Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 16:33
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.DropperX-gen.276.10448.exe
Resource
win7-20220812-en
General
-
Target
SecuriteInfo.com.Win32.DropperX-gen.276.10448.exe
-
Size
6KB
-
MD5
4568108633c246c348b7a6179f1eef10
-
SHA1
622978f85eafdd79be410d47551c0098bd924400
-
SHA256
3f999fa0a43425869e768d6ca75c3e5a70dd34e475cdd20ee240076c6ed75749
-
SHA512
70933c4ec2a44e4ed4d17745c19d3282094e965b2b3327f76af2810f861e51aa7f98602d1467668bf6be449d11db03ff4ce528a407b559042e7a785eae910209
-
SSDEEP
48:6LV5MbckIQXCIsN+nK/M1DIMAGd45hJpLOj4dd2xyiXii2qBHruul4dG7FWSfbNM:RckVaNd/KoGoJa4mhiNktGGFzNt
Malware Config
Extracted
formbook
4.1
fs44
whneat.com
jljcw.net
pocodelivery.com
outofplacezine.com
yavuzcansigorta.com
xinhewood-cn.com
cartogogh.com
5avis.com
joyceyong.art
digitalsurf.community
blackcreekbarns.com
magazinedistribuidor.com
sportsgross.com
drevom.online
mayibeofservice.com
gareloi-digit.com
permitha.net
renaissanceestetica.com
facts-r-friends.com
dach-loc.com
thezuki.xyz
cerradoforte.com
yunjin-band.com
soleirasun.com
stoneyinsideout.com
a-sprut.store
verdistar.com
hivingly.com
trywork.net
bvpropertymanagement.com
calibrationprofessionals.com
mpalmcoffee.com
polygons-stakes.site
themomerator.com
payrollserviceform.com
luyensex.club
elon-drop.net
bluechipblog.com
suaempresaemcasa.com
experimentalcircus.art
vietnamesecuisines.com
i4zlyv.com
b23q.xyz
quantumap.com
sana-poratal.site
eastcoastguardfl.com
maxwell-caspar.com
pontochavelocacoes.com
nitsmm.site
tiffanyrockdesign.com
dgmlsubscribers.com
cybericonsultancy.com
bankssy.com
cxitsolution.com
summerinthepark2022.com
chainadmere.com
quangdecalshop.com
winagency.net
motorworks.tech
huefa.club
mthoodviewlodge.com
bahisaltv79.com
codeforge.pro
dpd-gasplumbingandheating.com
echoesdesing.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4972-145-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4972-151-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3452-153-0x0000000000D00000-0x0000000000D2F000-memory.dmp formbook behavioral2/memory/3452-156-0x0000000000D00000-0x0000000000D2F000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SecuriteInfo.com.Win32.DropperX-gen.276.10448.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation SecuriteInfo.com.Win32.DropperX-gen.276.10448.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
SecuriteInfo.com.Win32.DropperX-gen.276.10448.exeMSBuild.exechkdsk.exedescription pid process target process PID 1952 set thread context of 4972 1952 SecuriteInfo.com.Win32.DropperX-gen.276.10448.exe MSBuild.exe PID 4972 set thread context of 2756 4972 MSBuild.exe Explorer.EXE PID 3452 set thread context of 2756 3452 chkdsk.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
powershell.exeMSBuild.exechkdsk.exepid process 1004 powershell.exe 1004 powershell.exe 4972 MSBuild.exe 4972 MSBuild.exe 4972 MSBuild.exe 4972 MSBuild.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe 3452 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2756 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
MSBuild.exechkdsk.exepid process 4972 MSBuild.exe 4972 MSBuild.exe 4972 MSBuild.exe 3452 chkdsk.exe 3452 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
SecuriteInfo.com.Win32.DropperX-gen.276.10448.exepowershell.exeMSBuild.exechkdsk.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1952 SecuriteInfo.com.Win32.DropperX-gen.276.10448.exe Token: SeDebugPrivilege 1004 powershell.exe Token: SeDebugPrivilege 4972 MSBuild.exe Token: SeDebugPrivilege 3452 chkdsk.exe Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
SecuriteInfo.com.Win32.DropperX-gen.276.10448.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1952 wrote to memory of 1004 1952 SecuriteInfo.com.Win32.DropperX-gen.276.10448.exe powershell.exe PID 1952 wrote to memory of 1004 1952 SecuriteInfo.com.Win32.DropperX-gen.276.10448.exe powershell.exe PID 1952 wrote to memory of 1004 1952 SecuriteInfo.com.Win32.DropperX-gen.276.10448.exe powershell.exe PID 1952 wrote to memory of 4972 1952 SecuriteInfo.com.Win32.DropperX-gen.276.10448.exe MSBuild.exe PID 1952 wrote to memory of 4972 1952 SecuriteInfo.com.Win32.DropperX-gen.276.10448.exe MSBuild.exe PID 1952 wrote to memory of 4972 1952 SecuriteInfo.com.Win32.DropperX-gen.276.10448.exe MSBuild.exe PID 1952 wrote to memory of 4972 1952 SecuriteInfo.com.Win32.DropperX-gen.276.10448.exe MSBuild.exe PID 1952 wrote to memory of 4972 1952 SecuriteInfo.com.Win32.DropperX-gen.276.10448.exe MSBuild.exe PID 1952 wrote to memory of 4972 1952 SecuriteInfo.com.Win32.DropperX-gen.276.10448.exe MSBuild.exe PID 2756 wrote to memory of 3452 2756 Explorer.EXE chkdsk.exe PID 2756 wrote to memory of 3452 2756 Explorer.EXE chkdsk.exe PID 2756 wrote to memory of 3452 2756 Explorer.EXE chkdsk.exe PID 3452 wrote to memory of 3500 3452 chkdsk.exe cmd.exe PID 3452 wrote to memory of 3500 3452 chkdsk.exe cmd.exe PID 3452 wrote to memory of 3500 3452 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DropperX-gen.276.10448.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DropperX-gen.276.10448.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe purecrypter.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1004-136-0x0000000000000000-mapping.dmp
