Analysis
-
max time kernel
154s -
max time network
191s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-07-2022 13:19
Static task
static1
Behavioral task
behavioral1
Sample
049 BL DRAFT.exe
Resource
win7-20220414-en
General
-
Target
049 BL DRAFT.exe
-
Size
167KB
-
MD5
dd9252c3656c0f6cb68a35f59c047758
-
SHA1
c9ccd18031e4f99cef7fed58a93ed5c7c616274c
-
SHA256
f5e3f4ae71d7846b03325a53361ea4a31b12871a2e4808cae4afcd3dce35e2ea
-
SHA512
a9e564512a2fa28fafcd4ac8838b80948e95146e03fc3e26358f1a117eb309e7456bb5f7eb00193a585b156db86d843c85b4afc1db46676f819733b639fea260
Malware Config
Extracted
formbook
4.1
ba17
bearwant.com
sdsguanfang.com
steamcommunityvia.top
sugarplumtreasures.com
koronislakefishing.com
jmae.xyz
xhxnqemkiqe.xyz
playzcrew.com
zatwsbq.com
lankofix.com
sh-zhepeng.com
mibodamisxv.online
butterflyjewelry.store
finestrecitalto-spottoday.info
globomateria.com
royalmdarts.com
d4af10836709.com
shepwill.com
67aldrich.info
trustedmakers.club
burdiezholdings.com
facialcoach.com
hunterous.com
carei.xyz
positivityintheworkplace.com
top1productjapan.online
camperrentnovara.com
nostalgiaz.xyz
prepperandsalt.com
platinum-swallow-nest.com
jmdadoag.com
cornerstonesolarconsulting.com
carmelhasit.com
hospitalaurelia.com
epolystars.com
best5psychicreadingsites.com
cbradleyowens.com
cmshelps.com
leclefsdor.com
male-muscle-slave.cloud
eselinchen.com
statesunitedaction.net
goweet.com
hififurniturehouse.info
alphacapitaltrust.online
hotsellmed.com
sunxueling.com
firstclass-poolservice.com
tuveranopelayo.com
wayangslot.net
joseauto.net
consinko.com
pacificoffshorecharters.com
steemboard.xyz
poollife.info
miraihenokoibumi.net
mfh-sa.com
seontra.xyz
openfaders.com
guardianz.online
purse.gold
affaire-chaba.com
rosency.xyz
somethingform.site
digitalpursuitsonline.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1536-67-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1536-68-0x000000000041F1E0-mapping.dmp formbook behavioral1/memory/1536-71-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1752-79-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/1752-83-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
049 BL DRAFT.exeRegAsm.exeraserver.exedescription pid process target process PID 964 set thread context of 1536 964 049 BL DRAFT.exe RegAsm.exe PID 1536 set thread context of 1384 1536 RegAsm.exe Explorer.EXE PID 1752 set thread context of 1384 1752 raserver.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
powershell.exe049 BL DRAFT.exeRegAsm.exeraserver.exepid process 1088 powershell.exe 964 049 BL DRAFT.exe 1536 RegAsm.exe 1536 RegAsm.exe 1752 raserver.exe 1752 raserver.exe 1752 raserver.exe 1752 raserver.exe 1752 raserver.exe 1752 raserver.exe 1752 raserver.exe 1752 raserver.exe 1752 raserver.exe 1752 raserver.exe 1752 raserver.exe 1752 raserver.exe 1752 raserver.exe 1752 raserver.exe 1752 raserver.exe 1752 raserver.exe 1752 raserver.exe 1752 raserver.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegAsm.exeraserver.exepid process 1536 RegAsm.exe 1536 RegAsm.exe 1536 RegAsm.exe 1752 raserver.exe 1752 raserver.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
049 BL DRAFT.exepowershell.exeRegAsm.exeraserver.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 964 049 BL DRAFT.exe Token: SeDebugPrivilege 1088 powershell.exe Token: SeDebugPrivilege 1536 RegAsm.exe Token: SeDebugPrivilege 1752 raserver.exe Token: SeShutdownPrivilege 1384 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
049 BL DRAFT.exeExplorer.EXEraserver.exedescription pid process target process PID 964 wrote to memory of 1088 964 049 BL DRAFT.exe powershell.exe PID 964 wrote to memory of 1088 964 049 BL DRAFT.exe powershell.exe PID 964 wrote to memory of 1088 964 049 BL DRAFT.exe powershell.exe PID 964 wrote to memory of 1088 964 049 BL DRAFT.exe powershell.exe PID 964 wrote to memory of 1536 964 049 BL DRAFT.exe RegAsm.exe PID 964 wrote to memory of 1536 964 049 BL DRAFT.exe RegAsm.exe PID 964 wrote to memory of 1536 964 049 BL DRAFT.exe RegAsm.exe PID 964 wrote to memory of 1536 964 049 BL DRAFT.exe RegAsm.exe PID 964 wrote to memory of 1536 964 049 BL DRAFT.exe RegAsm.exe PID 964 wrote to memory of 1536 964 049 BL DRAFT.exe RegAsm.exe PID 964 wrote to memory of 1536 964 049 BL DRAFT.exe RegAsm.exe PID 964 wrote to memory of 1536 964 049 BL DRAFT.exe RegAsm.exe PID 964 wrote to memory of 1536 964 049 BL DRAFT.exe RegAsm.exe PID 964 wrote to memory of 1536 964 049 BL DRAFT.exe RegAsm.exe PID 1384 wrote to memory of 1752 1384 Explorer.EXE raserver.exe PID 1384 wrote to memory of 1752 1384 Explorer.EXE raserver.exe PID 1384 wrote to memory of 1752 1384 Explorer.EXE raserver.exe PID 1384 wrote to memory of 1752 1384 Explorer.EXE raserver.exe PID 1752 wrote to memory of 932 1752 raserver.exe cmd.exe PID 1752 wrote to memory of 932 1752 raserver.exe cmd.exe PID 1752 wrote to memory of 932 1752 raserver.exe cmd.exe PID 1752 wrote to memory of 932 1752 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\049 BL DRAFT.exe"C:\Users\Admin\AppData\Local\Temp\049 BL DRAFT.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/932-77-0x0000000000000000-mapping.dmp
-
memory/964-54-0x00000000003C0000-0x00000000003F0000-memory.dmpFilesize
192KB
-
memory/964-55-0x00000000753B1000-0x00000000753B3000-memory.dmpFilesize
8KB
-
memory/964-56-0x0000000005100000-0x000000000518A000-memory.dmpFilesize
552KB
-
memory/964-57-0x0000000004250000-0x000000000429E000-memory.dmpFilesize
312KB
-
memory/964-58-0x0000000005090000-0x00000000050DC000-memory.dmpFilesize
304KB
-
memory/1088-61-0x0000000070070000-0x000000007061B000-memory.dmpFilesize
5.7MB
-
memory/1088-62-0x0000000070070000-0x000000007061B000-memory.dmpFilesize
5.7MB
-
memory/1088-63-0x0000000070070000-0x000000007061B000-memory.dmpFilesize
5.7MB
-
memory/1088-59-0x0000000000000000-mapping.dmp
-
memory/1384-84-0x00000000046D0000-0x00000000047BC000-memory.dmpFilesize
944KB
-
memory/1384-82-0x00000000046D0000-0x00000000047BC000-memory.dmpFilesize
944KB
-
memory/1384-74-0x0000000004C40000-0x0000000004DC9000-memory.dmpFilesize
1.5MB
-
memory/1536-73-0x00000000001D0000-0x00000000001E5000-memory.dmpFilesize
84KB
-
memory/1536-72-0x0000000002350000-0x0000000002653000-memory.dmpFilesize
3.0MB
-
memory/1536-71-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1536-68-0x000000000041F1E0-mapping.dmp
-
memory/1536-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1536-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1536-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1752-75-0x0000000000000000-mapping.dmp
-
memory/1752-78-0x0000000000AA0000-0x0000000000ABC000-memory.dmpFilesize
112KB
-
memory/1752-79-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1752-80-0x0000000001EC0000-0x00000000021C3000-memory.dmpFilesize
3.0MB
-
memory/1752-81-0x00000000007E0000-0x0000000000874000-memory.dmpFilesize
592KB
-
memory/1752-83-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB