Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
16-12-2021 09:36
Static task
static1
Behavioral task
behavioral1
Sample
4b61202928df12bf9fd1aa7ae12cc743.exe
Resource
win7-en-20211208
General
-
Target
4b61202928df12bf9fd1aa7ae12cc743.exe
-
Size
463KB
-
MD5
4b61202928df12bf9fd1aa7ae12cc743
-
SHA1
83427d18ce784aa66b509fe9871d6c364558fe48
-
SHA256
1d62ae45c62db87a620725b6ece3a6c5c32495a37a06038634002ff16e5365f3
-
SHA512
d4724104ca4f5e5bf66c95b80a52a706050567ec787bad2f0a18ba7430ad6c08d42e7a83f305195a810eb2c9e8658e3b6f6394c5b7b55ac2d67380871487c419
Malware Config
Extracted
formbook
4.1
h4d0
onlinefinejewelry.com
samstringermusic.com
beam-lettings.info
optimumcoin.xyz
fasa.xyz
creativedime.com
eihncuz.online
griffin2008.top
europcarlive.com
jxhcar.com
museumsshop.international
bonolaboral-lnterbank.com
kelebandis.xyz
hiddenlakeranch.net
carelessyouth.com
jfkilfoil.store
potok-it-ua.site
magdulemediation.com
shakadal.xyz
coastconstructionfl.com
wilsonbrosvanlines.com
collagenroaster.com
thegetawayspace.com
grittybeetsproduction.com
ieemyanmar.com
gyozaviajera.com
familie-leben.info
finnbd.com
nomasrevolving.com
gtstudios.art
sergesur.com
hnljgame.com
lakemould.com
kandanmart.com
devinbutler.com
everythingisdetermined.com
justift96.com
crose.info
pb6111.com
thecollarcollective.com
jrc8899.com
studiocrypto.xyz
sadrarobotics.com
carpimuebles.com
chinaqcgg.com
ninjixiang.net
thewildexplorerabin.com
realestatenebraskanews.com
metaversenitro.com
com171ksw.xyz
fammilee.com
farmstoragesolution.com
some-things.net
kedaiwangi.one
aztrac.net
webzyn.xyz
cell-mex.com
argusprojects.com
jcaemporium.com
xfgyun.store
xdhgrl.com
creating-club.com
masterproperty34.com
joyemotion.com
voxelsoxx.xyz
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3964-116-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3964-117-0x000000000041F130-mapping.dmp formbook -
Loads dropped DLL 1 IoCs
Processes:
4b61202928df12bf9fd1aa7ae12cc743.exepid process 2940 4b61202928df12bf9fd1aa7ae12cc743.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4b61202928df12bf9fd1aa7ae12cc743.exedescription pid process target process PID 2940 set thread context of 3964 2940 4b61202928df12bf9fd1aa7ae12cc743.exe 4b61202928df12bf9fd1aa7ae12cc743.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
4b61202928df12bf9fd1aa7ae12cc743.exepid process 3964 4b61202928df12bf9fd1aa7ae12cc743.exe 3964 4b61202928df12bf9fd1aa7ae12cc743.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
4b61202928df12bf9fd1aa7ae12cc743.exedescription pid process target process PID 2940 wrote to memory of 3964 2940 4b61202928df12bf9fd1aa7ae12cc743.exe 4b61202928df12bf9fd1aa7ae12cc743.exe PID 2940 wrote to memory of 3964 2940 4b61202928df12bf9fd1aa7ae12cc743.exe 4b61202928df12bf9fd1aa7ae12cc743.exe PID 2940 wrote to memory of 3964 2940 4b61202928df12bf9fd1aa7ae12cc743.exe 4b61202928df12bf9fd1aa7ae12cc743.exe PID 2940 wrote to memory of 3964 2940 4b61202928df12bf9fd1aa7ae12cc743.exe 4b61202928df12bf9fd1aa7ae12cc743.exe PID 2940 wrote to memory of 3964 2940 4b61202928df12bf9fd1aa7ae12cc743.exe 4b61202928df12bf9fd1aa7ae12cc743.exe PID 2940 wrote to memory of 3964 2940 4b61202928df12bf9fd1aa7ae12cc743.exe 4b61202928df12bf9fd1aa7ae12cc743.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b61202928df12bf9fd1aa7ae12cc743.exe"C:\Users\Admin\AppData\Local\Temp\4b61202928df12bf9fd1aa7ae12cc743.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4b61202928df12bf9fd1aa7ae12cc743.exe"C:\Users\Admin\AppData\Local\Temp\4b61202928df12bf9fd1aa7ae12cc743.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nslA0B6.tmp\ngxq.dllMD5
07360e01d34fed4b32247f5273da6603
SHA15e38a5c226f89214a5e99798598601eb3ae495d9
SHA256a6edc1489d37a5f597c9bb5996406ee67b5c86add49dbe3bd31f67fd1604d923
SHA512b7487094a0788ff0e2e0f1e736d2ec2afcf81ce5c4e2d664243f54a469b93818faa28d1f6d1b12010d5957da7f1a4ce697cef7dc4f5fc63111e1f1c52ebc7d77
-
memory/3964-116-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3964-117-0x000000000041F130-mapping.dmp
-
memory/3964-118-0x00000000009D0000-0x0000000000CF0000-memory.dmpFilesize
3.1MB