Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
23-11-2022 10:55
Static task
static1
General
-
Target
44b473195e8f495f9e53899badaabf0e164b52ec3cc3d73be3c59cc5c570ccd1.exe
-
Size
442KB
-
MD5
ac9f7c1ebdf2d688c3f9b7ff82bf4c0a
-
SHA1
b5a0a41c6b3059a93effa972c8f2641192419445
-
SHA256
44b473195e8f495f9e53899badaabf0e164b52ec3cc3d73be3c59cc5c570ccd1
-
SHA512
2b47a0ef4cd5fbc5996dc77a773396146509f7b321ba327190fb16581c33cb0dcaf73b15986b8ff69e0f1b43da97cef84f397d076fd6ba9b35e0b7285485800a
-
SSDEEP
6144:iyEa0sZPLivhZvzkUIRkPQD97qEIb+Qz5W45y/fIXoQGFGtcSsYYL:is4T7wk4VqvKQpEYG5SsLL
Malware Config
Extracted
formbook
4.1
lt63
fortrantelecom.africa
ffafa.buzz
bullybrain.com
ekeisolutions.com
lamiamira.com
noahsark.xyz
beautyby-eve.com
cloudfatory.com
12443.football
hataykultur.online
donqu3.sexy
breakthroughaustralia.com
havengpe.com
cpxlocatup.info
corefourpartners.com
amonefintech.com
thithombo.africa
bassmaty.store
fdshdsr.top
lifesoapsimple.com
divaproportugal.com
footwearbags.com
ivbusinessservices.com
93215.vip
livescorenona123.online
ablulu109.xyz
chuyunfang.com
fogofwar.quest
weimingpian.net
getmowico.com
hability.xyz
brightmachineary.com
precious-sawdaa.com
nochewing.net
fruihcon.xyz
hue-fame.com
egordizain.ru
tutastrading.africa
deansroofingandconstruction.com
arabianroadstech.com
family-doctor-41501.com
233969.com
9898svip1.com
yonggunkim.net
illminded.com
gemlikguventasevdeneve.com
fiberlazertamir.com
kimia.boo
skinnectar.uk
leve-tech.co.uk
just3pages.com
wristnoe.co.uk
e-suxiu.com
evri-deiivery.com
storageredbox.net
grdpy.com
darkblissclothing.com
functionful.com
bestinvestorcorporation.info
com-prostaclear.com
91yqm.com
districthvacs.com
floridasoftware.biz
cocredcaixaaqui.com
gooqoo.xyz
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/4532-215-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/4532-225-0x0000000001100000-0x000000000124A000-memory.dmp formbook behavioral1/memory/4532-229-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1168-251-0x0000000003200000-0x000000000322F000-memory.dmp formbook behavioral1/memory/1168-262-0x0000000003200000-0x000000000322F000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
Processes:
ttiun.exettiun.exepid process 4904 ttiun.exe 4532 ttiun.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
ttiun.exettiun.execmmon32.exedescription pid process target process PID 4904 set thread context of 4532 4904 ttiun.exe ttiun.exe PID 4532 set thread context of 2676 4532 ttiun.exe Explorer.EXE PID 1168 set thread context of 2676 1168 cmmon32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
ttiun.execmmon32.exepid process 4532 ttiun.exe 4532 ttiun.exe 4532 ttiun.exe 4532 ttiun.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe 1168 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2676 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
ttiun.exettiun.execmmon32.exepid process 4904 ttiun.exe 4532 ttiun.exe 4532 ttiun.exe 4532 ttiun.exe 1168 cmmon32.exe 1168 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
ttiun.execmmon32.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4532 ttiun.exe Token: SeDebugPrivilege 1168 cmmon32.exe Token: SeShutdownPrivilege 2676 Explorer.EXE Token: SeCreatePagefilePrivilege 2676 Explorer.EXE Token: SeShutdownPrivilege 2676 Explorer.EXE Token: SeCreatePagefilePrivilege 2676 Explorer.EXE Token: SeShutdownPrivilege 2676 Explorer.EXE Token: SeCreatePagefilePrivilege 2676 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
44b473195e8f495f9e53899badaabf0e164b52ec3cc3d73be3c59cc5c570ccd1.exettiun.exeExplorer.EXEcmmon32.exedescription pid process target process PID 2512 wrote to memory of 4904 2512 44b473195e8f495f9e53899badaabf0e164b52ec3cc3d73be3c59cc5c570ccd1.exe ttiun.exe PID 2512 wrote to memory of 4904 2512 44b473195e8f495f9e53899badaabf0e164b52ec3cc3d73be3c59cc5c570ccd1.exe ttiun.exe PID 2512 wrote to memory of 4904 2512 44b473195e8f495f9e53899badaabf0e164b52ec3cc3d73be3c59cc5c570ccd1.exe ttiun.exe PID 4904 wrote to memory of 4532 4904 ttiun.exe ttiun.exe PID 4904 wrote to memory of 4532 4904 ttiun.exe ttiun.exe PID 4904 wrote to memory of 4532 4904 ttiun.exe ttiun.exe PID 4904 wrote to memory of 4532 4904 ttiun.exe ttiun.exe PID 2676 wrote to memory of 1168 2676 Explorer.EXE cmmon32.exe PID 2676 wrote to memory of 1168 2676 Explorer.EXE cmmon32.exe PID 2676 wrote to memory of 1168 2676 Explorer.EXE cmmon32.exe PID 1168 wrote to memory of 3064 1168 cmmon32.exe cmd.exe PID 1168 wrote to memory of 3064 1168 cmmon32.exe cmd.exe PID 1168 wrote to memory of 3064 1168 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\44b473195e8f495f9e53899badaabf0e164b52ec3cc3d73be3c59cc5c570ccd1.exe"C:\Users\Admin\AppData\Local\Temp\44b473195e8f495f9e53899badaabf0e164b52ec3cc3d73be3c59cc5c570ccd1.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ttiun.exe"C:\Users\Admin\AppData\Local\Temp\ttiun.exe" C:\Users\Admin\AppData\Local\Temp\jkbyqpmwpn.myo3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ttiun.exe"C:\Users\Admin\AppData\Local\Temp\ttiun.exe" C:\Users\Admin\AppData\Local\Temp\jkbyqpmwpn.myo4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ttiun.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\gguamexvo.lwFilesize
185KB
MD5a5a31158bfe067c0ba04e5e4f95f4053
SHA11c1335feb34f7b6753a4d4fcc229d5c9eda16fcd
SHA256f5b7b47ee862ad199a4b84ea0f070b51515695eb7212ffa16f56ac96144d82a0
SHA51225bdca3d77882f7ec5d9baa9b74d17f7351f2d2dde40719391df68e0a61b3de1b6d65c8a82a67484a3040f1602118d061ad96eacc191dcc9e229d04ce4df896e
-
C:\Users\Admin\AppData\Local\Temp\jkbyqpmwpn.myoFilesize
5KB
MD58437e8a1212106edf1df72ef5b70e141
SHA173ab9b54361194615030d530e33746593ad0b73d
SHA25600981090f59108d62f1330be78e684b3a40b75ea2da27eb95904a471d4764943
SHA512823692591cea509967ee97be1e4b7078aa0fba3de222d6794ef94a638a2d56ae8641d0e333cf7de87d768d3401d2ce82b6e27fb457a731fa5572aa1c280198d3
-
C:\Users\Admin\AppData\Local\Temp\ttiun.exeFilesize
30KB
