Analysis
-
max time kernel
149s -
max time network
134s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
21-10-2021 13:54
Static task
static1
Behavioral task
behavioral1
Sample
pos.exe
Resource
win7-en-20210920
General
-
Target
pos.exe
-
Size
454KB
-
MD5
0082bb1c3ac5dc499f6db3d45de0ab3e
-
SHA1
90eb55324f4068a4fde1da25ca7a3eff65d17e1e
-
SHA256
1bb913d6f594107a8c8d4d64f9a3de85c602813d9ad93189b9949fbc8a93aa32
-
SHA512
e42c5af62527c2193d3f49f93918535b656f9d0a34065657df8273e606405b551e9f939450a134c20c58429951fbe7a27c14e19e66eeee57446349eaf7e30384
Malware Config
Extracted
formbook
4.1
u1bs
http://www.vgmpradio.com/u1bs/
ln-safe-keepingmisva4.xyz
rtfh.xyz
awolin.link
metadlf.com
cardboardcasual.com
psicoterapiahablada.com
spaminator.xyz
hnjqzl.top
dentalyinovasi.site
biosynblas.com
zvyk.store
shreevishwakarmaservices.com
showersplash.com
norbert-roth.com
londoncapitaltraders.com
istanbuldonerkebabheroncity.com
realdiscountsnow.com
marlinplumbingwnc.com
magazinadziavane.com
qantv.com
redcardinaldaycare.com
fevxok.com
avp-travaux.com
spielload.com
countrymen.net
loverizzi.online
verbandverse.com
esssc.icu
thealphabrains.com
sleep-lab.pro
fancysquat.com
santasdasd.com
28ssc4.icu
gordonmicah.xyz
readyviewerone.com
242plaza.com
lc-kassel-kurhessen.com
guzram.com
classicitystudios.com
nextvoicetech.com
conectadoseventovirtual.com
chollz.xyz
sdxhbl.com
wilopumps.store
netshopsceilingfans.com
econiq.us
wisconsinfarmstay.com
pharmacie-plaideux.com
kppservices.com
cashprotectionservices.com
365bet356.com
davidandanabelsellshomes.com
bvfymca.net
kakvototakova.com
4bosses700mcc.com
topgamesimple.xyz
neistovo-veliko.online
vespafarmingdale.com
newmexicotitlesearches.com
dunnsdispatching.com
caldirectloans.com
taxitienthanh.com
marabout-serieux-rapide.com
oxygenglobal.net
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1608-125-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1608-126-0x000000000041F130-mapping.dmp formbook behavioral2/memory/2760-133-0x0000000002A00000-0x0000000002A2F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
pos.exepos.exerundll32.exedescription pid process target process PID 3444 set thread context of 1608 3444 pos.exe pos.exe PID 1608 set thread context of 2580 1608 pos.exe Explorer.EXE PID 2760 set thread context of 2580 2760 rundll32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
pos.exerundll32.exepid process 1608 pos.exe 1608 pos.exe 1608 pos.exe 1608 pos.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2580 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
pos.exerundll32.exepid process 1608 pos.exe 1608 pos.exe 1608 pos.exe 2760 rundll32.exe 2760 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
pos.exerundll32.exedescription pid process Token: SeDebugPrivilege 1608 pos.exe Token: SeDebugPrivilege 2760 rundll32.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
pos.exeExplorer.EXErundll32.exedescription pid process target process PID 3444 wrote to memory of 3420 3444 pos.exe schtasks.exe PID 3444 wrote to memory of 3420 3444 pos.exe schtasks.exe PID 3444 wrote to memory of 3420 3444 pos.exe schtasks.exe PID 3444 wrote to memory of 1608 3444 pos.exe pos.exe PID 3444 wrote to memory of 1608 3444 pos.exe pos.exe PID 3444 wrote to memory of 1608 3444 pos.exe pos.exe PID 3444 wrote to memory of 1608 3444 pos.exe pos.exe PID 3444 wrote to memory of 1608 3444 pos.exe pos.exe PID 3444 wrote to memory of 1608 3444 pos.exe pos.exe PID 2580 wrote to memory of 2760 2580 Explorer.EXE rundll32.exe PID 2580 wrote to memory of 2760 2580 Explorer.EXE rundll32.exe PID 2580 wrote to memory of 2760 2580 Explorer.EXE rundll32.exe PID 2760 wrote to memory of 1056 2760 rundll32.exe cmd.exe PID 2760 wrote to memory of 1056 2760 rundll32.exe cmd.exe PID 2760 wrote to memory of 1056 2760 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pos.exe"C:\Users\Admin\AppData\Local\Temp\pos.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YAeSiES" /XML "C:\Users\Admin\AppData\Local\Temp\tmp607B.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\pos.exe"C:\Users\Admin\AppData\Local\Temp\pos.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\pos.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1056-135-0x0000000000000000-mapping.dmp
-
memory/1608-125-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1608-128-0x0000000001170000-0x0000000001490000-memory.dmpFilesize
3.1MB
-
memory/1608-129-0x0000000000EA0000-0x0000000000EB4000-memory.dmpFilesize
80KB
-
memory/1608-126-0x000000000041F130-mapping.dmp
-
memory/2580-137-0x0000000005C30000-0x0000000005DBA000-memory.dmpFilesize
1.5MB
-
memory/2580-130-0x0000000005AD0000-0x0000000005C27000-memory.dmpFilesize
1.3MB
-
memory/2760-133-0x0000000002A00000-0x0000000002A2F000-memory.dmpFilesize
188KB
-
memory/2760-134-0x0000000004380000-0x00000000046A0000-memory.dmpFilesize
3.1MB
-
memory/2760-136-0x0000000004110000-0x00000000041A3000-memory.dmpFilesize
588KB
-
memory/2760-132-0x00000000001A0000-0x00000000001B3000-memory.dmpFilesize
76KB
-
memory/2760-131-0x0000000000000000-mapping.dmp
-
memory/3420-124-0x0000000000000000-mapping.dmp
-
memory/3444-120-0x00000000052E0000-0x00000000057DE000-memory.dmpFilesize
5.0MB
-
memory/3444-119-0x00000000052C0000-0x00000000052C1000-memory.dmpFilesize
4KB
-
memory/3444-121-0x00000000054A0000-0x00000000054A7000-memory.dmpFilesize
28KB
-
memory/3444-115-0x0000000000820000-0x0000000000821000-memory.dmpFilesize
4KB
-
memory/3444-122-0x0000000005FE0000-0x0000000005FE1000-memory.dmpFilesize
4KB
-
memory/3444-118-0x00000000052E0000-0x00000000052E1000-memory.dmpFilesize
4KB
-
memory/3444-123-0x0000000005770000-0x00000000057C0000-memory.dmpFilesize
320KB
-
memory/3444-117-0x00000000057E0000-0x00000000057E1000-memory.dmpFilesize
4KB