Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 11:16
Static task
static1
Behavioral task
behavioral1
Sample
opTrJaglOqdy9oE.exe
Resource
win7-20220414-en
General
-
Target
opTrJaglOqdy9oE.exe
-
Size
553KB
-
MD5
ed5ff25257d74b36a35c3a171dd754cc
-
SHA1
238a3737b3458e3ad2dcef135e9086f6be65811b
-
SHA256
a8534e310ee42756cfc01caf1eeddc8f4bca6e7e7f36de1a90f5c6ccc480e90a
-
SHA512
5f262537948b58769264dc896a2defd7d5a982e01ed7c7e3be12647e861a0c119e166e50b776be315015d66c5425183eac78094dc38fc41cab319f38fe91a00a
Malware Config
Extracted
formbook
4.1
aq3x
atinderellastory.com
transylvaniawanderlust.com
b9x1muhzjm4.biz
questmfgtech.net
globalsmartcoin.com
wine-worldtour.com
boerauto.com
lovelybakingco.com
mosikito.com
valorea-immobilier.com
szts168.net
emarkage.com
extraordinarylivingstore.com
ihatehunger.com
animoji.zone
robocovers.com
refengmo.com
beckomedia.com
rifitumab.com
vfatgroup.com
wwwjs80044.com
nbwqwksf.com
kakaroto07.win
kinnairdmarine.com
gamepaces.com
futureyou.tech
bitcoinatmproject.com
atlhomebuilders.com
toprehabfacilities.com
shoptildrop.net
cierradiamse.com
geodataservicesinc.net
patentagentdirect.com
easy-diver.net
rmax10max.com
zvwewn.info
openanel.net
shyxcm.com
mantistrailer.com
13e2.com
peku.ltd
diamondridgestablesllc.net
diabetesgala.com
geleixiaos.com
sanantoniotxsolarelectric.com
dongpinwuyou.com
pkmenjoytheride.com
west-decision.com
skinnutritiondoc.com
garderob.store
feelinamazen.com
artandaks.com
m4sq.com
simple-prod.com
xn--hxtub534vqoa.net
blockchain360.info
ozmosmh.com
walaimpressions.com
yakpore.com
killaday.com
rerab.com
beadsdirectory.com
wonder7globaltaiwan.info
asksociety.site
regulars6.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1240-64-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1240-65-0x000000000041EDE0-mapping.dmp formbook behavioral1/memory/1848-73-0x00000000000D0000-0x00000000000FE000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
opTrJaglOqdy9oE.exeopTrJaglOqdy9oE.exeNETSTAT.EXEdescription pid process target process PID 536 set thread context of 1240 536 opTrJaglOqdy9oE.exe opTrJaglOqdy9oE.exe PID 1240 set thread context of 1208 1240 opTrJaglOqdy9oE.exe Explorer.EXE PID 1848 set thread context of 1208 1848 NETSTAT.EXE Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 1848 NETSTAT.EXE -
Processes:
NETSTAT.EXEdescription ioc process Key created \Registry\User\S-1-5-21-1819626980-2277161760-1023733287-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
opTrJaglOqdy9oE.exeopTrJaglOqdy9oE.exeNETSTAT.EXEpid process 536 opTrJaglOqdy9oE.exe 1240 opTrJaglOqdy9oE.exe 1240 opTrJaglOqdy9oE.exe 1848 NETSTAT.EXE 1848 NETSTAT.EXE 1848 NETSTAT.EXE 1848 NETSTAT.EXE 1848 NETSTAT.EXE 1848 NETSTAT.EXE 1848 NETSTAT.EXE 1848 NETSTAT.EXE 1848 NETSTAT.EXE 1848 NETSTAT.EXE 1848 NETSTAT.EXE 1848 NETSTAT.EXE 1848 NETSTAT.EXE 1848 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
opTrJaglOqdy9oE.exeNETSTAT.EXEpid process 1240 opTrJaglOqdy9oE.exe 1240 opTrJaglOqdy9oE.exe 1240 opTrJaglOqdy9oE.exe 1848 NETSTAT.EXE 1848 NETSTAT.EXE 1848 NETSTAT.EXE 1848 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
opTrJaglOqdy9oE.exeopTrJaglOqdy9oE.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 536 opTrJaglOqdy9oE.exe Token: SeDebugPrivilege 1240 opTrJaglOqdy9oE.exe Token: SeDebugPrivilege 1848 NETSTAT.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
opTrJaglOqdy9oE.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 536 wrote to memory of 1376 536 opTrJaglOqdy9oE.exe schtasks.exe PID 536 wrote to memory of 1376 536 opTrJaglOqdy9oE.exe schtasks.exe PID 536 wrote to memory of 1376 536 opTrJaglOqdy9oE.exe schtasks.exe PID 536 wrote to memory of 1376 536 opTrJaglOqdy9oE.exe schtasks.exe PID 536 wrote to memory of 1324 536 opTrJaglOqdy9oE.exe opTrJaglOqdy9oE.exe PID 536 wrote to memory of 1324 536 opTrJaglOqdy9oE.exe opTrJaglOqdy9oE.exe PID 536 wrote to memory of 1324 536 opTrJaglOqdy9oE.exe opTrJaglOqdy9oE.exe PID 536 wrote to memory of 1324 536 opTrJaglOqdy9oE.exe opTrJaglOqdy9oE.exe PID 536 wrote to memory of 1240 536 opTrJaglOqdy9oE.exe opTrJaglOqdy9oE.exe PID 536 wrote to memory of 1240 536 opTrJaglOqdy9oE.exe opTrJaglOqdy9oE.exe PID 536 wrote to memory of 1240 536 opTrJaglOqdy9oE.exe opTrJaglOqdy9oE.exe PID 536 wrote to memory of 1240 536 opTrJaglOqdy9oE.exe opTrJaglOqdy9oE.exe PID 536 wrote to memory of 1240 536 opTrJaglOqdy9oE.exe opTrJaglOqdy9oE.exe PID 536 wrote to memory of 1240 536 opTrJaglOqdy9oE.exe opTrJaglOqdy9oE.exe PID 536 wrote to memory of 1240 536 opTrJaglOqdy9oE.exe opTrJaglOqdy9oE.exe PID 1208 wrote to memory of 1848 1208 Explorer.EXE NETSTAT.EXE PID 1208 wrote to memory of 1848 1208 Explorer.EXE NETSTAT.EXE PID 1208 wrote to memory of 1848 1208 Explorer.EXE NETSTAT.EXE PID 1208 wrote to memory of 1848 1208 Explorer.EXE NETSTAT.EXE PID 1848 wrote to memory of 1688 1848 NETSTAT.EXE Firefox.exe PID 1848 wrote to memory of 1688 1848 NETSTAT.EXE Firefox.exe PID 1848 wrote to memory of 1688 1848 NETSTAT.EXE Firefox.exe PID 1848 wrote to memory of 1688 1848 NETSTAT.EXE Firefox.exe PID 1848 wrote to memory of 1688 1848 NETSTAT.EXE Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\opTrJaglOqdy9oE.exe"C:\Users\Admin\AppData\Local\Temp\opTrJaglOqdy9oE.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD21F.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\opTrJaglOqdy9oE.exe"C:\Users\Admin\AppData\Local\Temp\opTrJaglOqdy9oE.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\opTrJaglOqdy9oE.exe"C:\Users\Admin\AppData\Local\Temp\opTrJaglOqdy9oE.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD21F.tmpFilesize
1KB
MD561aeb01590cef596e1070974949eaf11
SHA157338065731c05440d467ce637d8cc58603f2c6f
SHA2569c126532a208b686cbd6f80c9be429965f0cb31f7f32ce8b6a93d9f1333e9793
SHA512aaf6a1f1b1e90c57e6ee3aa4f6fc163cd8795ae489803855b638e29c68bcccb815150e3e8333c6c2068f7f65260bc4904489279305df55f4d5e429c38b4c13f7
-
C:\Users\Admin\AppData\Roaming\419RB7D7\419logim.jpegFilesize
68KB
MD5fb11ec6e77b42109578207d4abb7244b
SHA13854b9f087a9aa8ea25fcc13036c27d07e4b2095
SHA2566b71e9e5178d73bada65e1d5d65820d883a63dbd9d14b2445bccdbf6aa9f530b
SHA512bab94128ab34928a38e0495a0bac1ba1a91bd2ee5bc17396b47a4c92cc729610e1e9bfd820c19afb12f0d8d26d0d5181b7f79a5031702c234b7d372c16d9c29b
-
C:\Users\Admin\AppData\Roaming\419RB7D7\419logrf.iniFilesize
40B
MD52f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
C:\Users\Admin\AppData\Roaming\419RB7D7\419logri.iniFilesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\419RB7D7\419logrv.iniFilesize
40B
MD5ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf
-
memory/536-54-0x0000000000040000-0x00000000000D0000-memory.dmpFilesize
576KB
-
memory/536-55-0x0000000075B61000-0x0000000075B63000-memory.dmpFilesize
8KB
-
memory/536-56-0x0000000000280000-0x000000000028A000-memory.dmpFilesize
40KB
-
memory/536-57-0x00000000048F0000-0x000000000493E000-memory.dmpFilesize
312KB
-
memory/536-58-0x0000000000840000-0x0000000000874000-memory.dmpFilesize
208KB
-
memory/1208-76-0x0000000002A10000-0x0000000002AA6000-memory.dmpFilesize
600KB
-
memory/1208-69-0x0000000004A30000-0x0000000004AE7000-memory.dmpFilesize
732KB
-
memory/1240-68-0x0000000000310000-0x0000000000324000-memory.dmpFilesize
80KB
-
memory/1240-67-0x0000000000AE0000-0x0000000000DE3000-memory.dmpFilesize
3.0MB
-
memory/1240-65-0x000000000041EDE0-mapping.dmp
-
memory/1240-64-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1240-62-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1240-61-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1376-59-0x0000000000000000-mapping.dmp
-
memory/1848-70-0x0000000000000000-mapping.dmp
-
memory/1848-72-0x0000000000E40000-0x0000000000E49000-memory.dmpFilesize
36KB
-
memory/1848-73-0x00000000000D0000-0x00000000000FE000-memory.dmpFilesize
184KB
-
memory/1848-74-0x0000000002250000-0x0000000002553000-memory.dmpFilesize
3.0MB
-
memory/1848-75-0x0000000000B50000-0x0000000000BE3000-memory.dmpFilesize
588KB