Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
21-10-2021 13:54
Static task
static1
Behavioral task
behavioral1
Sample
pos.exe
Resource
win7-en-20210920
General
-
Target
pos.exe
-
Size
454KB
-
MD5
0082bb1c3ac5dc499f6db3d45de0ab3e
-
SHA1
90eb55324f4068a4fde1da25ca7a3eff65d17e1e
-
SHA256
1bb913d6f594107a8c8d4d64f9a3de85c602813d9ad93189b9949fbc8a93aa32
-
SHA512
e42c5af62527c2193d3f49f93918535b656f9d0a34065657df8273e606405b551e9f939450a134c20c58429951fbe7a27c14e19e66eeee57446349eaf7e30384
Malware Config
Extracted
formbook
4.1
u1bs
http://www.vgmpradio.com/u1bs/
ln-safe-keepingmisva4.xyz
rtfh.xyz
awolin.link
metadlf.com
cardboardcasual.com
psicoterapiahablada.com
spaminator.xyz
hnjqzl.top
dentalyinovasi.site
biosynblas.com
zvyk.store
shreevishwakarmaservices.com
showersplash.com
norbert-roth.com
londoncapitaltraders.com
istanbuldonerkebabheroncity.com
realdiscountsnow.com
marlinplumbingwnc.com
magazinadziavane.com
qantv.com
redcardinaldaycare.com
fevxok.com
avp-travaux.com
spielload.com
countrymen.net
loverizzi.online
verbandverse.com
esssc.icu
thealphabrains.com
sleep-lab.pro
fancysquat.com
santasdasd.com
28ssc4.icu
gordonmicah.xyz
readyviewerone.com
242plaza.com
lc-kassel-kurhessen.com
guzram.com
classicitystudios.com
nextvoicetech.com
conectadoseventovirtual.com
chollz.xyz
sdxhbl.com
wilopumps.store
netshopsceilingfans.com
econiq.us
wisconsinfarmstay.com
pharmacie-plaideux.com
kppservices.com
cashprotectionservices.com
365bet356.com
davidandanabelsellshomes.com
bvfymca.net
kakvototakova.com
4bosses700mcc.com
topgamesimple.xyz
neistovo-veliko.online
vespafarmingdale.com
newmexicotitlesearches.com
dunnsdispatching.com
caldirectloans.com
taxitienthanh.com
marabout-serieux-rapide.com
oxygenglobal.net
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1352-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1352-64-0x000000000041F130-mapping.dmp formbook behavioral1/memory/1108-72-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 800 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
pos.exepos.exemsiexec.exedescription pid process target process PID 1756 set thread context of 1352 1756 pos.exe pos.exe PID 1352 set thread context of 1272 1352 pos.exe Explorer.EXE PID 1108 set thread context of 1272 1108 msiexec.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
pos.exepos.exemsiexec.exepid process 1756 pos.exe 1756 pos.exe 1352 pos.exe 1352 pos.exe 1108 msiexec.exe 1108 msiexec.exe 1108 msiexec.exe 1108 msiexec.exe 1108 msiexec.exe 1108 msiexec.exe 1108 msiexec.exe 1108 msiexec.exe 1108 msiexec.exe 1108 msiexec.exe 1108 msiexec.exe 1108 msiexec.exe 1108 msiexec.exe 1108 msiexec.exe 1108 msiexec.exe 1108 msiexec.exe 1108 msiexec.exe 1108 msiexec.exe 1108 msiexec.exe 1108 msiexec.exe 1108 msiexec.exe 1108 msiexec.exe 1108 msiexec.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
pos.exemsiexec.exepid process 1352 pos.exe 1352 pos.exe 1352 pos.exe 1108 msiexec.exe 1108 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pos.exepos.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1756 pos.exe Token: SeDebugPrivilege 1352 pos.exe Token: SeDebugPrivilege 1108 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
