Analysis
-
max time kernel
145s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
02-07-2022 14:41
Static task
static1
Behavioral task
behavioral1
Sample
MT103-203674982.exe
Resource
win7-20220414-en
General
-
Target
MT103-203674982.exe
-
Size
247KB
-
MD5
400ff0ca3ab2676f072aea68870ef70d
-
SHA1
dfd2f2443fd103089be9ab9f6fe651399b3d19f4
-
SHA256
7a605579f572e0ca0067f031db05ceec4f0445a09aae0a57bc36b14e5874d734
-
SHA512
a441c8e2b7aaf60a46a95077d4296888cc0bebc694e0fefb7501bab664d2fe5a81de8ec703b66df61372dfc3a09d8d918ed9ee952dbb558181a88f535b8d329b
Malware Config
Extracted
formbook
4.1
m56u
tercantiq.com
fortvillechicken.net
spiritsandtheb.com
alliant-inc.biz
yh1902.com
xiaodewenhua.net
cityjobs.xyz
seniorlivingwisconsin.com
piadagrilla.com
truistfinancebank.online
nft-fashionlover.com
hangmandownload.com
chun888.xyz
lemonviral.com
getagrip.network
daniellepinnock.info
chiswickstudios.com
essayservicee.com
bharatpragatifoundation.com
800vn.com
leslieskraftboutique.com
massimusdescanso.com
bastadidiabete.com
tufkase.com
fifyx.xyz
xn--hausarzt-lneburg-szb.com
healthcarecheap.com
minshangjt.com
therapistorangecounty.com
thehappyfinn.com
cannalytics-test.com
thejunglees.com
hotel-tuerkiye.com
80at39.com
elsiemckellar.com
jia-he.net
www-kerassentials.com
sang-pakar.xyz
bivirtual.com
ventul.online
mikateknik.xyz
comparazionequote.net
suffolkpolefitness.com
395136.com
kui88.xyz
keohps.com
laketarponresort.com
betaal.fyi
ekascollection.com
rawreporter.com
regionhere.xyz
theartistknownaskayla.com
bobbihub.com
ezviz.xyz
kiffiybeauty.com
mocthaotay.com
glacies-financial.com
altamahalife.com
jodeeluna.com
familylabsummit.com
oufsfaooqp.com
famaciaonlineveterinaria.com
jadooresurfb.info
yansonlineshop.com
pielearn.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 6 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\binn.exe formbook \Users\Admin\AppData\Local\Temp\binn.exe formbook C:\Users\Admin\AppData\Local\Temp\binn.exe formbook C:\Users\Admin\AppData\Local\Temp\binn.exe formbook behavioral1/memory/1272-68-0x0000000000090000-0x00000000000BF000-memory.dmp formbook behavioral1/memory/1272-72-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Executes dropped EXE 1 IoCs
Processes:
binn.exepid process 1284 binn.exe -
Loads dropped DLL 2 IoCs
Processes:
MT103-203674982.exepid process 1672 MT103-203674982.exe 1672 MT103-203674982.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
binn.exerundll32.exedescription pid process target process PID 1284 set thread context of 1204 1284 binn.exe Explorer.EXE PID 1272 set thread context of 1204 1272 rundll32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
binn.exerundll32.exepid process 1284 binn.exe 1284 binn.exe 1272 rundll32.exe 1272 rundll32.exe 1272 rundll32.exe 1272 rundll32.exe 1272 rundll32.exe 1272 rundll32.exe 1272 rundll32.exe 1272 rundll32.exe 1272 rundll32.exe 1272 rundll32.exe 1272 rundll32.exe 1272 rundll32.exe 1272 rundll32.exe 1272 rundll32.exe 1272 rundll32.exe 1272 rundll32.exe 1272 rundll32.exe 1272 rundll32.exe 1272 rundll32.exe 1272 rundll32.exe 1272 rundll32.exe 1272 rundll32.exe 1272 rundll32.exe 1272 rundll32.exe 1272 rundll32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
binn.exerundll32.exepid process 1284 binn.exe 1284 binn.exe 1284 binn.exe 1272 rundll32.exe 1272 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
binn.exerundll32.exedescription pid process Token: SeDebugPrivilege 1284 binn.exe Token: SeDebugPrivilege 1272 rundll32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
MT103-203674982.exeExplorer.EXErundll32.exedescription pid process target process PID 1672 wrote to memory of 1284 1672 MT103-203674982.exe binn.exe PID 1672 wrote to memory of 1284 1672 MT103-203674982.exe binn.exe PID 1672 wrote to memory of 1284 1672 MT103-203674982.exe binn.exe PID 1672 wrote to memory of 1284 1672 MT103-203674982.exe binn.exe PID 1204 wrote to memory of 1272 1204 Explorer.EXE rundll32.exe PID 1204 wrote to memory of 1272 1204 Explorer.EXE rundll32.exe PID 1204 wrote to memory of 1272 1204 Explorer.EXE rundll32.exe PID 1204 wrote to memory of 1272 1204 Explorer.EXE rundll32.exe PID 1204 wrote to memory of 1272 1204 Explorer.EXE rundll32.exe PID 1204 wrote to memory of 1272 1204 Explorer.EXE rundll32.exe PID 1204 wrote to memory of 1272 1204 Explorer.EXE rundll32.exe PID 1272 wrote to memory of 1304 1272 rundll32.exe cmd.exe PID 1272 wrote to memory of 1304 1272 rundll32.exe cmd.exe PID 1272 wrote to memory of 1304 1272 rundll32.exe cmd.exe PID 1272 wrote to memory of 1304 1272 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MT103-203674982.exe"C:\Users\Admin\AppData\Local\Temp\MT103-203674982.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\binn.exe"C:\Users\Admin\AppData\Local\Temp\binn.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\binn.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\binn.exeFilesize
185KB
MD5e1f5a85acd28c0ede994855fa013aefa
SHA1186f3d8528f4016285d3d37adb10b368eea6a2c3
SHA2566c9b4c99b8aa445727927fc0a209bede836c9465b3de875cbf34425347cb0cfd
SHA512a4671c682e78a32dd013c71ab53c133564c8c04bfda4ce2c96e3d7385f51c4f27d1ef26ba5e991d6b24ffdb1602f85f114d3be5195ad618b7c91ebd7fe049337
-
C:\Users\Admin\AppData\Local\Temp\binn.exeFilesize
185KB
MD5e1f5a85acd28c0ede994855fa013aefa
SHA1186f3d8528f4016285d3d37adb10b368eea6a2c3
SHA2566c9b4c99b8aa445727927fc0a209bede836c9465b3de875cbf34425347cb0cfd
SHA512a4671c682e78a32dd013c71ab53c133564c8c04bfda4ce2c96e3d7385f51c4f27d1ef26ba5e991d6b24ffdb1602f85f114d3be5195ad618b7c91ebd7fe049337
-
\Users\Admin\AppData\Local\Temp\binn.exeFilesize
185KB
MD5e1f5a85acd28c0ede994855fa013aefa
SHA1186f3d8528f4016285d3d37adb10b368eea6a2c3
SHA2566c9b4c99b8aa445727927fc0a209bede836c9465b3de875cbf34425347cb0cfd
SHA512a4671c682e78a32dd013c71ab53c133564c8c04bfda4ce2c96e3d7385f51c4f27d1ef26ba5e991d6b24ffdb1602f85f114d3be5195ad618b7c91ebd7fe049337
-
\Users\Admin\AppData\Local\Temp\binn.exeFilesize
185KB
MD5e1f5a85acd28c0ede994855fa013aefa
SHA1186f3d8528f4016285d3d37adb10b368eea6a2c3
SHA2566c9b4c99b8aa445727927fc0a209bede836c9465b3de875cbf34425347cb0cfd
SHA512a4671c682e78a32dd013c71ab53c133564c8c04bfda4ce2c96e3d7385f51c4f27d1ef26ba5e991d6b24ffdb1602f85f114d3be5195ad618b7c91ebd7fe049337
-
memory/1204-62-0x0000000004A90000-0x0000000004BB5000-memory.dmpFilesize
1.1MB
-
memory/1204-73-0x0000000004CB0000-0x0000000004E10000-memory.dmpFilesize
1.4MB
-
memory/1204-71-0x0000000004CB0000-0x0000000004E10000-memory.dmpFilesize
1.4MB
-
memory/1272-70-0x0000000001E60000-0x0000000001EF3000-memory.dmpFilesize
588KB
-
memory/1272-63-0x0000000000000000-mapping.dmp
-
memory/1272-72-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/1272-67-0x0000000000820000-0x000000000082E000-memory.dmpFilesize
56KB
-
memory/1272-69-0x0000000002090000-0x0000000002393000-memory.dmpFilesize
3.0MB
-
memory/1272-68-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/1284-61-0x0000000000270000-0x0000000000284000-memory.dmpFilesize
80KB
-
memory/1284-60-0x0000000000A20000-0x0000000000D23000-memory.dmpFilesize
3.0MB
-
memory/1284-58-0x0000000000000000-mapping.dmp
-
memory/1304-66-0x0000000000000000-mapping.dmp
-
memory/1672-55-0x0000000075B61000-0x0000000075B63000-memory.dmpFilesize
8KB
-
memory/1672-54-0x0000000000BB0000-0x0000000000BF4000-memory.dmpFilesize
272KB