Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
26-01-2022 09:59
Static task
static1
Behavioral task
behavioral1
Sample
LVpromo.exe
Resource
win7-en-20211208
General
-
Target
LVpromo.exe
-
Size
769KB
-
MD5
77e85ad8891096baba68e44b43f2f820
-
SHA1
11517a0e9f4c5f39170f8083436ff6156b5ecf7b
-
SHA256
01622d3e6d14184769fc2b052e32588b7bbd86f5a61e511f395db4695d7018a9
-
SHA512
7c6727fe6a9a2092e576d75cb4ad2cf22f9b2fcba394049430e236590a38d9a90590f52ea89ea96a82e8226e61a70b6e41ab89a7fc6fca9fed13ddcabf4c6a7a
Malware Config
Extracted
formbook
4.1
oh75
denizgidam.com
6cc06.com
charlottewaldburgzeil.com
medijanus.com
qingdaoyiersan.com
datcabilgisayar.xyz
111439d.com
xn--1ruo40k.com
wu6enxwcx5h3.xyz
vnscloud.net
brtka.xyz
showztime.com
promocoesdedezenbro.com
wokpy.com
chnowuk.online
rockshotscafe.com
pelrjy.com
nato-riness.com
feixiang-chem.com
thcoinexchange.com
fuelrescuereponse.com
digitaltunic.com
cellefill.com
paulbau.com
camillebeckman.xyz
ilico-media.com
603sa.com
firstechfedcu.com
koreaglp.com
thebeardedbrocksblends.com
musumeya-kotora.com
tocoteacanada.com
travelwitharden.com
diversamenteclinica.com
bw613.com
qe46.com
spectrumelectrolysis.com
maloyenterprises.com
inovasyon.xyz
remijoe.com
petsgallie.com
metagiphydownload.online
tigerdieect.com
jamedomp.com
peninsularbottling.com
1383fx.com
pandeymasala.online
spoilnet.com
itweu.com
ankxbi.icu
lm-safe-keepingyuchand92.xyz
dreamdsjoceo.com
providentview.com
newchinafortpayne.com
wu6bvnrlz4ra.xyz
intrasvp.com
ghoul-ambrose.com
alltenexpress.com
oniray.com
sistemaparadrogaria.com
zeidrei514-nifty.xyz
excaliburteacher.com
jennyandsteven.com
zakcotransportationllc.com
wwwccsuresults.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1540-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1540-68-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1296-73-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1636 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
LVpromo.exeLVpromo.execontrol.exedescription pid process target process PID 1664 set thread context of 1540 1664 LVpromo.exe LVpromo.exe PID 1540 set thread context of 1412 1540 LVpromo.exe Explorer.EXE PID 1540 set thread context of 1412 1540 LVpromo.exe Explorer.EXE PID 1296 set thread context of 1412 1296 control.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
powershell.exeLVpromo.execontrol.exepid process 1320 powershell.exe 1540 LVpromo.exe 1540 LVpromo.exe 1540 LVpromo.exe 1296 control.exe 1296 control.exe 1296 control.exe 1296 control.exe 1296 control.exe 1296 control.exe 1296 control.exe 1296 control.exe 1296 control.exe 1296 control.exe 1296 control.exe 1296 control.exe 1296 control.exe 1296 control.exe 1296 control.exe 1296 control.exe 1296 control.exe 1296 control.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
LVpromo.execontrol.exepid process 1540 LVpromo.exe 1540 LVpromo.exe 1540 LVpromo.exe 1540 LVpromo.exe 1296 control.exe 1296 control.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exeLVpromo.execontrol.exedescription pid process Token: SeDebugPrivilege 1320 powershell.exe Token: SeDebugPrivilege 1540 LVpromo.exe Token: SeDebugPrivilege 1296 control.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
LVpromo.exeExplorer.EXEcontrol.exedescription pid process target process PID 1664 wrote to memory of 1320 1664 LVpromo.exe powershell.exe PID 1664 wrote to memory of 1320 1664 LVpromo.exe powershell.exe PID 1664 wrote to memory of 1320 1664 LVpromo.exe powershell.exe PID 1664 wrote to memory of 1320 1664 LVpromo.exe powershell.exe PID 1664 wrote to memory of 1548 1664 LVpromo.exe schtasks.exe PID 1664 wrote to memory of 1548 1664 LVpromo.exe schtasks.exe PID 1664 wrote to memory of 1548 1664 LVpromo.exe schtasks.exe PID 1664 wrote to memory of 1548 1664 LVpromo.exe schtasks.exe PID 1664 wrote to memory of 1540 1664 LVpromo.exe LVpromo.exe PID 1664 wrote to memory of 1540 1664 LVpromo.exe LVpromo.exe PID 1664 wrote to memory of 1540 1664 LVpromo.exe LVpromo.exe PID 1664 wrote to memory of 1540 1664 LVpromo.exe LVpromo.exe PID 1664 wrote to memory of 1540 1664 LVpromo.exe LVpromo.exe PID 1664 wrote to memory of 1540 1664 LVpromo.exe LVpromo.exe PID 1664 wrote to memory of 1540 1664 LVpromo.exe LVpromo.exe PID 1412 wrote to memory of 1296 1412 Explorer.EXE control.exe PID 1412 wrote to memory of 1296 1412 Explorer.EXE control.exe PID 1412 wrote to memory of 1296 1412 Explorer.EXE control.exe PID 1412 wrote to memory of 1296 1412 Explorer.EXE control.exe PID 1296 wrote to memory of 1636 1296 control.exe cmd.exe PID 1296 wrote to memory of 1636 1296 control.exe cmd.exe PID 1296 wrote to memory of 1636 1296 control.exe cmd.exe PID 1296 wrote to memory of 1636 1296 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LVpromo.exe"C:\Users\Admin\AppData\Local\Temp\LVpromo.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DhcJUDDVFUzIJt.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DhcJUDDVFUzIJt" /XML "C:\Users\Admin\AppData\Local\Temp\tmp64BC.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\LVpromo.exe"C:\Users\Admin\AppData\Local\Temp\LVpromo.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\LVpromo.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp64BC.tmpMD5
962b3e21d05aacfdeed4f29f3cf9c771
SHA13aeeeeebb9938785a82dce8736de4837846d98d9
SHA2563f6bfe0e1ed1539a914dc02984134f3751d843ff39c1a0659940c114c8c2abad
SHA51242aaa4e78eef6a6d97f5669bca38c80e75374f0c5a6f7b456d479f67d9cf9b0f6c1aaec7fff15a8060e6a1cc95b0eb2b2d7931505013c76ce6745f88c7b8a430
-
memory/1296-72-0x00000000002F0000-0x000000000030F000-memory.dmpFilesize
124KB
-
memory/1296-74-0x00000000020C0000-0x00000000023C3000-memory.dmpFilesize
3.0MB
-
memory/1296-75-0x0000000000510000-0x00000000005A3000-memory.dmpFilesize
588KB
-
memory/1296-73-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1412-70-0x0000000006AA0000-0x0000000006BCD000-memory.dmpFilesize
1.2MB
-
memory/1412-76-0x0000000007BF0000-0x0000000007D3B000-memory.dmpFilesize
1.3MB
-
memory/1412-67-0x0000000006960000-0x0000000006A9C000-memory.dmpFilesize
1.2MB
-
memory/1540-65-0x00000000008C0000-0x0000000000BC3000-memory.dmpFilesize
3.0MB
-
memory/1540-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1540-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1540-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1540-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1540-69-0x00000000002D0000-0x00000000002E4000-memory.dmpFilesize
80KB
-
memory/1540-66-0x0000000000180000-0x0000000000194000-memory.dmpFilesize
80KB
-
memory/1664-57-0x00000000005F0000-0x00000000005FC000-memory.dmpFilesize
48KB
-
memory/1664-55-0x0000000075D61000-0x0000000075D63000-memory.dmpFilesize
8KB
-
memory/1664-58-0x0000000005470000-0x00000000054DA000-memory.dmpFilesize
424KB
-
memory/1664-54-0x0000000000CB0000-0x0000000000D76000-memory.dmpFilesize
792KB
-
memory/1664-56-0x0000000000C30000-0x0000000000C31000-memory.dmpFilesize
4KB