Analysis
-
max time kernel
128s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
19-06-2022 20:46
Static task
static1
Behavioral task
behavioral1
Sample
3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe
Resource
win7-20220414-en
General
-
Target
3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe
-
Size
660KB
-
MD5
8586d4005045c9816d1f3b526db7f5e0
-
SHA1
db893933c7bd25841642c2bd1d3c585aefa02479
-
SHA256
3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733
-
SHA512
c66d1c1447ceb443ba85596c2c20ffdc97be02f9841cfc890c412697fba087e9c1227997bfc76e30d5912c9214aea9f287aa3589845a9f2171d757b76e3343ff
Malware Config
Extracted
formbook
3.8
sh
westoffice.net
open-sgi.info
night-club.online
tv17404.info
0472game.com
haberlerim.net
my-web.net
360almeria.com
healthyair.cymru
anxietysupresant.info
domainprodssl1309test.com
tolgakorkmaz.com
laklapos.com
4y978g.info
entitydatabase.info
jese52.party
redstarnepal.com
internationaldrugdiscovery.com
crafting.solutions
lecodedumariage.com
neshackles.com
ashslashesandspa.com
tcisaronno.cloud
e-sophiasstyle.com
makrobet335.com
enighana.com
touslesdeux.com
powerupp.win
darknessanddaylight.com
greatherbbeauty.com
syheiwu.com
theoasis-group.com
correctrxphramacy.com
northcarolinapayday.loan
iangregson.rocks
applecoastnoore.com
mylaboss.com
dahliaskin.com
chicagorefinancenet.com
legacy-multitestghgh.biz
thenaturesea.com
halosflavor.com
hotrosukien2017.com
supermanisadick.com
yymml.com
shipsnappy.info
mentormarki.com
annatheil.com
bankshow.com
thesimscc.net
xn--jor97j2vc4zdsq2bqy5b.net
hermitcrabscare.com
laurarabehi.com
wtax.ltd
cuddlycatbits.com
clashroyalegiveawais.com
lesmatchmaker.com
kopisconstructionllc.com
boibb.info
fafe.ltd
myglitzgirl.com
liquid-service.com
0551lf.com
younghomedecor.com
blandeglos.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3840-133-0x0000000000000000-mapping.dmp formbook behavioral2/memory/3840-135-0x0000000000400000-0x000000000042A000-memory.dmp formbook -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exepid process 3840 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe 3840 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exepid process 4532 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exedescription pid process target process PID 4532 wrote to memory of 3840 4532 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe PID 4532 wrote to memory of 3840 4532 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe PID 4532 wrote to memory of 3840 4532 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe PID 4532 wrote to memory of 3840 4532 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe PID 4532 wrote to memory of 3840 4532 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe PID 4532 wrote to memory of 3840 4532 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe PID 4532 wrote to memory of 3840 4532 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe PID 4532 wrote to memory of 3840 4532 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe PID 4532 wrote to memory of 3840 4532 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe PID 4532 wrote to memory of 3840 4532 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe PID 4532 wrote to memory of 3840 4532 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe PID 4532 wrote to memory of 3840 4532 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe 3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe"C:\Users\Admin\AppData\Local\Temp\3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe"C:\Users\Admin\AppData\Local\Temp\3496d5d286ff7c906f2684d19756acd15393bd034fb231a1e1ebb7eb1d66a733.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3840
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3840-133-0x0000000000000000-mapping.dmp
-
memory/3840-135-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/3840-136-0x0000000000A70000-0x0000000000DBA000-memory.dmpFilesize
3.3MB
-
memory/4532-132-0x0000000002230000-0x0000000002236000-memory.dmpFilesize
24KB
-
memory/4532-134-0x0000000002230000-0x0000000002236000-memory.dmpFilesize
24KB