Analysis
-
max time kernel
152s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:02
Static task
static1
Behavioral task
behavioral1
Sample
Anekgroup Order.exe
Resource
win7-20220414-en
General
-
Target
Anekgroup Order.exe
-
Size
494KB
-
MD5
d2b789d2c98252774eb46369c122e862
-
SHA1
79d2d76e879bf3dc2d9c5c748fd69c37ce6c3d16
-
SHA256
823f72e280224715e6d4f7fff1f792d2c372d7633eab250f2308325eff114c18
-
SHA512
e2b217874575571d6159a35cc34be34de1ba078e17084e5965f56e4066b6ca8acbdf1bf40d4a30ed5c21a0716baa308778af1fdd02f2bbd1d9f7a036d44b1d84
Malware Config
Extracted
formbook
4.1
xwqs
miracledynamic.win
farshadzandi.com
cruisesociety.site
alluredecorate.com
topseptictanks.net
goodguysblogblack.com
xn--80aaexkk3ad8c.com
manbet22.net
ristohotelcastellani.com
vesinhvinhlong.com
fashion-phoenix.com
iferrara.expert
sellyourart.gallery
hayatmag.info
serafimasflowersparadise.com
4p1o3a.biz
maidonline.net
kuntaijinrong.com
makethebreastpumpnotsuck.com
europeansmartcapital.com
familyfolktales.com
thetowing.world
zulemalabra.com
yennyso.com
asmnb.com
aryabhisak.com
taqueriaelherradero.com
ilovebuz.cricket
streamone.studio
othreport.net
xvyhhx.download
stratz-consulting.com
flangeroofs.com
aspiresuccessconsulting.com
ohiorecoverypros.info
xn--igt54izq0a.com
mojzesz.email
ecosnus.com
robocroft.com
secengine.net
thczepam.com
studiopenelope.com
chrisrubino.net
immogecheck.com
pier39.news
studentcreditcardreviews.info
plombest.com
04sbw.com
vonkeppel.com
pastecolor.com
boot-kik.com
comegetsomevoip.com
arttextileduverdon.info
bestworldwatches.com
dimasjts.com
offerberg.com
cqchidu.com
luxeladybee.net
turismosaoluis.com
jubfps.site
bobandbertie.com
1i0fourapple.loan
pushinglovely.com
abacusfinancialgroupinc.com
mansiobok3.info
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3548-140-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/1312-148-0x0000000000E70000-0x0000000000E9D000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Anekgroup Order.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation Anekgroup Order.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Anekgroup Order.exeAnekgroup Order.exechkdsk.exedescription pid process target process PID 320 set thread context of 3548 320 Anekgroup Order.exe Anekgroup Order.exe PID 3548 set thread context of 3152 3548 Anekgroup Order.exe Explorer.EXE PID 1312 set thread context of 3152 1312 chkdsk.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
Anekgroup Order.exeAnekgroup Order.exechkdsk.exepid process 320 Anekgroup Order.exe 320 Anekgroup Order.exe 320 Anekgroup Order.exe 3548 Anekgroup Order.exe 3548 Anekgroup Order.exe 3548 Anekgroup Order.exe 3548 Anekgroup Order.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Anekgroup Order.exechkdsk.exepid process 3548 Anekgroup Order.exe 3548 Anekgroup Order.exe 3548 Anekgroup Order.exe 1312 chkdsk.exe 1312 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Anekgroup Order.exeAnekgroup Order.exechkdsk.exedescription pid process Token: SeDebugPrivilege 320 Anekgroup Order.exe Token: SeDebugPrivilege 3548 Anekgroup Order.exe Token: SeDebugPrivilege 1312 chkdsk.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Anekgroup Order.exeExplorer.EXEchkdsk.exedescription pid process target process PID 320 wrote to memory of 3644 320 Anekgroup Order.exe schtasks.exe PID 320 wrote to memory of 3644 320 Anekgroup Order.exe schtasks.exe PID 320 wrote to memory of 3644 320 Anekgroup Order.exe schtasks.exe PID 320 wrote to memory of 3936 320 Anekgroup Order.exe Anekgroup Order.exe PID 320 wrote to memory of 3936 320 Anekgroup Order.exe Anekgroup Order.exe PID 320 wrote to memory of 3936 320 Anekgroup Order.exe Anekgroup Order.exe PID 320 wrote to memory of 3548 320 Anekgroup Order.exe Anekgroup Order.exe PID 320 wrote to memory of 3548 320 Anekgroup Order.exe Anekgroup Order.exe PID 320 wrote to memory of 3548 320 Anekgroup Order.exe Anekgroup Order.exe PID 320 wrote to memory of 3548 320 Anekgroup Order.exe Anekgroup Order.exe PID 320 wrote to memory of 3548 320 Anekgroup Order.exe Anekgroup Order.exe PID 320 wrote to memory of 3548 320 Anekgroup Order.exe Anekgroup Order.exe PID 3152 wrote to memory of 1312 3152 Explorer.EXE chkdsk.exe PID 3152 wrote to memory of 1312 3152 Explorer.EXE chkdsk.exe PID 3152 wrote to memory of 1312 3152 Explorer.EXE chkdsk.exe PID 1312 wrote to memory of 3136 1312 chkdsk.exe cmd.exe PID 1312 wrote to memory of 3136 1312 chkdsk.exe cmd.exe PID 1312 wrote to memory of 3136 1312 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Anekgroup Order.exe"C:\Users\Admin\AppData\Local\Temp\Anekgroup Order.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DTSbqLcmux" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE445.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Anekgroup Order.exe"C:\Users\Admin\AppData\Local\Temp\Anekgroup Order.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Anekgroup Order.exe"C:\Users\Admin\AppData\Local\Temp\Anekgroup Order.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Anekgroup Order.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpE445.tmpFilesize
1KB
MD5e4b7b353b85c3fd1ed7d2969e178ce6f
SHA1292887c6f889396093fff8e6b15168f9c5f348df
SHA256cd3d9cece94f5459ed9d2afb1812fdc3ddfce9e470d22fb9dad9ddd6f40002c9
SHA5124faf7a7bf433c0e0d953251fa7eed609e25e8bfb9a904768ad753d88346f85d0af046e22c6b8bbe6cafda7c61972335dbf4724a343ad7b9712011882095086cc
-
memory/320-131-0x0000000005730000-0x00000000057CC000-memory.dmpFilesize
624KB
-
memory/320-132-0x0000000005D80000-0x0000000006324000-memory.dmpFilesize
5.6MB
-
memory/320-133-0x0000000005870000-0x0000000005902000-memory.dmpFilesize
584KB
-
memory/320-134-0x00000000057F0000-0x00000000057FA000-memory.dmpFilesize
40KB
-
memory/320-135-0x0000000005A00000-0x0000000005A56000-memory.dmpFilesize
344KB
-
memory/320-130-0x0000000000D10000-0x0000000000D92000-memory.dmpFilesize
520KB
-
memory/1312-146-0x0000000000160000-0x000000000016A000-memory.dmpFilesize
40KB
-
memory/1312-147-0x00000000017B0000-0x0000000001AFA000-memory.dmpFilesize
3.3MB
-
memory/1312-150-0x0000000001450000-0x00000000014E3000-memory.dmpFilesize
588KB
-
memory/1312-148-0x0000000000E70000-0x0000000000E9D000-memory.dmpFilesize
180KB
-
memory/1312-145-0x0000000000000000-mapping.dmp
-
memory/3136-149-0x0000000000000000-mapping.dmp
-
memory/3152-144-0x0000000002B50000-0x0000000002CA7000-memory.dmpFilesize
1.3MB
-
memory/3152-151-0x0000000008450000-0x000000000858E000-memory.dmpFilesize
1.2MB
-
memory/3548-143-0x0000000000BF0000-0x0000000000C04000-memory.dmpFilesize
80KB
-
memory/3548-142-0x0000000001070000-0x00000000013BA000-memory.dmpFilesize
3.3MB
-
memory/3548-140-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/3548-139-0x0000000000000000-mapping.dmp
-
memory/3644-136-0x0000000000000000-mapping.dmp
-
memory/3936-138-0x0000000000000000-mapping.dmp