Analysis
-
max time kernel
145s -
max time network
177s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
29-08-2022 03:36
Static task
static1
Behavioral task
behavioral1
Sample
fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe
Resource
win7-20220812-en
General
-
Target
fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe
-
Size
659KB
-
MD5
f9a3cdc12852c0b905b94e0f349849cf
-
SHA1
550a68569df15cbb6d49bd7acba568b1bec63a4b
-
SHA256
fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48
-
SHA512
b63f19d89e7cb02b91b498095616dbf7f01fe3e4348111754cdebe078167b1bd3157b824967f12143e9e4db25de809c2199195f1b7e83dd249cc3d2f828c89d9
-
SSDEEP
12288:aThFh11R/5PB+/SRHTp70ESIJmNSWGZN2O2KVGgmtapeHuvYaYZ0FK4jHJnJW7yi:gh3P3V970EzmNPGZwyGgmtofpjH6qy
Malware Config
Extracted
formbook
4.1
d27e
lilysbusride.com
cloud-sechs.com
danpro.co.uk
wendoortech.com
playgroundrebellion.com
betventures.xyz
digimediasolution.net
abrahambetrayedus.com
whinefree.com
realeurolicence.com
makelovetrip.com
damediaagency.com
pinaralsan.com
5bobitw.com
shootingkarelia.online
website-staging.pro
manassadhvi.online
bathroomandkitcenking.com
realtormarket.net
dfysupport.com
class-flow.com
migstrip.online
qnacontracting.com
namaste-events.com
yestifications.com
indigoartandclothing.com
resultedu.com
digitalworldp.com
phase7assured.com
hirejar.site
leadstosuccessdental.com
ebooksonline4u.com
prosperbags.com
binarytreetech.com
jenpetronellatattoos.com
purpleduckdesign.net
merceriasen.xyz
shinnadesign.online
perubahantariftransaksi.website
jhanca.site
tacoslawera.com
majorappliancepros.com
kemiandsalam22.com
skipperage.info
tabulose-lust.xyz
wahproducts.com
mcleod.top
acepaintingservice.com
longtaidazong.com
spit2dabeat.com
jthecreator.net
sanhelu00.top
ipcemea.info
uniofilm.com
kitchenbw.space
abiccreats.com
southamptonvac.com
zavodalabda.xyz
mahahills.com
careers01-cxeinc.com
betteryourfinancial.info
buyfarfalla.com
moesoldmine.com
sioreu.com
havehealthybloodsugar.com
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3884-248-0x000000000041F1A0-mapping.dmp formbook behavioral2/memory/3884-270-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exedescription pid process target process PID 2336 set thread context of 3884 2336 fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exepowershell.exepid process 3884 fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe 3884 fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe 944 powershell.exe 944 powershell.exe 944 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 944 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exedescription pid process target process PID 2336 wrote to memory of 944 2336 fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe powershell.exe PID 2336 wrote to memory of 944 2336 fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe powershell.exe PID 2336 wrote to memory of 944 2336 fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe powershell.exe PID 2336 wrote to memory of 1444 2336 fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe schtasks.exe PID 2336 wrote to memory of 1444 2336 fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe schtasks.exe PID 2336 wrote to memory of 1444 2336 fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe schtasks.exe PID 2336 wrote to memory of 3884 2336 fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe PID 2336 wrote to memory of 3884 2336 fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe PID 2336 wrote to memory of 3884 2336 fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe PID 2336 wrote to memory of 3884 2336 fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe PID 2336 wrote to memory of 3884 2336 fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe PID 2336 wrote to memory of 3884 2336 fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe"C:\Users\Admin\AppData\Local\Temp\fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xBxmbh.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:944 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xBxmbh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp324B.tmp"2⤵
- Creates scheduled task(s)
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe"C:\Users\Admin\AppData\Local\Temp\fdcb2fd208c68b8ffde80d26a7e40a3d65f0479ef17ba08af4f9659a3e551d48.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3884
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp324B.tmpFilesize
1KB
MD5024aa4af8b185bf038d65bbf56b1ff17
SHA1c111888c710fcc81c6b2c775850e55561fed3d51
SHA256e19e776b9f9d27953a32d88c322530fd4d3fbb7207b54bb2bf4913b5abec0539
SHA512078c69fa83156053a6e76bec87a9979f278a236abfa5e7170e002f696d9416ceb5e0a0378be52e90e5b125dbd3a52ee536dabf5d4fa0457a100ef77fdac0d383
-
memory/944-293-0x0000000008610000-0x000000000865B000-memory.dmpFilesize
300KB
-
memory/944-532-0x0000000009760000-0x0000000009768000-memory.dmpFilesize
32KB
-
memory/944-311-0x00000000092A0000-0x00000000092BE000-memory.dmpFilesize
120KB
-
memory/944-286-0x0000000007AA0000-0x0000000007AC2000-memory.dmpFilesize
136KB
-
memory/944-310-0x00000000092C0000-0x00000000092F3000-memory.dmpFilesize
204KB
-
memory/944-527-0x0000000009770000-0x000000000978A000-memory.dmpFilesize
104KB
-
memory/944-324-0x00000000097C0000-0x0000000009854000-memory.dmpFilesize
592KB
-
memory/944-297-0x0000000008420000-0x0000000008496000-memory.dmpFilesize
