Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2022 17:43
Static task
static1
Behavioral task
behavioral1
Sample
Orden de Compra Urgente.exe
Resource
win7-20220715-en
General
-
Target
Orden de Compra Urgente.exe
-
Size
757KB
-
MD5
96d65af8738de30dfa2283585f11e1e1
-
SHA1
fce536c32341baad02ba836a06688ab9f60193b9
-
SHA256
a69ee77f4eb102a3528594435748d3a1e2925022a6d986eac8d32feb068c1f36
-
SHA512
99364f2a86bb7a10e57642ad176195df04a746cb2e25d3b2562228f61192634ccec3668b008b141a3fb6864fb6f6608dff3721e96613eb31aaf65e5cb5b204ca
Malware Config
Extracted
formbook
4.1
de08
retirecloudyyard.com
fabiyan.xyz
chrisarlyde.com
selapex.com
vivalosgales.com
specialty-medicine.com
contasesolucoes.com
satunusanews.net
allyibc.com
alameda1876.com
artofdala.com
yukoidusp.xyz
steeldrumbandnearme.com
stonewedgetechnology.com
kentonai.com
macquarie-private.com
ddgwy.com
megagreenhousekits.com
descomplicaomarketing.com
inclusiverealtor.com
themummyfront.club
computerfashiondesigns.com
ericparlatore.com
whathappened2me.com
baksomail.xyz
mugupplatform.com
shopsolutely.com
gymcservices.com
qianshunchina.com
zoomsbshab.icu
esrmtech.com
966211.com
stockinsidepr.com
df-wh.com
smartshopapps.com
kayseriadsl.com
acedesserts.com
205qs.com
ei8i.com
aibtly.com
kpviewllc.net
nnehandebol.com
torontonianapparel.ca
therealgoldenganjagang.com
mingxiang99.com
rewkagcompany.xyz
ahmee4.com
valen.info
vacuumfun.parts
fabiyan.xyz
psncareersolutions.com
escobargroups.com
michigandice.com
ey3solutions.com
li-n.info
puingkehancuran.xyz
bilt-green.com
dfysuitetech.xyz
abdoomar.com
actsaka.xyz
justsweatitout.com
axabank.life
billyyaka.com
mypatchtools.com
epulsive.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4536-142-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4536-156-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1608-162-0x0000000000D80000-0x0000000000DAF000-memory.dmp formbook behavioral2/memory/1608-168-0x0000000000D80000-0x0000000000DAF000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Orden de Compra Urgente.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation Orden de Compra Urgente.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Orden de Compra Urgente.exeRegSvcs.exeraserver.exedescription pid process target process PID 4548 set thread context of 4536 4548 Orden de Compra Urgente.exe RegSvcs.exe PID 4536 set thread context of 2688 4536 RegSvcs.exe Explorer.EXE PID 1608 set thread context of 2688 1608 raserver.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
powershell.exeRegSvcs.exeraserver.exepid process 2016 powershell.exe 4536 RegSvcs.exe 4536 RegSvcs.exe 4536 RegSvcs.exe 4536 RegSvcs.exe 2016 powershell.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe 1608 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2688 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exeraserver.exepid process 4536 RegSvcs.exe 4536 RegSvcs.exe 4536 RegSvcs.exe 1608 raserver.exe 1608 raserver.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
powershell.exeRegSvcs.exeraserver.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 2016 powershell.exe Token: SeDebugPrivilege 4536 RegSvcs.exe Token: SeDebugPrivilege 1608 raserver.exe Token: SeShutdownPrivilege 2688 Explorer.EXE Token: SeCreatePagefilePrivilege 2688 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Orden de Compra Urgente.exepid process 4548 Orden de Compra Urgente.exe 4548 Orden de Compra Urgente.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Orden de Compra Urgente.exeExplorer.EXEraserver.exedescription pid process target process PID 4548 wrote to memory of 2016 4548 Orden de Compra Urgente.exe powershell.exe PID 4548 wrote to memory of 2016 4548 Orden de Compra Urgente.exe powershell.exe PID 4548 wrote to memory of 2016 4548 Orden de Compra Urgente.exe powershell.exe PID 4548 wrote to memory of 376 4548 Orden de Compra Urgente.exe schtasks.exe PID 4548 wrote to memory of 376 4548 Orden de Compra Urgente.exe schtasks.exe PID 4548 wrote to memory of 376 4548 Orden de Compra Urgente.exe schtasks.exe PID 4548 wrote to memory of 4536 4548 Orden de Compra Urgente.exe RegSvcs.exe PID 4548 wrote to memory of 4536 4548 Orden de Compra Urgente.exe RegSvcs.exe PID 4548 