Analysis
-
max time kernel
146s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
04-07-2022 07:14
Static task
static1
Behavioral task
behavioral1
Sample
MT103-203674982.exe
Resource
win7-20220414-en
General
-
Target
MT103-203674982.exe
-
Size
247KB
-
MD5
400ff0ca3ab2676f072aea68870ef70d
-
SHA1
dfd2f2443fd103089be9ab9f6fe651399b3d19f4
-
SHA256
7a605579f572e0ca0067f031db05ceec4f0445a09aae0a57bc36b14e5874d734
-
SHA512
a441c8e2b7aaf60a46a95077d4296888cc0bebc694e0fefb7501bab664d2fe5a81de8ec703b66df61372dfc3a09d8d918ed9ee952dbb558181a88f535b8d329b
Malware Config
Extracted
formbook
4.1
m56u
tercantiq.com
fortvillechicken.net
spiritsandtheb.com
alliant-inc.biz
yh1902.com
xiaodewenhua.net
cityjobs.xyz
seniorlivingwisconsin.com
piadagrilla.com
truistfinancebank.online
nft-fashionlover.com
hangmandownload.com
chun888.xyz
lemonviral.com
getagrip.network
daniellepinnock.info
chiswickstudios.com
essayservicee.com
bharatpragatifoundation.com
800vn.com
leslieskraftboutique.com
massimusdescanso.com
bastadidiabete.com
tufkase.com
fifyx.xyz
xn--hausarzt-lneburg-szb.com
healthcarecheap.com
minshangjt.com
therapistorangecounty.com
thehappyfinn.com
cannalytics-test.com
thejunglees.com
hotel-tuerkiye.com
80at39.com
elsiemckellar.com
jia-he.net
www-kerassentials.com
sang-pakar.xyz
bivirtual.com
ventul.online
mikateknik.xyz
comparazionequote.net
suffolkpolefitness.com
395136.com
kui88.xyz
keohps.com
laketarponresort.com
betaal.fyi
ekascollection.com
rawreporter.com
regionhere.xyz
theartistknownaskayla.com
bobbihub.com
ezviz.xyz
kiffiybeauty.com
mocthaotay.com
glacies-financial.com
altamahalife.com
jodeeluna.com
familylabsummit.com
oufsfaooqp.com
famaciaonlineveterinaria.com
jadooresurfb.info
yansonlineshop.com
pielearn.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 6 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\binn.exe formbook \Users\Admin\AppData\Local\Temp\binn.exe formbook C:\Users\Admin\AppData\Local\Temp\binn.exe formbook behavioral1/memory/2016-69-0x0000000000080000-0x00000000000AF000-memory.dmp formbook C:\Users\Admin\AppData\Local\Temp\binn.exe formbook behavioral1/memory/2016-75-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Executes dropped EXE 1 IoCs
Processes:
binn.exepid process 2036 binn.exe -
Loads dropped DLL 2 IoCs
Processes:
MT103-203674982.exepid process 1704 MT103-203674982.exe 1704 MT103-203674982.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
binn.exeexplorer.exedescription pid process target process PID 2036 set thread context of 1260 2036 binn.exe Explorer.EXE PID 2036 set thread context of 1260 2036 binn.exe Explorer.EXE PID 2016 set thread context of 1260 2016 explorer.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
binn.exeexplorer.exepid process 2036 binn.exe 2036 binn.exe 2036 binn.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
binn.exeexplorer.exepid process 2036 binn.exe 2036 binn.exe 2036 binn.exe 2036 binn.exe 2016 explorer.exe 2016 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
binn.exeexplorer.exedescription pid process Token: SeDebugPrivilege 2036 binn.exe Token: SeDebugPrivilege 2016 explorer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
MT103-203674982.exeExplorer.EXEexplorer.exedescription pid process target process PID 1704 wrote to memory of 2036 1704 MT103-203674982.exe binn.exe PID 1704 wrote to memory of 2036 1704 MT103-203674982.exe binn.exe PID 1704 wrote to memory of 2036 1704 MT103-203674982.exe binn.exe PID 1704 wrote to memory of 2036 1704 MT103-203674982.exe binn.exe PID 1260 wrote to memory of 2016 1260 Explorer.EXE explorer.exe PID 1260 wrote to memory of 2016 1260 Explorer.EXE explorer.exe PID 1260 wrote to memory of 2016 1260 Explorer.EXE explorer.exe PID 1260 wrote to memory of 2016 1260 Explorer.EXE explorer.exe PID 2016 wrote to memory of 1964 2016 explorer.exe cmd.exe PID 2016 wrote to memory of 1964 2016 explorer.exe cmd.exe PID 2016 wrote to memory of 1964 2016 explorer.exe cmd.exe PID 2016 wrote to memory of 1964 2016 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MT103-203674982.exe"C:\Users\Admin\AppData\Local\Temp\MT103-203674982.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\binn.exe"C:\Users\Admin\AppData\Local\Temp\binn.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\binn.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\binn.exeFilesize
185KB
MD5e1f5a85acd28c0ede994855fa013aefa
SHA1186f3d8528f4016285d3d37adb10b368eea6a2c3
SHA2566c9b4c99b8aa445727927fc0a209bede836c9465b3de875cbf34425347cb0cfd
SHA512a4671c682e78a32dd013c71ab53c133564c8c04bfda4ce2c96e3d7385f51c4f27d1ef26ba5e991d6b24ffdb1602f85f114d3be5195ad618b7c91ebd7fe049337
-
C:\Users\Admin\AppData\Local\Temp\binn.exeFilesize
185KB
MD5e1f5a85acd28c0ede994855fa013aefa
SHA1186f3d8528f4016285d3d37adb10b368eea6a2c3
SHA2566c9b4c99b8aa445727927fc0a209bede836c9465b3de875cbf34425347cb0cfd
SHA512a4671c682e78a32dd013c71ab53c133564c8c04bfda4ce2c96e3d7385f51c4f27d1ef26ba5e991d6b24ffdb1602f85f114d3be5195ad618b7c91ebd7fe049337
-
\Users\Admin\AppData\Local\Temp\binn.exeFilesize
185KB
MD5e1f5a85acd28c0ede994855fa013aefa
SHA1186f3d8528f4016285d3d37adb10b368eea6a2c3
SHA2566c9b4c99b8aa445727927fc0a209bede836c9465b3de875cbf34425347cb0cfd
SHA512a4671c682e78a32dd013c71ab53c133564c8c04bfda4ce2c96e3d7385f51c4f27d1ef26ba5e991d6b24ffdb1602f85f114d3be5195ad618b7c91ebd7fe049337
-
\Users\Admin\AppData\Local\Temp\binn.exeFilesize
185KB
MD5e1f5a85acd28c0ede994855fa013aefa
SHA1186f3d8528f4016285d3d37adb10b368eea6a2c3
SHA2566c9b4c99b8aa445727927fc0a209bede836c9465b3de875cbf34425347cb0cfd
SHA512a4671c682e78a32dd013c71ab53c133564c8c04bfda4ce2c96e3d7385f51c4f27d1ef26ba5e991d6b24ffdb1602f85f114d3be5195ad618b7c91ebd7fe049337
-
memory/1260-76-0x0000000004AD0000-0x0000000004BF4000-memory.dmpFilesize
1.1MB
-
memory/1260-74-0x0000000004AD0000-0x0000000004BF4000-memory.dmpFilesize
1.1MB
-
memory/1260-62-0x00000000073E0000-0x0000000007589000-memory.dmpFilesize
1.7MB
-
memory/1260-64-0x0000000002AF0000-0x0000000002C03000-memory.dmpFilesize
1.1MB
-
memory/1704-54-0x0000000000080000-0x00000000000C4000-memory.dmpFilesize
272KB
-
memory/1704-55-0x00000000755B1000-0x00000000755B3000-memory.dmpFilesize
8KB
-
memory/1964-71-0x0000000000000000-mapping.dmp
-
memory/2016-72-0x0000000002390000-0x0000000002693000-memory.dmpFilesize
3.0MB
-
memory/2016-69-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/2016-67-0x0000000074CB1000-0x0000000074CB3000-memory.dmpFilesize
8KB
-
memory/2016-73-0x0000000002170000-0x0000000002203000-memory.dmpFilesize
588KB
-
memory/2016-68-0x00000000001F0000-0x0000000000471000-memory.dmpFilesize
2.5MB
-
memory/2016-75-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/2016-65-0x0000000000000000-mapping.dmp
-
memory/2036-63-0x00000000001C0000-0x00000000001D4000-memory.dmpFilesize
80KB
-
memory/2036-58-0x0000000000000000-mapping.dmp
-
memory/2036-61-0x0000000000130000-0x0000000000144000-memory.dmpFilesize
80KB
-
memory/2036-60-0x00000000009A0000-0x0000000000CA3000-memory.dmpFilesize
3.0MB