Analysis
-
max time kernel
148s -
max time network
138s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
21-10-2021 13:54
Static task
static1
Behavioral task
behavioral1
Sample
pos.exe
Resource
win7-en-20211014
General
-
Target
pos.exe
-
Size
454KB
-
MD5
0082bb1c3ac5dc499f6db3d45de0ab3e
-
SHA1
90eb55324f4068a4fde1da25ca7a3eff65d17e1e
-
SHA256
1bb913d6f594107a8c8d4d64f9a3de85c602813d9ad93189b9949fbc8a93aa32
-
SHA512
e42c5af62527c2193d3f49f93918535b656f9d0a34065657df8273e606405b551e9f939450a134c20c58429951fbe7a27c14e19e66eeee57446349eaf7e30384
Malware Config
Extracted
formbook
4.1
u1bs
http://www.vgmpradio.com/u1bs/
ln-safe-keepingmisva4.xyz
rtfh.xyz
awolin.link
metadlf.com
cardboardcasual.com
psicoterapiahablada.com
spaminator.xyz
hnjqzl.top
dentalyinovasi.site
biosynblas.com
zvyk.store
shreevishwakarmaservices.com
showersplash.com
norbert-roth.com
londoncapitaltraders.com
istanbuldonerkebabheroncity.com
realdiscountsnow.com
marlinplumbingwnc.com
magazinadziavane.com
qantv.com
redcardinaldaycare.com
fevxok.com
avp-travaux.com
spielload.com
countrymen.net
loverizzi.online
verbandverse.com
esssc.icu
thealphabrains.com
sleep-lab.pro
fancysquat.com
santasdasd.com
28ssc4.icu
gordonmicah.xyz
readyviewerone.com
242plaza.com
lc-kassel-kurhessen.com
guzram.com
classicitystudios.com
nextvoicetech.com
conectadoseventovirtual.com
chollz.xyz
sdxhbl.com
wilopumps.store
netshopsceilingfans.com
econiq.us
wisconsinfarmstay.com
pharmacie-plaideux.com
kppservices.com
cashprotectionservices.com
365bet356.com
davidandanabelsellshomes.com
bvfymca.net
kakvototakova.com
4bosses700mcc.com
topgamesimple.xyz
neistovo-veliko.online
vespafarmingdale.com
newmexicotitlesearches.com
dunnsdispatching.com
caldirectloans.com
taxitienthanh.com
marabout-serieux-rapide.com
oxygenglobal.net
Signatures
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4496-125-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4496-126-0x000000000041F130-mapping.dmp formbook behavioral2/memory/4496-129-0x0000000001100000-0x000000000124A000-memory.dmp formbook behavioral2/memory/4644-134-0x0000000003210000-0x000000000323F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
pos.exepos.exeraserver.exedescription pid process target process PID 4248 set thread context of 4496 4248 pos.exe pos.exe PID 4496 set thread context of 2712 4496 pos.exe Explorer.EXE PID 4644 set thread context of 2712 4644 raserver.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
pos.exeraserver.exepid process 4496 pos.exe 4496 pos.exe 4496 pos.exe 4496 pos.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe 4644 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2712 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
pos.exeraserver.exepid process 4496 pos.exe 4496 pos.exe 4496 pos.exe 4644 raserver.exe 4644 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
pos.exeraserver.exedescription pid process Token: SeDebugPrivilege 4496 pos.exe Token: SeDebugPrivilege 4644 raserver.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
pos.exeExplorer.EXEraserver.exedescription pid process target process PID 4248 wrote to memory of 4512 4248 pos.exe schtasks.exe PID 4248 wrote to memory of 4512 4248 pos.exe schtasks.exe PID 4248 wrote to memory of 4512 4248 pos.exe schtasks.exe PID 4248 wrote to memory of 4496 4248 pos.exe pos.exe PID 4248 wrote to memory of 4496 4248 pos.exe pos.exe PID 4248 wrote to memory of 4496 4248 pos.exe pos.exe PID 4248 wrote to memory of 4496 4248 pos.exe pos.exe PID 4248 wrote to memory of 4496 4248 pos.exe pos.exe PID 4248 wrote to memory of 4496 4248 pos.exe pos.exe PID 2712 wrote to memory of 4644 2712 Explorer.EXE raserver.exe PID 2712 wrote to memory of 4644 2712 Explorer.EXE raserver.exe PID 2712 wrote to memory of 4644 2712 Explorer.EXE raserver.exe PID 4644 wrote to memory of 4548 4644 raserver.exe cmd.exe PID 4644 wrote to memory of 4548 4644 raserver.exe cmd.exe PID 4644 wrote to memory of 4548 4644 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pos.exe"C:\Users\Admin\AppData\Local\Temp\pos.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YAeSiES" /XML "C:\Users\Admin\AppData\Local\Temp\tmp36BC.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\pos.exe"C:\Users\Admin\AppData\Local\Temp\pos.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\pos.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2712-137-0x0000000005500000-0x0000000005619000-memory.dmpFilesize
1.1MB
-
memory/2712-130-0x00000000068D0000-0x00000000069FD000-memory.dmpFilesize
1.2MB
-
memory/4248-115-0x00000000006F0000-0x00000000006F1000-memory.dmpFilesize
4KB
-
memory/4248-117-0x00000000053A0000-0x00000000053A1000-memory.dmpFilesize
4KB
-
memory/4248-118-0x0000000004FA0000-0x0000000004FA1000-memory.dmpFilesize
4KB
-
memory/4248-119-0x0000000005110000-0x0000000005111000-memory.dmpFilesize
4KB
-
memory/4248-120-0x0000000004EA0000-0x000000000539E000-memory.dmpFilesize
5.0MB
-
memory/4248-121-0x0000000005360000-0x0000000005367000-memory.dmpFilesize
28KB
-
memory/4248-122-0x0000000005D40000-0x0000000005D41000-memory.dmpFilesize
4KB
-
memory/4248-123-0x0000000005CF0000-0x0000000005D40000-memory.dmpFilesize
320KB
-
memory/4496-126-0x000000000041F130-mapping.dmp
-
memory/4496-127-0x0000000001820000-0x0000000001B40000-memory.dmpFilesize
3.1MB
-
memory/4496-129-0x0000000001100000-0x000000000124A000-memory.dmpFilesize
1.3MB
-
memory/4496-125-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4512-124-0x0000000000000000-mapping.dmp
-
memory/4548-132-0x0000000000000000-mapping.dmp
-
memory/4644-131-0x0000000000000000-mapping.dmp
-
memory/4644-134-0x0000000003210000-0x000000000323F000-memory.dmpFilesize
188KB
-
memory/4644-135-0x0000000004E20000-0x0000000005140000-memory.dmpFilesize
3.1MB
-
memory/4644-133-0x0000000000B00000-0x0000000000B1F000-memory.dmpFilesize
124KB
-
memory/4644-136-0x0000000004C80000-0x0000000004D13000-memory.dmpFilesize
588KB