472KB
-
memory/944-265-0x0000000007360000-0x0000000007988000-memory.dmpFilesize
6.2MB
-
memory/944-260-0x0000000006C60000-0x0000000006C96000-memory.dmpFilesize
216KB
-
memory/944-320-0x0000000009600000-0x00000000096A5000-memory.dmpFilesize
660KB
-
memory/944-196-0x0000000000000000-mapping.dmp
-
memory/944-292-0x0000000007B10000-0x0000000007B2C000-memory.dmpFilesize
112KB
-
memory/944-289-0x0000000007DE0000-0x0000000008130000-memory.dmpFilesize
3.3MB
-
memory/944-288-0x0000000007D70000-0x0000000007DD6000-memory.dmpFilesize
408KB
-
memory/944-287-0x0000000007B40000-0x0000000007BA6000-memory.dmpFilesize
408KB
-
memory/1444-198-0x0000000000000000-mapping.dmp
-
memory/2336-159-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-168-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-133-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-134-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-135-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-136-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-137-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-138-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-139-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-140-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-141-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-142-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-143-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-144-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-145-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-146-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-147-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-148-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-149-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-150-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-151-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-152-0x0000000000090000-0x000000000013A000-memory.dmpFilesize
680KB
-
memory/2336-153-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-154-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-155-0x0000000004D90000-0x000000000528E000-memory.dmpFilesize
5.0MB
-
memory/2336-156-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-157-0x0000000004980000-0x0000000004A12000-memory.dmpFilesize
584KB
-
memory/2336-158-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-131-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-160-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-161-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-162-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-163-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-164-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-165-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-166-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-167-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-132-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-169-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-170-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-171-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-172-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-173-0x0000000004A20000-0x0000000004A2A000-memory.dmpFilesize
40KB
-
memory/2336-174-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-175-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-176-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-177-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-178-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-179-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-180-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-181-0x0000000004D70000-0x0000000004D8A000-memory.dmpFilesize
104KB
-
memory/2336-182-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-183-0x000000000A860000-0x000000000A86C000-memory.dmpFilesize
48KB
-
memory/2336-184-0x000000000A900000-0x000000000A988000-memory.dmpFilesize
544KB
-
memory/2336-185-0x000000000AA50000-0x000000000AAEC000-memory.dmpFilesize
624KB
-
memory/2336-186-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-187-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-188-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-189-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-243-0x000000000A9C0000-0x000000000AA04000-memory.dmpFilesize
272KB
-
memory/2336-118-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-119-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-120-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-130-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-129-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-128-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-127-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-126-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-125-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-124-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-123-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-122-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-121-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/3884-272-0x0000000000C30000-0x0000000000F50000-memory.dmpFilesize
3.1MB
-
memory/3884-270-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3884-248-0x000000000041F1A0-mapping.dmp