Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
24-11-2021 08:28
Static task
static1
Behavioral task
behavioral1
Sample
ORDER K0-9110.exe
Resource
win7-en-20211014
General
-
Target
ORDER K0-9110.exe
-
Size
308KB
-
MD5
0ef87099ea49164fc1dd5999763c6b19
-
SHA1
1d7e88dd09c5406c52fbf1e55eaade3c89b300f4
-
SHA256
96a065bd6726b198e2cb2723f6eacee3f16ec1b7925c97547db30aa2eec00c1c
-
SHA512
05253f5f8bbb0e7b875f0703145b4bcf1ea54fe3a7396f3024213f7953ceebf6ea16064e1fd0c9887a6784942078065272fa67c03beed60c4608f600c8083f1a
Malware Config
Extracted
formbook
4.1
dn7r
http://www.yourherogarden.net/dn7r/
eventphotographerdfw.com
thehalalcoinstaking.com
philipfaziofineart.com
intercoh.com
gaiaseyephotography.com
chatbotforrealestate.com
lovelancemg.com
marlieskasberger.com
elcongoenespanol.info
lepirecredit.com
distribution-concept.com
e99game.com
exit11festival.com
twodollartoothbrushclub.com
cocktailsandlawn.com
performimprove.network
24horas-telefono-11840.com
cosmossify.com
kellenleote.com
perovskite.energy
crosschain.services
xiwanghe.com
mollycayton.com
bonipay.com
uuwyxc.com
viberiokno-online.com
mobceo.com
menzelna.com
tiffaniefoster.com
premiumautowesthartford.com
ownhome.house
bestmartinshop.com
splashstoreofficial.com
guidemining.com
ecshopdemo.com
bestprinting1.com
s-circle2020.com
ncagency.info
easydigitalzone.com
reikiforthecollective.com
theknottteam.com
evolvedpixel.com
japxo.online
ryansqualityrenovations.com
dentimagenquito.net
pantherprints.co.uk
apoporangi.com
thietkemietvuon.net
ifernshop.com
casaruralesgranada.com
camp-3saumons.com
eddsucks.com
blwcd.com
deldlab.com
susanperb.com
autosanitizingsolutions.com
femhouse.com
ironcageclash.com
thekinghealer.com
shaghayeghbovand.com
advertfaces.com
lonriley.com
mased-world.online
mythicspacex.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1512-57-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1512-58-0x000000000041F200-mapping.dmp formbook behavioral1/memory/1512-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/980-69-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1280 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
ORDER K0-9110.exepid process 1864 ORDER K0-9110.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
ORDER K0-9110.exeORDER K0-9110.execmstp.exedescription pid process target process PID 1864 set thread context of 1512 1864 ORDER K0-9110.exe ORDER K0-9110.exe PID 1512 set thread context of 1264 1512 ORDER K0-9110.exe Explorer.EXE PID 1512 set thread context of 1264 1512 ORDER K0-9110.exe Explorer.EXE PID 980 set thread context of 1264 980 cmstp.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
ORDER K0-9110.execmstp.exepid process 1512 ORDER K0-9110.exe 1512 ORDER K0-9110.exe 1512 ORDER K0-9110.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe 980 cmstp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
ORDER K0-9110.execmstp.exepid process 1512 ORDER K0-9110.exe 1512 ORDER K0-9110.exe 1512 ORDER K0-9110.exe 1512 ORDER K0-9110.exe 980 cmstp.exe 980 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ORDER K0-9110.execmstp.exedescription pid process Token: SeDebugPrivilege 1512 ORDER K0-9110.exe Token: SeDebugPrivilege 980 cmstp.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
ORDER K0-9110.exeORDER K0-9110.execmstp.exedescription pid process target process PID 1864 wrote to memory of 1512 1864 ORDER K0-9110.exe ORDER K0-9110.exe PID 1864 wrote to memory of 1512 1864 ORDER K0-9110.exe ORDER K0-9110.exe PID 1864 wrote to memory of 1512 1864 ORDER K0-9110.exe ORDER K0-9110.exe PID 1864 wrote to memory of 1512 1864 ORDER K0-9110.exe ORDER K0-9110.exe PID 1864 wrote to memory of 1512 1864 ORDER K0-9110.exe ORDER K0-9110.exe PID 1864 wrote to memory of 1512 1864 ORDER K0-9110.exe ORDER K0-9110.exe PID 1864 wrote to memory of 1512 1864 ORDER K0-9110.exe ORDER K0-9110.exe PID 1512 wrote to memory of 980 1512 ORDER K0-9110.exe cmstp.exe PID 1512 wrote to memory of 980 1512 ORDER K0-9110.exe cmstp.exe PID 1512 wrote to memory of 980 1512 ORDER K0-9110.exe cmstp.exe PID 1512 wrote to memory of 980 1512 ORDER K0-9110.exe cmstp.exe PID 1512 wrote to memory of 980 1512 ORDER K0-9110.exe cmstp.exe PID 1512 wrote to memory of 980 1512 ORDER K0-9110.exe cmstp.exe PID 1512 wrote to memory of 980 1512 ORDER K0-9110.exe cmstp.exe PID 980 wrote to memory of 1280 980 cmstp.exe cmd.exe PID 980 wrote to memory of 1280 980 cmstp.exe cmd.exe PID 980 wrote to memory of 1280 980 cmstp.exe cmd.exe PID 980 wrote to memory of 1280 980 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\ORDER K0-9110.exe"C:\Users\Admin\AppData\Local\Temp\ORDER K0-9110.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ORDER K0-9110.exe"C:\Users\Admin\AppData\Local\Temp\ORDER K0-9110.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ORDER K0-9110.exe"5⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsiCC93.tmp\glpojpygz.dllMD5
65bfefd82f1abd5cf8bc01859f045e1a
SHA190424a43da043f573fffaaf56eda814db42d58a5
SHA256c52fa7b6be2a61d7ab1d53d7aed282c18faafef973a7ab897104d7e31964ca1e
SHA512a2ab61cd5353ab02d4fed464fdf828a882ae9ea29cc79e055f5214791c41c805abbf8cad4651242511c92c653c54b8f9cf96669fd1c3995c3b944bc81a207d21
-
memory/980-66-0x0000000000000000-mapping.dmp
-
memory/980-72-0x0000000000510000-0x00000000005A4000-memory.dmpFilesize
592KB
-
memory/980-71-0x0000000002000000-0x0000000002303000-memory.dmpFilesize
3.0MB
-
memory/980-69-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/980-68-0x0000000000BE0000-0x0000000000BF8000-memory.dmpFilesize
96KB
-
memory/1264-73-0x0000000006EA0000-0x0000000006FAD000-memory.dmpFilesize
1.1MB
-
memory/1264-62-0x00000000061E0000-0x0000000006299000-memory.dmpFilesize
740KB
-
memory/1264-65-0x0000000006BD0000-0x0000000006D21000-memory.dmpFilesize
1.3MB
-
memory/1280-70-0x0000000000000000-mapping.dmp
-
memory/1512-60-0x0000000000930000-0x0000000000C33000-memory.dmpFilesize
3.0MB
-
memory/1512-64-0x00000000003A0000-0x00000000003B5000-memory.dmpFilesize
84KB
-
memory/1512-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1512-61-0x00000000002C0000-0x00000000002D5000-memory.dmpFilesize
84KB
-
memory/1512-58-0x000000000041F200-mapping.dmp
-
memory/1512-57-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1864-55-0x0000000075B71000-0x0000000075B73000-memory.dmpFilesize
8KB