Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-10-2022 17:02
Static task
static1
Behavioral task
behavioral1
Sample
3ab1cc60bd5dca00fc6cad5cf3c0a7cccea610b20027c9db6b45f0b41860fba5.exe
Resource
win7-20220812-en
General
-
Target
3ab1cc60bd5dca00fc6cad5cf3c0a7cccea610b20027c9db6b45f0b41860fba5.exe
-
Size
1.1MB
-
MD5
71415d61dd3a653e017514280a4e05c4
-
SHA1
89bed5f613401c5816f3b22816f84d5f8067db3b
-
SHA256
3ab1cc60bd5dca00fc6cad5cf3c0a7cccea610b20027c9db6b45f0b41860fba5
-
SHA512
971407b4327c3a9fe1ff76f0ec84874522865ae08f338ec0985a1ef78066a59412d323a4a2731d33dec129c89355b7aa95fe36f4425db8ad6ea1151f5b9c2098
-
SSDEEP
24576:UAOcZXcxP61ptWw+avL8pnp3qY7daGAuvZG31RMaas/xmR:CH+tWw+S8D3r70QA3XM9n
Malware Config
Extracted
formbook
4.1
je14
innervisionbuildings.com
theenergysocialite.com
565548.com
panghr.com
onlyonesolutions.com
stjohnzone6.com
cnotes.rest
helfeb.online
xixi-s-inc.club
easilyentered.com
theshopx.store
mrclean-ac.com
miamibeachwateradventures.com
jpearce.co.uk
seseragi-bunkou.com
minimaddie.com
commbank-help-849c3.com
segohandelsonderneming.com
namthanhreal.com
fototerapi.online
your-download.com
klindt.one
sellerscourt.com
francoislambert.store
smokedoutvapes.co.uk
rundacg.com
flavors-and-spices-lyon.com
qifengsuo.com
sunnyislesgardens.com
tunneldutransit.com
restorecodes.website
blast4me.com
bingser.space
co-gpco.com
emporioaliwen.com
mr5g.com
abcp666.com
consulvip.net
sagaming168.info
zjpbhsuz.top
socal-labworx.com
arethaglennevents.com
rafiqsiregar.com
esgh2.com
veirdmusic.com
abzcc.xyz
8065yp.com
dronebazar.com
duetpbr.com
apartamentoslaencantada.com
digigold.info
homedecorsuppliers.com
duenorthrm.com
xmmdsy.com
ddstennessee.com
marmeluz.com
ragnallhess.com
methinelli.com
randomlymetheseer.com
magicgrowthproducts.com
shreejistudio.com
mattress-37684.com
yellyfishfilms.com
www1111cpw.com
tigermedlagroup.com
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/3460-139-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3460-138-0x0000000000000000-mapping.dmp formbook behavioral2/memory/3460-141-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1668-147-0x0000000000110000-0x000000000013F000-memory.dmp formbook behavioral2/memory/1668-152-0x0000000000110000-0x000000000013F000-memory.dmp formbook -
Executes dropped EXE 1 IoCs
Processes:
estrlf.pifpid process 4888 estrlf.pif -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3ab1cc60bd5dca00fc6cad5cf3c0a7cccea610b20027c9db6b45f0b41860fba5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 3ab1cc60bd5dca00fc6cad5cf3c0a7cccea610b20027c9db6b45f0b41860fba5.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
estrlf.pifRegSvcs.exeraserver.exedescription pid process target process PID 4888 set thread context of 3460 4888 estrlf.pif RegSvcs.exe PID 3460 set thread context of 2484 3460 RegSvcs.exe Explorer.EXE PID 1668 set thread context of 2484 1668 raserver.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
RegSvcs.exeraserver.exepid process 3460 RegSvcs.exe 3460 RegSvcs.exe 3460 RegSvcs.exe 3460 RegSvcs.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe 1668 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2484 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exeraserver.exepid process 3460 RegSvcs.exe 3460 RegSvcs.exe 3460 RegSvcs.exe 1668 raserver.exe 1668 raserver.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
RegSvcs.exeExplorer.EXEraserver.exedescription pid process Token: SeDebugPrivilege 3460 RegSvcs.exe Token: SeShutdownPrivilege 2484 Explorer.EXE Token: SeCreatePagefilePrivilege 2484 Explorer.EXE Token: SeShutdownPrivilege 2484 Explorer.EXE Token: SeCreatePagefilePrivilege 2484 Explorer.EXE Token: SeDebugPrivilege 1668 raserver.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