MD5cb9b2eec89472e53b529a2abbea610d3
SHA176a747cbfdd15c81d7df9cae1b6c6daf21f488c9
SHA256c1357d9479a40910d2c6030b58905e263ae821b1132617059df13d9a2dd0960a
SHA512da5c56cd1e3c069a9cc8943867e754575fc767c5a2d85c752b8a0af444a5161d7c4f12121c6ef4ee484979baa1cc42f1ddf89e6d9dc89e88a9977dc85d739d52
-
C:\Users\Admin\AppData\Local\Temp\ttiun.exeFilesize
30KB
MD5cb9b2eec89472e53b529a2abbea610d3
SHA176a747cbfdd15c81d7df9cae1b6c6daf21f488c9
SHA256c1357d9479a40910d2c6030b58905e263ae821b1132617059df13d9a2dd0960a
SHA512da5c56cd1e3c069a9cc8943867e754575fc767c5a2d85c752b8a0af444a5161d7c4f12121c6ef4ee484979baa1cc42f1ddf89e6d9dc89e88a9977dc85d739d52
-
C:\Users\Admin\AppData\Local\Temp\ttiun.exeFilesize
30KB
MD5cb9b2eec89472e53b529a2abbea610d3
SHA176a747cbfdd15c81d7df9cae1b6c6daf21f488c9
SHA256c1357d9479a40910d2c6030b58905e263ae821b1132617059df13d9a2dd0960a
SHA512da5c56cd1e3c069a9cc8943867e754575fc767c5a2d85c752b8a0af444a5161d7c4f12121c6ef4ee484979baa1cc42f1ddf89e6d9dc89e88a9977dc85d739d52
-
memory/1168-262-0x0000000003200000-0x000000000322F000-memory.dmpFilesize
188KB
-
memory/1168-260-0x0000000004AF0000-0x0000000004B83000-memory.dmpFilesize
588KB
-
memory/1168-258-0x0000000004730000-0x0000000004A50000-memory.dmpFilesize
3.1MB
-
memory/1168-250-0x00000000001D0000-0x00000000001DC000-memory.dmpFilesize
48KB
-
memory/1168-251-0x0000000003200000-0x000000000322F000-memory.dmpFilesize
188KB
-
memory/1168-227-0x0000000000000000-mapping.dmp
-
memory/2512-157-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-151-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-128-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-129-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-130-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-131-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-132-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-133-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-134-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-135-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-136-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-137-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-138-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-139-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-140-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-141-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-142-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-143-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-144-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-146-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-145-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-148-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-147-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-149-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-150-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-125-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-152-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-153-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-154-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-155-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-156-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-126-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-158-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-159-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-160-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-124-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-120-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-127-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-123-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-121-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2512-122-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/2676-261-0x00000000068F0000-0x0000000006A59000-memory.dmpFilesize
1.4MB
-
memory/2676-263-0x00000000068F0000-0x0000000006A59000-memory.dmpFilesize
1.4MB
-
memory/2676-226-0x0000000006260000-0x0000000006404000-memory.dmpFilesize
1.6MB
-
memory/3064-252-0x0000000000000000-mapping.dmp
-
memory/4532-201-0x000000000041F0B0-mapping.dmp
-
memory/4532-229-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4532-225-0x0000000001100000-0x000000000124A000-memory.dmpFilesize
1.3MB
-
memory/4532-217-0x0000000001910000-0x0000000001C30000-memory.dmpFilesize
3.1MB
-
memory/4532-215-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4904-166-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4904-181-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4904-179-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4904-177-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4904-182-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4904-184-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4904-180-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4904-178-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4904-176-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4904-175-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4904-174-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4904-173-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4904-167-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4904-172-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4904-170-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4904-171-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4904-168-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4904-161-0x0000000000000000-mapping.dmp
-
memory/4904-165-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4904-163-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4904-164-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4904-183-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4904-185-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4904-186-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB