Analysis
-
max time kernel
153s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 13:07
Static task
static1
Behavioral task
behavioral1
Sample
Orden N° 067.exe
Resource
win7-en-20211208
General
-
Target
Orden N° 067.exe
-
Size
247KB
-
MD5
b36ce18bb9f5d208ebef0620b525baf7
-
SHA1
045951540bd833078efb46ee7a38af86dac7764f
-
SHA256
cd4537fc71b075714c040194ba6caba7b0d1bf8b8614f0d7b1868f4941e4cb06
-
SHA512
755732c0d6c89180f9d7fa08361b221011dd014938abc1ee65ce62062ba22422fa74d29cabe6e4ca35093911788d622445bced9ea56659fd29c2e30834bee493
Malware Config
Extracted
formbook
4.1
os16
nautic-experts-hageboelling.com
fullharvestfundraising.com
xbdsm.club
duocaterers.com
prizebuddy.club
nillprive.com
firebreathingpenguin.com
buxledger.com
annual-journals.com
mydemosite0.com
noaoka.com
eblaghe-iran.xyz
globalyuncang.com
jacqueson-autocars.com
asiafinances.com
howtomakearesume.space
modernwarfaresecrets.com
dualamaquinaria.com
thrili.com
gracing-up.com
jcrealtydesigns.com
southaustinmarket.com
dp-yszxwbhc.com
cryptolux.store
yourtechyadda.com
yogamat-turban.com
fykori.xyz
bitherders.com
strelingcollectibles.com
undershieldz.com
youcarboneutral.com
meetjaykinder.com
wicked-smokes.com
wy-bride.com
dunespro.com
sallyandterry.com
theamalfiswim.com
eleynworld.com
dreamsinbloomphotography.com
anaccommodation.com
slingactivt.com
rxd-ereecd.com
immovableproperty.online
ramziflowers.com
anthropophony.com
uncle.finance
ialife.info
kennascookies.com
meta-medical.info
sexcommittee.com
royalfountainlogistics.com
thedefinitionteam.store
dragonflyessence.com
momubeauty.com
alraedest.com
alcmjd.xyz
massagecon.com
nicoletian.com
rapslearning.online
dlapi.xyz
52economics.com
neurochirurgie-eisner.com
mbbfocean.xyz
greenlightiim.com
foodgw.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1344-117-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3268-123-0x0000000000E20000-0x0000000000E4F000-memory.dmp formbook -
Loads dropped DLL 1 IoCs
Processes:
Orden N° 067.exepid process 3068 Orden N° 067.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Orden N° 067.exeOrden N° 067.exemsdt.exedescription pid process target process PID 3068 set thread context of 1344 3068 Orden N° 067.exe Orden N° 067.exe PID 1344 set thread context of 3056 1344 Orden N° 067.exe Explorer.EXE PID 3268 set thread context of 3056 3268 msdt.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 54 IoCs
Processes:
Orden N° 067.exemsdt.exepid process 1344 Orden N° 067.exe 1344 Orden N° 067.exe 1344 Orden N° 067.exe 1344 Orden N° 067.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe 3268 msdt.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3056 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Orden N° 067.exemsdt.exepid process 1344 Orden N° 067.exe 1344 Orden N° 067.exe 1344 Orden N° 067.exe 3268 msdt.exe 3268 msdt.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Orden N° 067.exemsdt.exedescription pid process Token: SeDebugPrivilege 1344 Orden N° 067.exe Token: SeDebugPrivilege 3268 msdt.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Orden N° 067.exeExplorer.EXEmsdt.exedescription pid process target process PID 3068 wrote to memory of 1344 3068 Orden N° 067.exe Orden N° 067.exe PID 3068 wrote to memory of 1344 3068 Orden N° 067.exe Orden N° 067.exe PID 3068 wrote to memory of 1344 3068 Orden N° 067.exe Orden N° 067.exe PID 3068 wrote to memory of 1344 3068 Orden N° 067.exe Orden N° 067.exe PID 3068 wrote to memory of 1344 3068 Orden N° 067.exe Orden N° 067.exe PID 3068 wrote to memory of 1344 3068 Orden N° 067.exe Orden N° 067.exe PID 3056 wrote to memory of 3268 3056 Explorer.EXE msdt.exe PID 3056 wrote to memory of 3268 3056 Explorer.EXE msdt.exe PID 3056 wrote to memory of 3268 3056 Explorer.EXE msdt.exe PID 3268 wrote to memory of 4080 3268 msdt.exe cmd.exe PID 3268 wrote to memory of 4080 3268 msdt.exe cmd.exe PID 3268 wrote to memory of 4080 3268 msdt.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Orden N° 067.exe"C:\Users\Admin\AppData\Local\Temp\Orden N° 067.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Orden N° 067.exe"C:\Users\Admin\AppData\Local\Temp\Orden N° 067.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Orden N° 067.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsf83B5.tmp\attiqkrutig.dllMD5
7a1555a55a8122f0dc242098c2b2e6e1
SHA1e4d0a98a54d806cdc19277d85bf0f7eca4544b4b
SHA256f3ad56b193b11181634b44e6bff6e2e34cc171a86412cae53f19088596214f00
SHA512dc2a01c605bbe6277b150fe3d1f163302f4b598e441dab428493576f01d25a36713dd8f92d2d27016cc171cbad2ffa6eef0692e90002e8b5524deeac382fe05c
-
memory/1344-117-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1344-119-0x00000000009A0000-0x0000000000CC0000-memory.dmpFilesize
3.1MB
-
memory/1344-120-0x00000000006D0000-0x00000000006E4000-memory.dmpFilesize
80KB
-
memory/3056-121-0x0000000002590000-0x000000000265B000-memory.dmpFilesize
812KB
-
memory/3056-126-0x0000000005C10000-0x0000000005D4D000-memory.dmpFilesize
1.2MB
-
memory/3068-116-0x0000000002280000-0x0000000002282000-memory.dmpFilesize
8KB
-
memory/3268-123-0x0000000000E20000-0x0000000000E4F000-memory.dmpFilesize
188KB
-
memory/3268-122-0x0000000000E50000-0x0000000000FC3000-memory.dmpFilesize
1.4MB
-
memory/3268-124-0x00000000051F0000-0x0000000005510000-memory.dmpFilesize
3.1MB
-
memory/3268-125-0x0000000004E00000-0x0000000004E93000-memory.dmpFilesize
588KB