3ab1cc60bd5dca00fc6cad5cf3c0a7cccea610b20027c9db6b45f0b41860fba5.exeestrlf.pifExplorer.EXEraserver.exedescription pid process target process PID 4232 wrote to memory of 4888 4232 3ab1cc60bd5dca00fc6cad5cf3c0a7cccea610b20027c9db6b45f0b41860fba5.exe estrlf.pif PID 4232 wrote to memory of 4888 4232 3ab1cc60bd5dca00fc6cad5cf3c0a7cccea610b20027c9db6b45f0b41860fba5.exe estrlf.pif PID 4232 wrote to memory of 4888 4232 3ab1cc60bd5dca00fc6cad5cf3c0a7cccea610b20027c9db6b45f0b41860fba5.exe estrlf.pif PID 4888 wrote to memory of 2316 4888 estrlf.pif RegSvcs.exe PID 4888 wrote to memory of 2316 4888 estrlf.pif RegSvcs.exe PID 4888 wrote to memory of 2316 4888 estrlf.pif RegSvcs.exe PID 4888 wrote to memory of 3460 4888 estrlf.pif RegSvcs.exe PID 4888 wrote to memory of 3460 4888 estrlf.pif RegSvcs.exe PID 4888 wrote to memory of 3460 4888 estrlf.pif RegSvcs.exe PID 4888 wrote to memory of 3460 4888 estrlf.pif RegSvcs.exe PID 4888 wrote to memory of 3460 4888 estrlf.pif RegSvcs.exe PID 4888 wrote to memory of 3460 4888 estrlf.pif RegSvcs.exe PID 2484 wrote to memory of 1668 2484 Explorer.EXE raserver.exe PID 2484 wrote to memory of 1668 2484 Explorer.EXE raserver.exe PID 2484 wrote to memory of 1668 2484 Explorer.EXE raserver.exe PID 1668 wrote to memory of 4268 1668 raserver.exe cmd.exe PID 1668 wrote to memory of 4268 1668 raserver.exe cmd.exe PID 1668 wrote to memory of 4268 1668 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3ab1cc60bd5dca00fc6cad5cf3c0a7cccea610b20027c9db6b45f0b41860fba5.exe"C:\Users\Admin\AppData\Local\Temp\3ab1cc60bd5dca00fc6cad5cf3c0a7cccea610b20027c9db6b45f0b41860fba5.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\5_29\estrlf.pif"C:\Users\Admin\AppData\Roaming\5_29\estrlf.pif" tvsgb.tls3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\5_29\estrlf.pifFilesize
794KB
MD518e404787e9c044105f5c4bec4600bd8
SHA19f1015bd7f33a6f3c1cc12c0971f51b1adee1939
SHA256e15984dc8ea9627d370c40178676490129427e2dc23499f68c9c65c4386fea12
SHA512c6a1faae524968351b4841665bfe1c5255f7e6c115b7a81a4b6c65626f23f7f15e4bb856914fce15225c33a2e2b6166b3f1f87698895fe0ce4cb084b630c2a5f
-
C:\Users\Admin\AppData\Roaming\5_29\estrlf.pifFilesize
794KB
MD518e404787e9c044105f5c4bec4600bd8
SHA19f1015bd7f33a6f3c1cc12c0971f51b1adee1939
SHA256e15984dc8ea9627d370c40178676490129427e2dc23499f68c9c65c4386fea12
SHA512c6a1faae524968351b4841665bfe1c5255f7e6c115b7a81a4b6c65626f23f7f15e4bb856914fce15225c33a2e2b6166b3f1f87698895fe0ce4cb084b630c2a5f
-
C:\Users\Admin\AppData\Roaming\5_29\gdrqa.icmFilesize
41KB
MD5285afea69a2e1f8aae59a0c748aa2bd8
SHA18a087a497757b6beccf483687fb0d1edec45d3fa
SHA25686aeb596d5962ca2389b1dcc252d0ae7b869b9e6ec319e76a387b0bb16baa910
SHA5122ef2acb9b6377e85e2cf73db99555c91456ecd29dc842dc75f414ff2fbad6667c2c8d0af38a0ffd7a23c7c6a0bb28889671eeb42f61777a0dea85cbfe2cf4404
-
C:\Users\Admin\AppData\Roaming\5_29\tvsgb.tlsFilesize
163.3MB
MD55ad0013bd9927682146d60065da2cc2b
SHA1a3954227b0b6e7d9ca4a8107219eb01b81e5697e
SHA256ee9872a43ecb872238e1bcca27df64b90071816f121d1f1685beec0e01cd5c39
SHA512f931e9cd85481537f2ca25b7aa4ec435a81a9d98beff46b16e2408a84caf2aeeca4cfab1d6b0bd3fdb97a7cbc14186c3afee9935d66915c27a1b26b1739e0ad5
-
C:\Users\Admin\AppData\Roaming\5_29\xaguexgkmu.xvkFilesize
370KB
MD556f43e5edcbdfcf4a7e9b8c09c0d2ba2
SHA11d47312b6eacbf63b04f83a9b4cd2dad238ae17a
SHA256a26e71e81529a9cb7aa276618d014c5275cf3f7c356efb0e6b2308e30727a0fb
SHA5128dd0f07a966aaf0c76fbdbed51184c2d765611128ce9b6e978229dc4954357c78cabef185e636e59827ffb7841913a0d543d60231e1f70aea2d62b0f917eba8a
-
memory/1668-150-0x0000000002050000-0x00000000020E3000-memory.dmpFilesize
588KB
-
memory/1668-152-0x0000000000110000-0x000000000013F000-memory.dmpFilesize
188KB
-
memory/1668-147-0x0000000000110000-0x000000000013F000-memory.dmpFilesize
188KB
-
memory/1668-149-0x0000000002310000-0x000000000265A000-memory.dmpFilesize
3.3MB
-
memory/1668-145-0x0000000000000000-mapping.dmp
-
memory/1668-146-0x00000000005C0000-0x00000000005DF000-memory.dmpFilesize
124KB
-
memory/2484-153-0x0000000008400000-0x00000000084D7000-memory.dmpFilesize
860KB
-
memory/2484-151-0x0000000008400000-0x00000000084D7000-memory.dmpFilesize
860KB
-
memory/2484-144-0x0000000008C10000-0x0000000008D7E000-memory.dmpFilesize
1.4MB
-
memory/3460-143-0x0000000001690000-0x00000000016A4000-memory.dmpFilesize
80KB
-
memory/3460-142-0x00000000019E0000-0x0000000001D2A000-memory.dmpFilesize
3.3MB
-
memory/3460-141-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3460-138-0x0000000000000000-mapping.dmp
-
memory/3460-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4268-148-0x0000000000000000-mapping.dmp
-
memory/4888-132-0x0000000000000000-mapping.dmp