Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
07-07-2022 13:19
Static task
static1
Behavioral task
behavioral1
Sample
049 BL DRAFT.exe
Resource
win7-20220414-en
General
-
Target
049 BL DRAFT.exe
-
Size
167KB
-
MD5
dd9252c3656c0f6cb68a35f59c047758
-
SHA1
c9ccd18031e4f99cef7fed58a93ed5c7c616274c
-
SHA256
f5e3f4ae71d7846b03325a53361ea4a31b12871a2e4808cae4afcd3dce35e2ea
-
SHA512
a9e564512a2fa28fafcd4ac8838b80948e95146e03fc3e26358f1a117eb309e7456bb5f7eb00193a585b156db86d843c85b4afc1db46676f819733b639fea260
Malware Config
Extracted
formbook
4.1
ba17
bearwant.com
sdsguanfang.com
steamcommunityvia.top
sugarplumtreasures.com
koronislakefishing.com
jmae.xyz
xhxnqemkiqe.xyz
playzcrew.com
zatwsbq.com
lankofix.com
sh-zhepeng.com
mibodamisxv.online
butterflyjewelry.store
finestrecitalto-spottoday.info
globomateria.com
royalmdarts.com
d4af10836709.com
shepwill.com
67aldrich.info
trustedmakers.club
burdiezholdings.com
facialcoach.com
hunterous.com
carei.xyz
positivityintheworkplace.com
top1productjapan.online
camperrentnovara.com
nostalgiaz.xyz
prepperandsalt.com
platinum-swallow-nest.com
jmdadoag.com
cornerstonesolarconsulting.com
carmelhasit.com
hospitalaurelia.com
epolystars.com
best5psychicreadingsites.com
cbradleyowens.com
cmshelps.com
leclefsdor.com
male-muscle-slave.cloud
eselinchen.com
statesunitedaction.net
goweet.com
hififurniturehouse.info
alphacapitaltrust.online
hotsellmed.com
sunxueling.com
firstclass-poolservice.com
tuveranopelayo.com
wayangslot.net
joseauto.net
consinko.com
pacificoffshorecharters.com
steemboard.xyz
poollife.info
miraihenokoibumi.net
mfh-sa.com
seontra.xyz
openfaders.com
guardianz.online
purse.gold
affaire-chaba.com
rosency.xyz
somethingform.site
digitalpursuitsonline.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1512-141-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1512-147-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/720-150-0x0000000000330000-0x000000000035F000-memory.dmp formbook behavioral2/memory/720-154-0x0000000000330000-0x000000000035F000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
049 BL DRAFT.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation 049 BL DRAFT.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
049 BL DRAFT.exeRegAsm.exewlanext.exedescription pid process target process PID 4684 set thread context of 1512 4684 049 BL DRAFT.exe RegAsm.exe PID 1512 set thread context of 3032 1512 RegAsm.exe Explorer.EXE PID 720 set thread context of 3032 720 wlanext.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
powershell.exe049 BL DRAFT.exeRegAsm.exewlanext.exepid process 1296 powershell.exe 1296 powershell.exe 4684 049 BL DRAFT.exe 4684 049 BL DRAFT.exe 1512 RegAsm.exe 1512 RegAsm.exe 1512 RegAsm.exe 1512 RegAsm.exe 720 wlanext.exe 720 wlanext.exe 720 wlanext.exe 720 wlanext.exe 720 wlanext.exe 720 wlanext.exe 720 wlanext.exe 720 wlanext.exe 720 wlanext.exe 720 wlanext.exe 720 wlanext.exe 720 wlanext.exe 720 wlanext.exe 720 wlanext.exe 720 wlanext.exe 720 wlanext.exe 720 wlanext.exe 720 wlanext.exe 720 wlanext.exe 720 wlanext.exe 720 wlanext.exe 720 wlanext.exe 720 wlanext.exe 720 wlanext.exe 720 wlanext.exe 720 wlanext.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3032 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegAsm.exewlanext.exepid process 1512 RegAsm.exe 1512 RegAsm.exe 1512 RegAsm.exe 720 wlanext.exe 720 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
049 BL DRAFT.exepowershell.exeRegAsm.exewlanext.exedescription pid process Token: SeDebugPrivilege 4684 049 BL DRAFT.exe Token: SeDebugPrivilege 1296 powershell.exe Token: SeDebugPrivilege 1512 RegAsm.exe Token: SeDebugPrivilege 720 wlanext.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
049 BL DRAFT.exeExplorer.EXEwlanext.exedescription pid process target process PID 4684 wrote to memory of 1296 4684 049 BL DRAFT.exe powershell.exe PID 4684 wrote to memory of 1296 4684 049 BL DRAFT.exe powershell.exe PID 4684 wrote to memory of 1296 4684 049 BL DRAFT.exe powershell.exe PID 4684 wrote to memory of 1512 4684 049 BL DRAFT.exe RegAsm.exe PID 4684 wrote to memory of 1512 4684 049 BL DRAFT.exe RegAsm.exe PID 4684 wrote to memory of 1512 4684 049 BL DRAFT.exe RegAsm.exe PID 4684 wrote to memory of 1512 4684 049 BL DRAFT.exe RegAsm.exe PID 4684 wrote to memory of 1512 4684 049 BL DRAFT.exe RegAsm.exe PID 4684 wrote to memory of 1512 4684 049 BL DRAFT.exe RegAsm.exe PID 3032 wrote to memory of 720 3032 Explorer.EXE wlanext.exe PID 3032 wrote to memory of 720 3032 Explorer.EXE wlanext.exe PID 3032 wrote to memory of 720 3032 Explorer.EXE wlanext.exe PID 720 wrote to memory of 4628 720 wlanext.exe cmd.exe PID 720 wrote to memory of 4628 720 wlanext.exe cmd.exe PID 720 wrote to memory of 4628 720 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\049 BL DRAFT.exe"C:\Users\Admin\AppData\Local\Temp\049 BL DRAFT.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1296 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1512 -
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:4628
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/720-146-0x0000000000000000-mapping.dmp
-
memory/720-154-0x0000000000330000-0x000000000035F000-memory.dmpFilesize
188KB
-
memory/720-152-0x0000000000AC0000-0x0000000000B54000-memory.dmpFilesize
592KB
-
memory/720-150-0x0000000000330000-0x000000000035F000-memory.dmpFilesize
188KB
-
memory/720-149-0x0000000000F10000-0x000000000125A000-memory.dmpFilesize
3.3MB
-
memory/720-148-0x0000000000650000-0x0000000000667000-memory.dmpFilesize
92KB
-
memory/1296-136-0x0000000005450000-0x00000000054B6000-memory.dmpFilesize
408KB
-
memory/1296-135-0x0000000004D00000-0x0000000004D66000-memory.dmpFilesize
408KB
-
memory/1296-138-0x0000000007310000-0x000000000798A000-memory.dmpFilesize
6.5MB
-
memory/1296-139-0x0000000006120000-0x000000000613A000-memory.dmpFilesize
104KB
-
memory/1296-131-0x0000000000000000-mapping.dmp
-
memory/1296-137-0x0000000005C00000-0x0000000005C1E000-memory.dmpFilesize
120KB
-
memory/1296-132-0x0000000004680000-0x00000000046B6000-memory.dmpFilesize
216KB
-
memory/1296-133-0x0000000004DB0000-0x00000000053D8000-memory.dmpFilesize
6.2MB
-
memory/1296-134-0x0000000004B60000-0x0000000004B82000-memory.dmpFilesize
136KB
-
memory/1512-141-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1512-147-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1512-144-0x0000000000F60000-0x0000000000F75000-memory.dmpFilesize
84KB
-
memory/1512-142-0x0000000002CC0000-0x000000000300A000-memory.dmpFilesize
3.3MB
-
memory/1512-140-0x0000000000000000-mapping.dmp
-
memory/3032-145-0x0000000007C60000-0x0000000007D95000-memory.dmpFilesize
1.2MB
-
memory/3032-153-0x0000000007DA0000-0x0000000007EF8000-memory.dmpFilesize
1.3MB
-
memory/3032-155-0x0000000007DA0000-0x0000000007EF8000-memory.dmpFilesize
1.3MB
-
memory/4628-151-0x0000000000000000-mapping.dmp
-
memory/4684-130-0x0000000000F60000-0x0000000000F90000-memory.dmpFilesize
192KB