Analysis
-
max time kernel
162s -
max time network
144s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 09:31
Static task
static1
Behavioral task
behavioral1
Sample
new_order.exe
Resource
win7-en-20211208
General
-
Target
new_order.exe
-
Size
247KB
-
MD5
a0e70d1760e60d81e0f4ac2904fa8002
-
SHA1
0512dcf545274ac6512abf3fb31a6fff41614280
-
SHA256
0cd606362bbe747f3d0c0193675ce46ea2920fba28580b784f50a2969bbb0c27
-
SHA512
59c04bc30b9f279d434428011efe80d41fd5de99c92165c77dc2a097b742c60e676f65d6185c90d9e5ddfd181fd4a32c7d237ca75ed2be978c6b951be6ae8588
Malware Config
Extracted
formbook
4.1
os16
nautic-experts-hageboelling.com
fullharvestfundraising.com
xbdsm.club
duocaterers.com
prizebuddy.club
nillprive.com
firebreathingpenguin.com
buxledger.com
annual-journals.com
mydemosite0.com
noaoka.com
eblaghe-iran.xyz
globalyuncang.com
jacqueson-autocars.com
asiafinances.com
howtomakearesume.space
modernwarfaresecrets.com
dualamaquinaria.com
thrili.com
gracing-up.com
jcrealtydesigns.com
southaustinmarket.com
dp-yszxwbhc.com
cryptolux.store
yourtechyadda.com
yogamat-turban.com
fykori.xyz
bitherders.com
strelingcollectibles.com
undershieldz.com
youcarboneutral.com
meetjaykinder.com
wicked-smokes.com
wy-bride.com
dunespro.com
sallyandterry.com
theamalfiswim.com
eleynworld.com
dreamsinbloomphotography.com
anaccommodation.com
slingactivt.com
rxd-ereecd.com
immovableproperty.online
ramziflowers.com
anthropophony.com
uncle.finance
ialife.info
kennascookies.com
meta-medical.info
sexcommittee.com
royalfountainlogistics.com
thedefinitionteam.store
dragonflyessence.com
momubeauty.com
alraedest.com
alcmjd.xyz
massagecon.com
nicoletian.com
rapslearning.online
dlapi.xyz
52economics.com
neurochirurgie-eisner.com
mbbfocean.xyz
greenlightiim.com
foodgw.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2684-119-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3540-126-0x0000000002D80000-0x0000000002DAF000-memory.dmp formbook -
Loads dropped DLL 1 IoCs
Processes:
new_order.exepid process 712 new_order.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
new_order.exenew_order.exemsdt.exedescription pid process target process PID 712 set thread context of 2684 712 new_order.exe new_order.exe PID 2684 set thread context of 3068 2684 new_order.exe Explorer.EXE PID 3540 set thread context of 3068 3540 msdt.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
new_order.exemsdt.exepid process 2684 new_order.exe 2684 new_order.exe 2684 new_order.exe 2684 new_order.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe 3540 msdt.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3068 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
new_order.exemsdt.exepid process 2684 new_order.exe 2684 new_order.exe 2684 new_order.exe 3540 msdt.exe 3540 msdt.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
new_order.exemsdt.exedescription pid process Token: SeDebugPrivilege 2684 new_order.exe Token: SeDebugPrivilege 3540 msdt.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
new_order.exeExplorer.EXEmsdt.exedescription pid process target process PID 712 wrote to memory of 2684 712 new_order.exe new_order.exe PID 712 wrote to memory of 2684 712 new_order.exe new_order.exe PID 712 wrote to memory of 2684 712 new_order.exe new_order.exe PID 712 wrote to memory of 2684 712 new_order.exe new_order.exe PID 712 wrote to memory of 2684 712 new_order.exe new_order.exe PID 712 wrote to memory of 2684 712 new_order.exe new_order.exe PID 3068 wrote to memory of 3540 3068 Explorer.EXE msdt.exe PID 3068 wrote to memory of 3540 3068 Explorer.EXE msdt.exe PID 3068 wrote to memory of 3540 3068 Explorer.EXE msdt.exe PID 3540 wrote to memory of 1172 3540 msdt.exe cmd.exe PID 3540 wrote to memory of 1172 3540 msdt.exe cmd.exe PID 3540 wrote to memory of 1172 3540 msdt.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\new_order.exe"C:\Users\Admin\AppData\Local\Temp\new_order.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\new_order.exe"C:\Users\Admin\AppData\Local\Temp\new_order.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\new_order.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsd6501.tmp\yvucmw.dllMD5
86475a0dbd24b01bcd1b264fecfdf1a2
SHA1745ce764eb6c9bf86e5ae65a5f365e7faf14a394
SHA2564ce85a4d12aa0d5b072330dbc50393d2d29eba5321beb3b3bfc6c4a8e9306ad7
SHA512e14dc2f083bd976482554b62b875645815f6f6bcb9b604b366b7f854e2620222de8f038bb8ddbc2026082476246a9cc1855c6aa1b1cc2a1415feb4a75b4eaca1
-
memory/712-120-0x0000000002350000-0x0000000002354000-memory.dmpFilesize
16KB
-
memory/2684-119-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2684-122-0x00000000009C0000-0x0000000000CE0000-memory.dmpFilesize
3.1MB
-
memory/2684-123-0x0000000000E40000-0x0000000000E54000-memory.dmpFilesize
80KB
-
memory/3068-124-0x00000000051B0000-0x00000000052EE000-memory.dmpFilesize
1.2MB
-
memory/3068-129-0x0000000006830000-0x0000000006935000-memory.dmpFilesize
1.0MB
-
memory/3540-125-0x00000000001E0000-0x0000000000353000-memory.dmpFilesize
1.4MB
-
memory/3540-126-0x0000000002D80000-0x0000000002DAF000-memory.dmpFilesize
188KB
-
memory/3540-127-0x00000000046E0000-0x0000000004A00000-memory.dmpFilesize
3.1MB
-
memory/3540-128-0x0000000004540000-0x00000000046DE000-memory.dmpFilesize
1.6MB