Analysis
-
max time kernel
122s -
max time network
122s -
submitted
01-01-1970 00:00
Static task
static1
Behavioral task
behavioral1
Sample
e87b10b098df8ff5906cb1154c78e83d.exe
Resource
win7-en-20211014
General
-
Target
e87b10b098df8ff5906cb1154c78e83d.exe
-
Size
596KB
-
MD5
e87b10b098df8ff5906cb1154c78e83d
-
SHA1
26417afefaabd707dae65d9fdd84178f4fb5e112
-
SHA256
4e25735dc713c78458f181caa0f09a6ea2ca79a708a3b22f52d1c936806de251
-
SHA512
87a959392f490e84346daffbbb3807a168b9c1ff4a4bdbf4b7e2e9db813377e1c9eb1a4be3b4cb7bd8eb011553d3367e818068d8af18c2e219543af7ca489e88
Malware Config
Extracted
formbook
4.1
hs3h
http://www.alefisrael.com/hs3h/
slairt.com
teresasellsflorida.com
resouthcarolina.com
npccfbf.com
hutshed.com
westatesmarking.com
rustmonkeys.com
kagawa-rentacar.com
easyvoip-system.com
admorinsulation.com
ericaleighjensen.com
zhonghaojiaju.net
apple-iphone.xyz
b0t.info
torgetmc.xyz
lawrencemargarse.com
6123655.com
macdonalds-delivery.com
cvpfl.com
ayudaparaturent.com
toptenanimals.com
zambiadawn.com
muzoe.com
xtrembabes.com
nomadicfoodpods.com
sibernewskaltara.com
thelyfetour.com
sailinn.xyz
cisiworld.com
right-effort.com
emmanuelleramaroson.com
aptgdaycare.com
yanceyhomes.com
minooshargh.com
littlemontars.com
liuhemustam.com
tajaraenterprises.com
myteepathfinder.com
nectarselector.com
digitalbusinesscard.website
kirakira-woman.xyz
tntexpressdelivery.com
collectcuriously.com
marielagarciarealty.com
javierramonmartinezalarcon.com
eis-investment.com
bookanyclick.com
primespotshop.com
heatdistrict.xyz
beadedjoy.com
oyster-gal.com
umateam.com
reservadaspalmeiras-mg.com
thiramirez.info
stanfec.xyz
cowcoupon.com
humaneeventmedia.com
exquisitepdc.com
silverartandcraft.com
plomeroelectricistaquintana.com
encounterniagara.com
ram-nilu.com
standwithcode.com
sphereexit.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1948-67-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1948-68-0x000000000041F1A0-mapping.dmp formbook -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
e87b10b098df8ff5906cb1154c78e83d.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion e87b10b098df8ff5906cb1154c78e83d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion e87b10b098df8ff5906cb1154c78e83d.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
e87b10b098df8ff5906cb1154c78e83d.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum e87b10b098df8ff5906cb1154c78e83d.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 e87b10b098df8ff5906cb1154c78e83d.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e87b10b098df8ff5906cb1154c78e83d.exedescription pid process target process PID 1932 set thread context of 1948 1932 e87b10b098df8ff5906cb1154c78e83d.exe e87b10b098df8ff5906cb1154c78e83d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
e87b10b098df8ff5906cb1154c78e83d.exee87b10b098df8ff5906cb1154c78e83d.exepid process 1932 e87b10b098df8ff5906cb1154c78e83d.exe 1948 e87b10b098df8ff5906cb1154c78e83d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e87b10b098df8ff5906cb1154c78e83d.exedescription pid process Token: SeDebugPrivilege 1932 e87b10b098df8ff5906cb1154c78e83d.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
e87b10b098df8ff5906cb1154c78e83d.exedescription pid process target process PID 1932 wrote to memory of 432 1932 e87b10b098df8ff5906cb1154c78e83d.exe schtasks.exe PID 1932 wrote to memory of 432 1932 e87b10b098df8ff5906cb1154c78e83d.exe schtasks.exe PID 1932 wrote to memory of 432 1932 e87b10b098df8ff5906cb1154c78e83d.exe schtasks.exe PID 1932 wrote to memory of 432 1932 e87b10b098df8ff5906cb1154c78e83d.exe schtasks.exe PID 1932 wrote to memory of 1948 1932 e87b10b098df8ff5906cb1154c78e83d.exe e87b10b098df8ff5906cb1154c78e83d.exe PID 1932 wrote to memory of 1948 1932 e87b10b098df8ff5906cb1154c78e83d.exe e87b10b098df8ff5906cb1154c78e83d.exe PID 1932 wrote to memory of 1948 1932 e87b10b098df8ff5906cb1154c78e83d.exe e87b10b098df8ff5906cb1154c78e83d.exe PID 1932 wrote to memory of 1948 1932 e87b10b098df8ff5906cb1154c78e83d.exe e87b10b098df8ff5906cb1154c78e83d.exe PID 1932 wrote to memory of 1948 1932 e87b10b098df8ff5906cb1154c78e83d.exe e87b10b098df8ff5906cb1154c78e83d.exe PID 1932 wrote to memory of 1948 1932 e87b10b098df8ff5906cb1154c78e83d.exe e87b10b098df8ff5906cb1154c78e83d.exe PID 1932 wrote to memory of 1948 1932 e87b10b098df8ff5906cb1154c78e83d.exe e87b10b098df8ff5906cb1154c78e83d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e87b10b098df8ff5906cb1154c78e83d.exe"C:\Users\Admin\AppData\Local\Temp\e87b10b098df8ff5906cb1154c78e83d.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DDGuFdDkUBuPOY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8AF1.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\e87b10b098df8ff5906cb1154c78e83d.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp8AF1.tmpMD5
ddba4099615a9c94e52e103543866eca
SHA186e030d23417380ef4dc5b089b3edfd8b80b3bf6
SHA256fe5e7e85b8f3f417f29b699acdacb898dbbf6d36044085e889be68a5f86233a5
SHA5125874eb99d1de2896ee87517a3ef139f8ebb8dd617b6646cf14a36bf79713328c5914e09b814eca069d86efb0071d7709d0e524bb71074b0312df8c69fcc98b46
-
memory/432-63-0x0000000000000000-mapping.dmp
-
memory/1932-62-0x0000000005E00000-0x0000000005E31000-memory.dmpFilesize
196KB
-
memory/1932-59-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/1932-60-0x0000000001F40000-0x0000000001F4E000-memory.dmpFilesize
56KB
-
memory/1932-61-0x0000000007D20000-0x0000000007DA2000-memory.dmpFilesize
520KB
-
memory/1932-55-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/1932-58-0x0000000004E70000-0x0000000004E71000-memory.dmpFilesize
4KB
-
memory/1932-57-0x0000000075901000-0x0000000075903000-memory.dmpFilesize
8KB
-
memory/1948-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1948-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1948-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1948-68-0x000000000041F1A0-mapping.dmp
-
memory/1948-69-0x0000000000A00000-0x0000000000D03000-memory.dmpFilesize
3.0MB