Analysis
-
max time kernel
148s -
max time network
144s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
22-10-2021 15:02
Static task
static1
Behavioral task
behavioral1
Sample
Muestras.exe
Resource
win7-en-20211014
General
-
Target
Muestras.exe
-
Size
513KB
-
MD5
2ea863b6b81bb910cacf7ad6562438d3
-
SHA1
13f5dbf1f7ba7191b41ca1aea3d18035709f6744
-
SHA256
371a7fde3d56ab06c051efdd78f55fa6a142360de778646d24f713b9097048e1
-
SHA512
8461ebefd23f850522cac453d33e533d1a208ca43e8a5fa328bc99a67c9726724aa7ff23232e14a77a52fe0dff25efd08338af6359b221cfc1eefdd89384e00d
Malware Config
Extracted
formbook
4.1
bs2l
http://www.amazonsfinds.com/bs2l/
file-anae.com
letsgosunderland.com
urgome.com
g5tet.xyz
myline2online.com
crafty-buck.com
uralpack.net
chinmeat.com
kursuskekipoh.com
justgantt.com
hqh.xyz
xiongege55.com
pokebrostogo.com
firststonemusic.com
bataviabento.com
comoditahandyshop.com
dayloniabeauty.com
ceeonec.com
scribblerhub.com
lindosueno.com
curatedelearning.net
seedparlour.com
veganleetruck.com
commscholar.com
syuto-ene.com
inspirainstitute.com
tmlsheltons.com
happinesssearch.com
finalstepcleaningservice.com
xcwwjzsb.com
linkmedgf.com
donnieandbrasco.com
greatestmeacademy.com
husainatalqara.com
222666dy.com
theproperconsultant.com
katherinexu.com
geredemiz.com
acres-of-loveshop.com
live-cam4sex.com
affineindia.com
oktirefwb.com
southernsoulcafe.com
wallylakesidecottages.com
zhenyanjx.com
phoebook.com
welovechurrosusa.com
sippingaggressively.com
verstechms.com
bulabluespropertiesllc.com
fallspill.com
factorycheckout.com
vanessarosejewellery.com
xn--fazlsay-tfb.com
microsoftinternational.com
xiaohe-yidian.com
favoriturizm.com
thisisdreamland.com
eatchar.com
8ky2.com
nexusurl.com
escapadogs.com
theofficialserenasolbrown.com
estambrilandia.com
Signatures
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1564-63-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1564-64-0x000000000041EB40-mapping.dmp formbook behavioral1/memory/1564-69-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1700-75-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Muestras.exeRegSvcs.exemsdt.exedescription pid process target process PID 964 set thread context of 1564 964 Muestras.exe RegSvcs.exe PID 1564 set thread context of 1360 1564 RegSvcs.exe Explorer.EXE PID 1564 set thread context of 1360 1564 RegSvcs.exe Explorer.EXE PID 1700 set thread context of 1360 1700 msdt.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
RegSvcs.exemsdt.exepid process 1564 RegSvcs.exe 1564 RegSvcs.exe 1564 RegSvcs.exe 1700 msdt.exe 1700 msdt.exe 1700 msdt.exe 1700 msdt.exe 1700 msdt.exe 1700 msdt.exe 1700 msdt.exe 1700 msdt.exe 1700 msdt.exe 1700 msdt.exe 1700 msdt.exe 1700 msdt.exe 1700 msdt.exe 1700 msdt.exe 1700 msdt.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RegSvcs.exemsdt.exepid process 1564 RegSvcs.exe 1564 RegSvcs.exe 1564 RegSvcs.exe 1564 RegSvcs.exe 1700 msdt.exe 1700 msdt.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.exemsdt.exedescription pid process Token: SeDebugPrivilege 1564 RegSvcs.exe Token: SeDebugPrivilege 1700 msdt.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
Muestras.exeExplorer.EXEmsdt.exedescription pid process target process PID 964 wrote to memory of 1404 964 Muestras.exe schtasks.exe PID 964 wrote to memory of 1404 964 Muestras.exe schtasks.exe PID 964 wrote to memory of 1404 964 Muestras.exe schtasks.exe PID 964 wrote to memory of 1404 964 Muestras.exe schtasks.exe PID 964 wrote to memory of 1564 964 Muestras.exe RegSvcs.exe PID 964 wrote to memory of 1564 964 Muestras.exe RegSvcs.exe PID 964 wrote to memory of 1564 964 Muestras.exe RegSvcs.exe PID 964 wrote to memory of 1564 964 Muestras.exe RegSvcs.exe PID 964 wrote to memory of 1564 964 Muestras.exe RegSvcs.exe PID 964 wrote to memory of 1564 964 Muestras.exe RegSvcs.exe PID 964 wrote to memory of 1564 964 Muestras.exe RegSvcs.exe PID 964 wrote to memory of 1564 964 Muestras.exe RegSvcs.exe PID 964 wrote to memory of 1564 964 Muestras.exe RegSvcs.exe PID 964 wrote to memory of 1564 964 Muestras.exe RegSvcs.exe PID 1360 wrote to memory of 1700 1360 Explorer.EXE msdt.exe PID 1360 wrote to memory of 1700 1360 Explorer.EXE msdt.exe PID 1360 wrote to memory of 1700 1360 Explorer.EXE msdt.exe PID 1360 wrote to memory of 1700 1360 Explorer.EXE msdt.exe PID 1700 wrote to memory of 1824 1700 msdt.exe cmd.exe PID 1700 wrote to memory of 1824 1700 msdt.exe cmd.exe PID 1700 wrote to memory of 1824 1700 msdt.exe cmd.exe PID 1700 wrote to memory of 1824 1700 msdt.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Muestras.exe"C:\Users\Admin\AppData\Local\Temp\Muestras.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eGWSVRxsBoYDt" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC1C9.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/964-57-0x0000000004BF0000-0x0000000004BF1000-memory.dmpFilesize
4KB
-
memory/964-58-0x0000000000540000-0x0000000000547000-memory.dmpFilesize
28KB
-
memory/964-59-0x0000000004D10000-0x0000000004D5F000-memory.dmpFilesize
316KB
-
memory/964-55-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/1360-68-0x0000000006A40000-0x0000000006B61000-memory.dmpFilesize
1.1MB
-
memory/1360-79-0x00000000040E0000-0x00000000041A1000-memory.dmpFilesize
772KB
-
memory/1360-71-0x0000000007000000-0x000000000714A000-memory.dmpFilesize
1.3MB
-
memory/1404-60-0x0000000000000000-mapping.dmp
-
memory/1564-61-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1564-63-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1564-64-0x000000000041EB40-mapping.dmp
-
memory/1564-66-0x0000000000AE0000-0x0000000000DE3000-memory.dmpFilesize
3.0MB
-
memory/1564-69-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1564-70-0x00000000002F0000-0x0000000000304000-memory.dmpFilesize
80KB
-
memory/1564-62-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1564-67-0x00000000001A0000-0x00000000001B4000-memory.dmpFilesize
80KB
-
memory/1700-72-0x0000000000000000-mapping.dmp
-
memory/1700-74-0x00000000003C0000-0x00000000004B4000-memory.dmpFilesize
976KB
-
memory/1700-75-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/1700-77-0x0000000002310000-0x0000000002613000-memory.dmpFilesize
3.0MB
-
memory/1700-73-0x0000000075F41000-0x0000000075F43000-memory.dmpFilesize
8KB
-
memory/1700-78-0x0000000002040000-0x00000000020D3000-memory.dmpFilesize
588KB
-
memory/1824-76-0x0000000000000000-mapping.dmp