-
memory/1004-137-0x0000000004C10000-0x0000000004C46000-memory.dmpFilesize
216KB
-
memory/1004-138-0x0000000005280000-0x00000000058A8000-memory.dmpFilesize
6.2MB
-
memory/1004-139-0x0000000005960000-0x00000000059C6000-memory.dmpFilesize
408KB
-
memory/1004-140-0x0000000005B80000-0x0000000005BE6000-memory.dmpFilesize
408KB
-
memory/1004-141-0x0000000006190000-0x00000000061AE000-memory.dmpFilesize
120KB
-
memory/1004-142-0x00000000077C0000-0x0000000007E3A000-memory.dmpFilesize
6.5MB
-
memory/1004-143-0x00000000066A0000-0x00000000066BA000-memory.dmpFilesize
104KB
-
memory/1952-132-0x0000000000840000-0x0000000000848000-memory.dmpFilesize
32KB
-
memory/1952-133-0x00000000070F0000-0x0000000007182000-memory.dmpFilesize
584KB
-
memory/1952-134-0x0000000007740000-0x0000000007CE4000-memory.dmpFilesize
5.6MB
-
memory/1952-135-0x00000000071C0000-0x00000000071E2000-memory.dmpFilesize
136KB
-
memory/2756-187-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-176-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-205-0x0000000007B70000-0x0000000007B80000-memory.dmpFilesize
64KB
-
memory/2756-204-0x0000000007B70000-0x0000000007B80000-memory.dmpFilesize
64KB
-
memory/2756-149-0x0000000002F30000-0x0000000003091000-memory.dmpFilesize
1.4MB
-
memory/2756-203-0x0000000007B70000-0x0000000007B80000-memory.dmpFilesize
64KB
-
memory/2756-202-0x0000000007B70000-0x0000000007B80000-memory.dmpFilesize
64KB
-
memory/2756-201-0x0000000007B70000-0x0000000007B80000-memory.dmpFilesize
64KB
-
memory/2756-200-0x0000000007B70000-0x0000000007B80000-memory.dmpFilesize
64KB
-
memory/2756-199-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-198-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-197-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-196-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-158-0x0000000003320000-0x0000000003415000-memory.dmpFilesize
980KB
-
memory/2756-159-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-160-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-161-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-162-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-163-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-164-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-165-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-166-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-167-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-168-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-169-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-170-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-171-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-172-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-173-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-174-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-175-0x0000000003320000-0x0000000003415000-memory.dmpFilesize
980KB
-
memory/2756-195-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-177-0x0000000003120000-0x0000000003130000-memory.dmpFilesize
64KB
-
memory/2756-179-0x0000000008310000-0x0000000008320000-memory.dmpFilesize
64KB
-
memory/2756-178-0x0000000008310000-0x0000000008320000-memory.dmpFilesize
64KB
-
memory/2756-180-0x0000000008310000-0x0000000008320000-memory.dmpFilesize
64KB
-
memory/2756-181-0x0000000008310000-0x0000000008320000-memory.dmpFilesize
64KB
-
memory/2756-182-0x0000000008310000-0x0000000008320000-memory.dmpFilesize
64KB
-
memory/2756-183-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-184-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-185-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-186-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-194-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-188-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-189-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-190-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-191-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-192-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-193-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/3452-157-0x00000000012F0000-0x0000000001383000-memory.dmpFilesize
588KB
-
memory/3452-156-0x0000000000D00000-0x0000000000D2F000-memory.dmpFilesize
188KB
-
memory/3452-154-0x00000000015B0000-0x00000000018FA000-memory.dmpFilesize
3.3MB
-
memory/3452-153-0x0000000000D00000-0x0000000000D2F000-memory.dmpFilesize
188KB
-
memory/3452-152-0x0000000000030000-0x000000000003A000-memory.dmpFilesize
40KB
-
memory/3452-150-0x0000000000000000-mapping.dmp
-
memory/3500-155-0x0000000000000000-mapping.dmp
-
memory/4972-144-0x0000000000000000-mapping.dmp
-
memory/4972-145-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4972-151-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4972-148-0x0000000001AA0000-0x0000000001AB4000-memory.dmpFilesize
80KB
-
memory/4972-147-0x0000000001750000-0x0000000001A9A000-memory.dmpFilesize
3.3MB