Analysis
-
max time kernel
90s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-06-2022 21:48
Static task
static1
Behavioral task
behavioral1
Sample
262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe
Resource
win7-20220414-en
General
-
Target
262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe
-
Size
590KB
-
MD5
e49800b715646a9d30281adb67eedc80
-
SHA1
cde536845aa356ad2913f19145156a8289c999c6
-
SHA256
262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09
-
SHA512
df455c186e1a4c14d5bcd484ab18f97717887cbffe313abebbca8ed3f924492eab1f719b2e2fd4387a6e9ea99c119452c05de380d1daa4e8936fcd4a17eb408a
Malware Config
Extracted
formbook
4.1
t19g
playstationspiele.com
cakesbyannal.com
racepin.space
anti-offender.com
magnetque.com
farragorealtybrokerage.com
khuludmohammed.com
v33696.com
84ggg.com
d440.com
soccersmarthome.com
ofthis.world
fivestaryardcards.com
lusyard.com
gghft.com
viajesfortur.com
rationalirrationality.com
hanaramenrestaurant.com
exactlycleanse.com
martensenargentina.com
michellesellsvt.com
pupsloveandlondon.com
kfhym.world
makeuphoje.com
ebookrise.com
flesherbrothers.com
doonaudio.com
doanet.xyz
wrghintlian.com
davidchristl.com
domaintch.com
quotereflection.com
eroptikblog.xyz
iranianinvestmentclub.com
cp200motorola.com
vsenq.com
theamazonmovement.com
aspiteksoln.com
perkebunannews.com
myreverie.life
hrddf.com
gblaincreative.com
lipsstreet.com
xxf76.top
dureluxx.com
heldelicioso.com
taskconsulting.com
dongcunzhengfu.com
itohpe.com
abundantskill.com
fernhutco.com
hairgrowthxpert.com
intelligentreportscloud.com
maybesupply.com
7156.world
cr-marcelo.com
shequipamentos.com
villeenvie.net
robbyscreations.com
mpaohead.com
nailsa.biz
accoladesandmore.com
preppers.pro
pinpinduo2.xyz
allsofttech.com
Signatures
-
Formbook Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1772-141-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exedescription pid process target process PID 1672 set thread context of 1772 1672 262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe 262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exe262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exepid process 4428 powershell.exe 4428 powershell.exe 1772 262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe 1772 262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4428 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exedescription pid process target process PID 1672 wrote to memory of 4428 1672 262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe powershell.exe PID 1672 wrote to memory of 4428 1672 262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe powershell.exe PID 1672 wrote to memory of 4428 1672 262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe powershell.exe PID 1672 wrote to memory of 116 1672 262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe schtasks.exe PID 1672 wrote to memory of 116 1672 262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe schtasks.exe PID 1672 wrote to memory of 116 1672 262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe schtasks.exe PID 1672 wrote to memory of 1772 1672 262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe 262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe PID 1672 wrote to memory of 1772 1672 262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe 262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe PID 1672 wrote to memory of 1772 1672 262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe 262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe PID 1672 wrote to memory of 1772 1672 262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe 262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe PID 1672 wrote to memory of 1772 1672 262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe 262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe PID 1672 wrote to memory of 1772 1672 262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe 262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe"C:\Users\Admin\AppData\Local\Temp\262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qEPKLo.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qEPKLo" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2C21.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe"C:\Users\Admin\AppData\Local\Temp\262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2C21.tmpFilesize
1KB
MD50b47590288efc3ad890f628bc668e197
SHA17602142df2d02d22cf98573de4ce5080259f3749
SHA2564ec1d106752893f37d0e1e4fa1cbba74c70d85b46f3dc01565774e947d2d2a63
SHA512ac3c9e8e6c1a0d43db83a6415eae03046078fa3d55765f40f69fdb05c05d5e81a32f9c1077a77204a6074374f86cb74ce24012bb0afe8295d1e9986832ba1f47
-
memory/116-136-0x0000000000000000-mapping.dmp
-
memory/1672-131-0x0000000005D60000-0x0000000006304000-memory.dmpFilesize
5.6MB
-
memory/1672-132-0x0000000005690000-0x0000000005722000-memory.dmpFilesize
584KB
-
memory/1672-133-0x0000000005630000-0x000000000563A000-memory.dmpFilesize
40KB
-
memory/1672-134-0x0000000009290000-0x000000000932C000-memory.dmpFilesize
624KB
-
memory/1672-130-0x0000000000BE0000-0x0000000000C7A000-memory.dmpFilesize
616KB
-
memory/1772-141-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1772-145-0x0000000000F40000-0x000000000128A000-memory.dmpFilesize
3.3MB
-
memory/1772-139-0x0000000000000000-mapping.dmp
-
memory/4428-142-0x0000000005320000-0x0000000005342000-memory.dmpFilesize
136KB
-
memory/4428-149-0x0000000006780000-0x000000000679E000-memory.dmpFilesize
120KB
-
memory/4428-137-0x00000000028B0000-0x00000000028E6000-memory.dmpFilesize
216KB
-
memory/4428-143-0x0000000005AF0000-0x0000000005B56000-memory.dmpFilesize
408KB
-
memory/4428-144-0x0000000005CD0000-0x0000000005D36000-memory.dmpFilesize
408KB
-
memory/4428-135-0x0000000000000000-mapping.dmp
-
memory/4428-146-0x00000000061E0000-0x00000000061FE000-memory.dmpFilesize
120KB
-
memory/4428-147-0x00000000071A0000-0x00000000071D2000-memory.dmpFilesize
200KB
-
memory/4428-148-0x0000000071BF0000-0x0000000071C3C000-memory.dmpFilesize
304KB
-
memory/4428-140-0x0000000005350000-0x0000000005978000-memory.dmpFilesize
6.2MB
-
memory/4428-150-0x0000000007B30000-0x00000000081AA000-memory.dmpFilesize
6.5MB
-
memory/4428-151-0x00000000074F0000-0x000000000750A000-memory.dmpFilesize
104KB
-
memory/4428-152-0x0000000007560000-0x000000000756A000-memory.dmpFilesize
40KB
-
memory/4428-153-0x0000000007770000-0x0000000007806000-memory.dmpFilesize
600KB
-
memory/4428-154-0x0000000007720000-0x000000000772E000-memory.dmpFilesize
56KB
-
memory/4428-155-0x0000000007830000-0x000000000784A000-memory.dmpFilesize
104KB
-
memory/4428-156-0x0000000007810000-0x0000000007818000-memory.dmpFilesize
32KB