Analysis
- max time kernel
147s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
14/02/2022, 13:50
Static task
static1
Behavioral task
behavioral1
Sample
rocee.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target rocee.exe
- Size 289KB
- Sample220214-q49v1aaham
- SHA256 b1623f58bfe1b81afd809e8b60a395ba2bcbe9c15b67ccb1938bd21172a586ba
- MD5 fa7ae8aacdae5c29240544a7d098b43f
- SHA1 911b39ab19a80ba61b0b71dffcdc29bc27552828
- SHA512 a8726e55f8817ca6cc425501ea1bfc225464c219675ae7f06e7e14b9a26438f6f4ea867830df34c5207c55460e48d7ef7181bd6ea53a2278383edd3782400728
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
r1e3
Decoy
-
floorwaves.com
-
leshigou.top
-
2y3jq.com
-
karobazaar.com
-
cookdd9.com
-
xn--9kqu10bhqv.top
-
hollieforson.com
-
peachso.com
-
gerberry.info
-
abslikepro.com
-
lesourire-official.com
-
dfhgxi.icu
-
lightofcg.com
-
hismozart.com
-
nieuwemaniervanleven.com
-
trimble-gs-112-cable-reel.com
-
putacandleinit.com
-
gopenly.xyz
-
northcountyneuropsychology.com
-
thekittyherbalist.com
-
tangkalopos.com
-
ethioprime.net
-
incredsolutions.com
-
thecandlecasa.com
-
china-scu.com
-
foxue.wiki
-
rh7jmbet.xyz
-
growthpesa.com
-
turnandco.net
-
livinglearning.site
-
ggcuan.net
-
yhy9.xyz
-
bill-address329972.com
-
londoninbd.com
-
wq516.services
-
zzztopia.online
-
lacework55ads.com
-
babys-b.com
-
budgetitworks.net
-
downlookup.com
-
a3dzdftrswfcp.site
-
pearbough.net
-
varehospitality.com
-
oswietleniedomu.com
-
hexterm.net
-
earthzone360.com
-
battlersnetwork.com
-
mauvecomics.xyz
-
llidoo.icu
-
aobvn.com
-
ainamalina.com
-
dietaketol.com
-
prospectingaustralia.gold
-
yoursafety.tech
-
adsick.com
-
grassrootsmedix.com
-
breakthroughcoaching.pro
-
haveitchile.com
-
yoodoo.site
-
kasper.tech
-
peykfori.com
-
dhjzc.icu
-
addbillsau.cloud
-
timesofworld.xyz
-
truenorthgarlicinc.com
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 2 IoCs
resource yara_rule behavioral2/memory/3416-134-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1500-142-0x0000000002E80000-0x0000000002EAF000-memory.dmp formbook - Executes dropped EXE 2 IoCs
pid Process 752 nktxi.exe 3416 nktxi.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 752 set thread context of 3416 752 nktxi.exe 59 PID 3416 set thread context of 2412 3416 nktxi.exe 32 PID 1500 set thread context of 2412 1500 systray.exe 32 - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe - Modifies data under HKEY_USERS 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "4.166560" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4136" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "1.923064" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4008" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132894966197398316" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4276" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.019685" svchost.exe - Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 3416 nktxi.exe 3416 nktxi.exe 3416 nktxi.exe 3416 nktxi.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe 1500 systray.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2412 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3416 nktxi.exe 3416 nktxi.exe 3416 nktxi.exe 1500 systray.exe 1500 systray.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3416 nktxi.exe Token: SeDebugPrivilege 1500 systray.exe Token: SeSecurityPrivilege 3104 TiWorker.exe Token: SeRestorePrivilege 3104 TiWorker.exe Token: SeBackupPrivilege 3104 TiWorker.exe Token: SeBackupPrivilege 3104 TiWorker.exe Token: SeRestorePrivilege 3104 TiWorker.exe Token: SeSecurityPrivilege 3104 TiWorker.exe Token: SeBackupPrivilege 3104 TiWorker.exe Token: SeRestorePrivilege 3104 TiWorker.exe Token: SeSecurityPrivilege 3104 TiWorker.exe Token: SeBackupPrivilege 3104 TiWorker.exe Token: SeRestorePrivilege 3104 TiWorker.exe Token: SeSecurityPrivilege 3104 TiWorker.exe Token: SeBackupPrivilege 3104 TiWorker.exe Token: SeRestorePrivilege 3104 TiWorker.exe Token: SeSecurityPrivilege 3104 TiWorker.exe Token: SeBackupPrivilege 3104 TiWorker.exe Token: SeRestorePrivilege 3104 TiWorker.exe Token: SeSecurityPrivilege 3104 TiWorker.exe Token: SeBackupPrivilege 3104 TiWorker.exe Token: SeRestorePrivilege 3104 TiWorker.exe Token: SeSecurityPrivilege 3104 TiWorker.exe Token: SeBackupPrivilege 3104 TiWorker.exe Token: SeRestorePrivilege 3104 TiWorker.exe Token: SeSecurityPrivilege 3104 TiWorker.exe Token: SeBackupPrivilege 3104 TiWorker.exe Token: SeRestorePrivilege 3104 TiWorker.exe Token: SeSecurityPrivilege 3104 TiWorker.exe Token: SeBackupPrivilege 3104 TiWorker.exe Token: SeRestorePrivilege 3104 TiWorker.exe Token: SeSecurityPrivilege 3104 TiWorker.exe Token: SeBackupPrivilege 3104 TiWorker.exe Token: SeRestorePrivilege 3104 TiWorker.exe Token: SeSecurityPrivilege 3104 TiWorker.exe Token: SeBackupPrivilege 3104 TiWorker.exe Token: SeRestorePrivilege 3104 TiWorker.exe Token: SeSecurityPrivilege 3104 TiWorker.exe Token: SeBackupPrivilege 3104 TiWorker.exe Token: SeRestorePrivilege 3104 TiWorker.exe Token: SeSecurityPrivilege 3104 TiWorker.exe Token: SeBackupPrivilege 3104 TiWorker.exe Token: SeRestorePrivilege 3104 TiWorker.exe Token: SeSecurityPrivilege 3104 TiWorker.exe Token: SeBackupPrivilege 3104 TiWorker.exe Token: SeRestorePrivilege 3104 TiWorker.exe Token: SeSecurityPrivilege 3104 TiWorker.exe Token: SeBackupPrivilege 3104 TiWorker.exe Token: SeRestorePrivilege 3104 TiWorker.exe Token: SeSecurityPrivilege 3104 TiWorker.exe Token: SeBackupPrivilege 3104 TiWorker.exe Token: SeRestorePrivilege 3104 TiWorker.exe Token: SeSecurityPrivilege 3104 TiWorker.exe Token: SeBackupPrivilege 3104 TiWorker.exe Token: SeRestorePrivilege 3104 TiWorker.exe Token: SeSecurityPrivilege 3104 TiWorker.exe Token: SeBackupPrivilege 3104 TiWorker.exe Token: SeRestorePrivilege 3104 TiWorker.exe Token: SeSecurityPrivilege 3104 TiWorker.exe Token: SeBackupPrivilege 3104 TiWorker.exe Token: SeRestorePrivilege 3104 TiWorker.exe Token: SeSecurityPrivilege 3104 TiWorker.exe Token: SeBackupPrivilege 3104 TiWorker.exe Token: SeRestorePrivilege 3104 TiWorker.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1628 wrote to memory of 752 1628 rocee.exe 58 PID 1628 wrote to memory of 752 1628 rocee.exe 58 PID 1628 wrote to memory of 752 1628 rocee.exe 58 PID 752 wrote to memory of 3416 752 nktxi.exe 59 PID 752 wrote to memory of 3416 752 nktxi.exe 59 PID 752 wrote to memory of 3416 752 nktxi.exe 59 PID 752 wrote to memory of 3416 752 nktxi.exe 59 PID 752 wrote to memory of 3416 752 nktxi.exe 59 PID 752 wrote to memory of 3416 752 nktxi.exe 59 PID 2412 wrote to memory of 1500 2412 Explorer.EXE 65 PID 2412 wrote to memory of 1500 2412 Explorer.EXE 65 PID 2412 wrote to memory of 1500 2412 Explorer.EXE 65 PID 1500 wrote to memory of 4028 1500 systray.exe 70 PID 1500 wrote to memory of 4028 1500 systray.exe 70 PID 1500 wrote to memory of 4028 1500 systray.exe 70
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\rocee.exe"C:\Users\Admin\AppData\Local\Temp\rocee.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\nktxi.exeC:\Users\Admin\AppData\Local\Temp\nktxi.exe C:\Users\Admin\AppData\Local\Temp\giafhutag3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\nktxi.exeC:\Users\Admin\AppData\Local\Temp\nktxi.exe C:\Users\Admin\AppData\Local\Temp\giafhutag4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3416
-
-
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:2148
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\nktxi.exe"3⤵PID:4028
-
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:4004
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1272
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3104