wrote to memory of 4536 4548 Orden de Compra Urgente.exe RegSvcs.exe PID 4548 wrote to memory of 4536 4548 Orden de Compra Urgente.exe RegSvcs.exe PID 4548 wrote to memory of 4536 4548 Orden de Compra Urgente.exe RegSvcs.exe PID 4548 wrote to memory of 4536 4548 Orden de Compra Urgente.exe RegSvcs.exe PID 2688 wrote to memory of 1608 2688 Explorer.EXE raserver.exe PID 2688 wrote to memory of 1608 2688 Explorer.EXE raserver.exe PID 2688 wrote to memory of 1608 2688 Explorer.EXE raserver.exe PID 1608 wrote to memory of 1364 1608 raserver.exe cmd.exe PID 1608 wrote to memory of 1364 1608 raserver.exe cmd.exe PID 1608 wrote to memory of 1364 1608 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Orden de Compra Urgente.exe"C:\Users\Admin\AppData\Local\Temp\Orden de Compra Urgente.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qBdLBxat.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qBdLBxat" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3548.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3548.tmpFilesize
1KB
MD5565e7a9d710212970f137c277300647c
SHA1eebb75b746776f673c22a5ac08436daf1a84ee59
SHA2568f27231f9f1c38c75de540b35e9d4203fd204235cec5eaecad8f3741b205680b
SHA512723a0bf2a22e1df53b1441acf307da56350ff5fd5c4619ee74923713c4dc587f4dcbaa8a45e036100f8143ad92ab13dc90a6af7243c3fb4dd639b1569ad6bac3
-
memory/376-137-0x0000000000000000-mapping.dmp
-
memory/1364-159-0x0000000000000000-mapping.dmp
-
memory/1608-168-0x0000000000D80000-0x0000000000DAF000-memory.dmpFilesize
188KB
-
memory/1608-166-0x0000000002CA0000-0x0000000002D33000-memory.dmpFilesize
588KB
-
memory/1608-162-0x0000000000D80000-0x0000000000DAF000-memory.dmpFilesize
188KB
-
memory/1608-161-0x0000000002E00000-0x000000000314A000-memory.dmpFilesize
3.3MB
-
memory/1608-160-0x0000000000C60000-0x0000000000C7F000-memory.dmpFilesize
124KB
-
memory/1608-155-0x0000000000000000-mapping.dmp
-
memory/2016-158-0x0000000007C00000-0x0000000007C96000-memory.dmpFilesize
600KB
-
memory/2016-153-0x0000000007FC0000-0x000000000863A000-memory.dmpFilesize
6.5MB
-
memory/2016-163-0x0000000007BB0000-0x0000000007BBE000-memory.dmpFilesize
56KB
-
memory/2016-157-0x00000000079F0000-0x00000000079FA000-memory.dmpFilesize
40KB
-
memory/2016-143-0x00000000056B0000-0x00000000056D2000-memory.dmpFilesize
136KB
-
memory/2016-144-0x0000000005FB0000-0x0000000006016000-memory.dmpFilesize
408KB
-
memory/2016-146-0x0000000006680000-0x000000000669E000-memory.dmpFilesize
120KB
-
memory/2016-165-0x0000000007CA0000-0x0000000007CA8000-memory.dmpFilesize
32KB
-
memory/2016-140-0x0000000005910000-0x0000000005F38000-memory.dmpFilesize
6.2MB
-
memory/2016-164-0x0000000007CC0000-0x0000000007CDA000-memory.dmpFilesize
104KB
-
memory/2016-150-0x0000000006C70000-0x0000000006CA2000-memory.dmpFilesize
200KB
-
memory/2016-151-0x0000000070B80000-0x0000000070BCC000-memory.dmpFilesize
304KB
-
memory/2016-152-0x0000000006C30000-0x0000000006C4E000-memory.dmpFilesize
120KB
-
memory/2016-136-0x0000000000000000-mapping.dmp
-
memory/2016-154-0x0000000007980000-0x000000000799A000-memory.dmpFilesize
104KB
-
memory/2016-138-0x0000000002D80000-0x0000000002DB6000-memory.dmpFilesize
216KB
-
memory/2688-149-0x0000000008920000-0x0000000008AA9000-memory.dmpFilesize
1.5MB
-
memory/2688-167-0x0000000008AB0000-0x0000000008C1D000-memory.dmpFilesize
1.4MB
-
memory/2688-169-0x0000000008AB0000-0x0000000008C1D000-memory.dmpFilesize
1.4MB
-
memory/4536-148-0x00000000010C0000-0x00000000010D4000-memory.dmpFilesize
80KB
-
memory/4536-156-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4536-147-0x0000000001100000-0x000000000144A000-memory.dmpFilesize
3.3MB
-
memory/4536-142-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4536-141-0x0000000000000000-mapping.dmp
-
memory/4548-135-0x000000000B330000-0x000000000B396000-memory.dmpFilesize
408KB
-
memory/4548-134-0x0000000008800000-0x000000000889C000-memory.dmpFilesize
624KB
-
memory/4548-133-0x0000000004CE0000-0x0000000004CEA000-memory.dmpFilesize
40KB
-
memory/4548-130-0x00000000001B0000-0x0000000000272000-memory.dmpFilesize
776KB
-
memory/4548-132-0x0000000004C30000-0x0000000004CC2000-memory.dmpFilesize
584KB
-
memory/4548-131-0x00000000052F0000-0x0000000005894000-memory.dmpFilesize
5.6MB