Analysis
-
max time kernel
117s -
max time network
131s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
18-01-2022 17:01
Static task
static1
General
-
Target
4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe
-
Size
173KB
-
MD5
26c5dc4002976b3b9ae49f2440929df4
-
SHA1
e43a8d51eacb148ed0cfa2d88b229bf212493eab
-
SHA256
4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8
-
SHA512
a3789050060c85a77c48631ec7ab564d0244b49c4e513a388f7f2fbd57a1ad669ffa21b1c87a18daeb4655fe964906c92269dd461c18269fff4660adc5ef188d
Malware Config
Extracted
formbook
4.1
oh75
denizgidam.com
6cc06.com
charlottewaldburgzeil.com
medijanus.com
qingdaoyiersan.com
datcabilgisayar.xyz
111439d.com
xn--1ruo40k.com
wu6enxwcx5h3.xyz
vnscloud.net
brtka.xyz
showztime.com
promocoesdedezenbro.com
wokpy.com
chnowuk.online
rockshotscafe.com
pelrjy.com
nato-riness.com
feixiang-chem.com
thcoinexchange.com
fuelrescuereponse.com
digitaltunic.com
cellefill.com
paulbau.com
camillebeckman.xyz
ilico-media.com
603sa.com
firstechfedcu.com
koreaglp.com
thebeardedbrocksblends.com
musumeya-kotora.com
tocoteacanada.com
travelwitharden.com
diversamenteclinica.com
bw613.com
qe46.com
spectrumelectrolysis.com
maloyenterprises.com
inovasyon.xyz
remijoe.com
petsgallie.com
metagiphydownload.online
tigerdieect.com
jamedomp.com
peninsularbottling.com
1383fx.com
pandeymasala.online
spoilnet.com
itweu.com
ankxbi.icu
lm-safe-keepingyuchand92.xyz
dreamdsjoceo.com
providentview.com
newchinafortpayne.com
wu6bvnrlz4ra.xyz
intrasvp.com
ghoul-ambrose.com
alltenexpress.com
oniray.com
sistemaparadrogaria.com
zeidrei514-nifty.xyz
excaliburteacher.com
jennyandsteven.com
zakcotransportationllc.com
wwwccsuresults.com
Signatures
-
Formbook Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1272-139-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\update = "\"C:\\Users\\Admin\\AppData\\Roaming\\update\\update.exe\"" 4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exedescription pid process target process PID 4000 set thread context of 1272 4000 4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe 4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 436 timeout.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
powershell.exe4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exepid process 3976 powershell.exe 3976 powershell.exe 3976 powershell.exe 4000 4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe 4000 4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe 1272 4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe 1272 4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exepowershell.exedescription pid process Token: SeDebugPrivilege 4000 4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe Token: SeDebugPrivilege 3976 powershell.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exepowershell.execmd.exedescription pid process target process PID 4000 wrote to memory of 3976 4000 4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe powershell.exe PID 4000 wrote to memory of 3976 4000 4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe powershell.exe PID 4000 wrote to memory of 3976 4000 4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe powershell.exe PID 3976 wrote to memory of 4016 3976 powershell.exe cmd.exe PID 3976 wrote to memory of 4016 3976 powershell.exe cmd.exe PID 3976 wrote to memory of 4016 3976 powershell.exe cmd.exe PID 4016 wrote to memory of 436 4016 cmd.exe timeout.exe PID 4016 wrote to memory of 436 4016 cmd.exe timeout.exe PID 4016 wrote to memory of 436 4016 cmd.exe timeout.exe PID 4000 wrote to memory of 1272 4000 4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe 4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe PID 4000 wrote to memory of 1272 4000 4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe 4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe PID 4000 wrote to memory of 1272 4000 4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe 4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe PID 4000 wrote to memory of 1272 4000 4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe 4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe PID 4000 wrote to memory of 1272 4000 4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe 4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe PID 4000 wrote to memory of 1272 4000 4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe 4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe"C:\Users\Admin\AppData\Local\Temp\4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc YwBtAGQAIAAvAGMAIAB0AGkAbQBlAG8AdQB0ACAAMQA5AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout 193⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 194⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exeC:\Users\Admin\AppData\Local\Temp\4e985458976378ce5866b7631c0bd0ecf259d246b3c9b7f6e12b144efcf855b8.exe2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1272-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1272-140-0x0000000000FC0000-0x00000000012E0000-memory.dmpFilesize
3.1MB
-
memory/3976-128-0x0000000007360000-0x00000000073C6000-memory.dmpFilesize
408KB
-
memory/3976-129-0x00000000074D0000-0x0000000007820000-memory.dmpFilesize
3.3MB
-
memory/3976-125-0x00000000043F0000-0x0000000004413000-memory.dmpFilesize
140KB
-
memory/3976-124-0x0000000004410000-0x0000000004411000-memory.dmpFilesize
4KB
-
memory/3976-126-0x00000000071E0000-0x0000000007202000-memory.dmpFilesize
136KB
-
memory/3976-127-0x00000000072F0000-0x0000000007356000-memory.dmpFilesize
408KB
-
memory/3976-121-0x0000000004460000-0x0000000004496000-memory.dmpFilesize
216KB
-
memory/3976-122-0x0000000006BB0000-0x00000000071D8000-memory.dmpFilesize
6.2MB
-
memory/3976-130-0x00000000072C0000-0x00000000072DC000-memory.dmpFilesize
112KB
-
memory/3976-131-0x0000000007B20000-0x0000000007B6B000-memory.dmpFilesize
300KB
-
memory/3976-132-0x0000000007C70000-0x0000000007CE6000-memory.dmpFilesize
472KB
-
memory/4000-136-0x0000000004E80000-0x0000000004F10000-memory.dmpFilesize
576KB
-
memory/4000-137-0x00000000047B0000-0x00000000047FC000-memory.dmpFilesize
304KB
-
memory/4000-138-0x0000000000BC0000-0x0000000000C52000-memory.dmpFilesize
584KB
-
memory/4000-123-0x0000000004D30000-0x0000000004D31000-memory.dmpFilesize
4KB
-
memory/4000-118-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB