kassel-kurhessen.com
guzram.com
classicitystudios.com
nextvoicetech.com
conectadoseventovirtual.com
chollz.xyz
sdxhbl.com
wilopumps.store
netshopsceilingfans.com
econiq.us
wisconsinfarmstay.com
pharmacie-plaideux.com
kppservices.com
cashprotectionservices.com
365bet356.com
davidandanabelsellshomes.com
bvfymca.net
kakvototakova.com
4bosses700mcc.com
topgamesimple.xyz
neistovo-veliko.online
vespafarmingdale.com
newmexicotitlesearches.com
dunnsdispatching.com
caldirectloans.com
taxitienthanh.com
marabout-serieux-rapide.com
oxygenglobal.net
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1820-64-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1820-65-0x000000000041F130-mapping.dmp formbook behavioral1/memory/960-73-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1060 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
pos.exepos.exehelp.exedescription pid process target process PID 1240 set thread context of 1820 1240 pos.exe pos.exe PID 1820 set thread context of 1268 1820 pos.exe Explorer.EXE PID 960 set thread context of 1268 960 help.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
pos.exepos.exehelp.exepid process 1240 pos.exe 1820 pos.exe 1820 pos.exe 960 help.exe 960 help.exe 960 help.exe 960 help.exe 960 help.exe 960 help.exe 960 help.exe 960 help.exe 960 help.exe 960 help.exe 960 help.exe 960 help.exe 960 help.exe 960 help.exe 960 help.exe 960 help.exe 960 help.exe 960 help.exe 960 help.exe 960 help.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
pos.exehelp.exepid process 1820 pos.exe 1820 pos.exe 1820 pos.exe 960 help.exe 960 help.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pos.exepos.exehelp.exedescription pid process Token: SeDebugPrivilege 1240 pos.exe Token: SeDebugPrivilege 1820 pos.exe Token: SeDebugPrivilege 960 help.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
pos.exeExplorer.EXEhelp.exedescription pid process target process PID 1240 wrote to memory of 900 1240 pos.exe schtasks.exe PID 1240 wrote to memory of 900 1240 pos.exe schtasks.exe PID 1240 wrote to memory of 900 1240 pos.exe schtasks.exe PID 1240 wrote to memory of 900 1240 pos.exe schtasks.exe PID 1240 wrote to memory of 340 1240 pos.exe pos.exe PID 1240 wrote to memory of 340 1240 pos.exe pos.exe PID 1240 wrote to memory of 340 1240 pos.exe pos.exe PID 1240 wrote to memory of 340 1240 pos.exe pos.exe PID 1240 wrote to memory of 1820 1240 pos.exe pos.exe PID 1240 wrote to memory of 1820 1240 pos.exe pos.exe PID 1240 wrote to memory of 1820 1240 pos.exe pos.exe PID 1240 wrote to memory of 1820 1240 pos.exe pos.exe PID 1240 wrote to memory of 1820 1240 pos.exe pos.exe PID 1240 wrote to memory of 1820 1240 pos.exe pos.exe PID 1240 wrote to memory of 1820 1240 pos.exe pos.exe PID 1268 wrote to memory of 960 1268 Explorer.EXE help.exe PID 1268 wrote to memory of 960 1268 Explorer.EXE help.exe PID 1268 wrote to memory of 960 1268 Explorer.EXE help.exe PID 1268 wrote to memory of 960 1268 Explorer.EXE help.exe PID 960 wrote to memory of 1060 960 help.exe cmd.exe PID 960 wrote to memory of 1060 960 help.exe cmd.exe PID 960 wrote to memory of 1060 960 help.exe cmd.exe PID 960 wrote to memory of 1060 960 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pos.exe"C:\Users\Admin\AppData\Local\Temp\pos.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YAeSiES" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9702.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\pos.exe"C:\Users\Admin\AppData\Local\Temp\pos.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\pos.exe"C:\Users\Admin\AppData\Local\Temp\pos.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\pos.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/900-61-0x0000000000000000-mapping.dmp
-
memory/960-73-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/960-75-0x0000000000480000-0x0000000000513000-memory.dmpFilesize
588KB
-
memory/960-72-0x0000000000190000-0x0000000000196000-memory.dmpFilesize
24KB
-
memory/960-74-0x00000000007C0000-0x0000000000AC3000-memory.dmpFilesize
3.0MB
-
memory/960-70-0x0000000000000000-mapping.dmp
-
memory/1060-71-0x0000000000000000-mapping.dmp
-
memory/1240-60-0x0000000004EA0000-0x0000000004EF0000-memory.dmpFilesize
320KB
-
memory/1240-59-0x00000000003B0000-0x00000000003B7000-memory.dmpFilesize
28KB
-
memory/1240-57-0x0000000076531000-0x0000000076533000-memory.dmpFilesize
8KB
-
memory/1240-58-0x0000000000D20000-0x0000000000D21000-memory.dmpFilesize
4KB
-
memory/1240-55-0x0000000001080000-0x0000000001081000-memory.dmpFilesize
4KB
-
memory/1268-69-0x0000000005ED0000-0x0000000005FED000-memory.dmpFilesize
1.1MB
-
memory/1268-76-0x00000000067F0000-0x000000000693A000-memory.dmpFilesize
1.3MB
-
memory/1820-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1820-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1820-68-0x0000000000140000-0x0000000000154000-memory.dmpFilesize
80KB
-
memory/1820-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1820-65-0x000000000041F130-mapping.dmp
-
memory/1820-67-0x0000000000AE0000-0x0000000000DE3000-memory.dmpFilesize
3.0MB