pos.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1756 wrote to memory of 1668 1756 pos.exe schtasks.exe PID 1756 wrote to memory of 1668 1756 pos.exe schtasks.exe PID 1756 wrote to memory of 1668 1756 pos.exe schtasks.exe PID 1756 wrote to memory of 1668 1756 pos.exe schtasks.exe PID 1756 wrote to memory of 1940 1756 pos.exe pos.exe PID 1756 wrote to memory of 1940 1756 pos.exe pos.exe PID 1756 wrote to memory of 1940 1756 pos.exe pos.exe PID 1756 wrote to memory of 1940 1756 pos.exe pos.exe PID 1756 wrote to memory of 1352 1756 pos.exe pos.exe PID 1756 wrote to memory of 1352 1756 pos.exe pos.exe PID 1756 wrote to memory of 1352 1756 pos.exe pos.exe PID 1756 wrote to memory of 1352 1756 pos.exe pos.exe PID 1756 wrote to memory of 1352 1756 pos.exe pos.exe PID 1756 wrote to memory of 1352 1756 pos.exe pos.exe PID 1756 wrote to memory of 1352 1756 pos.exe pos.exe PID 1272 wrote to memory of 1108 1272 Explorer.EXE msiexec.exe PID 1272 wrote to memory of 1108 1272 Explorer.EXE msiexec.exe PID 1272 wrote to memory of 1108 1272 Explorer.EXE msiexec.exe PID 1272 wrote to memory of 1108 1272 Explorer.EXE msiexec.exe PID 1272 wrote to memory of 1108 1272 Explorer.EXE msiexec.exe PID 1272 wrote to memory of 1108 1272 Explorer.EXE msiexec.exe PID 1272 wrote to memory of 1108 1272 Explorer.EXE msiexec.exe PID 1108 wrote to memory of 800 1108 msiexec.exe cmd.exe PID 1108 wrote to memory of 800 1108 msiexec.exe cmd.exe PID 1108 wrote to memory of 800 1108 msiexec.exe cmd.exe PID 1108 wrote to memory of 800 1108 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pos.exe"C:\Users\Admin\AppData\Local\Temp\pos.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YAeSiES" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2E8F.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\pos.exe"C:\Users\Admin\AppData\Local\Temp\pos.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\pos.exe"C:\Users\Admin\AppData\Local\Temp\pos.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\pos.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/800-73-0x0000000000000000-mapping.dmp
-
memory/1108-75-0x0000000000450000-0x00000000004E3000-memory.dmpFilesize
588KB
-
memory/1108-74-0x00000000022E0000-0x00000000025E3000-memory.dmpFilesize
3.0MB
-
memory/1108-71-0x0000000000610000-0x0000000000624000-memory.dmpFilesize
80KB
-
memory/1108-72-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB
-
memory/1108-69-0x0000000000000000-mapping.dmp
-
memory/1272-67-0x0000000007340000-0x00000000074EA000-memory.dmpFilesize
1.7MB
-
memory/1272-76-0x00000000074F0000-0x000000000766A000-memory.dmpFilesize
1.5MB
-
memory/1352-66-0x0000000000AC0000-0x0000000000DC3000-memory.dmpFilesize
3.0MB
-
memory/1352-64-0x000000000041F130-mapping.dmp
-
memory/1352-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1352-68-0x0000000000180000-0x0000000000194000-memory.dmpFilesize
80KB
-
memory/1352-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1352-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1668-60-0x0000000000000000-mapping.dmp
-
memory/1756-54-0x0000000001200000-0x0000000001201000-memory.dmpFilesize
4KB
-
memory/1756-59-0x0000000001170000-0x00000000011C0000-memory.dmpFilesize
320KB
-
memory/1756-58-0x0000000000420000-0x0000000000427000-memory.dmpFilesize
28KB
-
memory/1756-57-0x0000000004C80000-0x0000000004C81000-memory.dmpFilesize
4KB
-
memory/1756-56-0x0000000074F81000-0x0000000074F83000-memory.dmpFilesize
8KB