Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
07-12-2022 11:53
Static task
static1
Behavioral task
behavioral1
Sample
e-dekont.html.exe
Resource
win7-20221111-en
General
-
Target
e-dekont.html.exe
-
Size
322KB
-
MD5
55118de0c492e1425cb3ef8f27ed7124
-
SHA1
2d7a0eee423509129264dce5266c13e0c67e21d3
-
SHA256
6e8de74475e365bdd0f573a03266f447a13f30a76cc2c71d14c1fc5607e1ae5d
-
SHA512
b14b1a918f1760558c5cc4437c1d1626f0c77aa28c3f2fae89985dda4f64f426d0a28b9ccee8e6687472f29a914ccf8e710950898ba0f09e484189e1e7bfd407
-
SSDEEP
6144:QBn1X1benXIzx6/7YMovhl5nqvEQqVX8QYaTttAFvnkU/Vdcf757dpqXbUA0hO:gX1aF/7YZ35n4EQq9zyvz/aVZpqXD04
Malware Config
Extracted
formbook
4.1
mi08
mytimebabes.com
ycpxb.com
abdkaplani.com
cloudingersoftech.com
fthfire.xyz
christyna.work
3d-add-on.com
knowyourtechdeals.com
kcl24.com
sepatubiker.com
sunnyboy.live
zrbsq.com
rinpari.com
lesac-berra.com
yes820.com
cnnorman.com
mystichousedv.com
sbobet888auto.com
gawiul.xyz
luispenas.com
whdchb.com
094am.com
fkwjs.xyz
batobo.online
mathswatchbot.com
bereketvadisi.com
additionmovies.xyz
zgqc168.com
xamango.com
1cpi1s0u7qcuj1xus5cg1fezo1k.com
b4xy.top
owicz.com
impulseamtt.com
247plumbers.monster
tradersource.online
decrimatx.com
my-vero.com
zgshdbhy.com
cab24seven.com
adultnnewspalace.com
volpi-venture.com
pixpotengi.link
zzjyswx.xyz
xn--90aiiithifm8h.com
nextdaybannerstands.com
uniquehandicraft.store
securityapp.top
mugexpert.net
magaa.xyz
omegaverse.wiki
owlsomeclothing.com
pegasuspadel.club
d-esig-n.site
alrate.top
simplyhillpisya.monster
mentawaisurfboat.com
nwjfypy.xyz
pgcbl.online
adultarivaj.com
juicyhookahinc.com
thewisestonellc.com
it32mgn.store
coco-vista.com
cremation-services-53998.com
grassi.uno
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1340-64-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1340-69-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1496-72-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/1496-76-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
Processes:
lfjebdgdht.exelfjebdgdht.exepid process 1364 lfjebdgdht.exe 1340 lfjebdgdht.exe -
Loads dropped DLL 2 IoCs
Processes:
e-dekont.html.exelfjebdgdht.exepid process 1528 e-dekont.html.exe 1364 lfjebdgdht.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
lfjebdgdht.exelfjebdgdht.exesystray.exedescription pid process target process PID 1364 set thread context of 1340 1364 lfjebdgdht.exe lfjebdgdht.exe PID 1340 set thread context of 1272 1340 lfjebdgdht.exe Explorer.EXE PID 1340 set thread context of 1272 1340 lfjebdgdht.exe Explorer.EXE PID 1496 set thread context of 1272 1496 systray.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
lfjebdgdht.exesystray.exepid process 1340 lfjebdgdht.exe 1340 lfjebdgdht.exe 1340 lfjebdgdht.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
lfjebdgdht.exelfjebdgdht.exesystray.exepid process 1364 lfjebdgdht.exe 1340 lfjebdgdht.exe 1340 lfjebdgdht.exe 1340 lfjebdgdht.exe 1340 lfjebdgdht.exe 1496 systray.exe 1496 systray.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
lfjebdgdht.exesystray.exedescription pid process Token: SeDebugPrivilege 1340 lfjebdgdht.exe Token: SeDebugPrivilege 1496 systray.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
e-dekont.html.exelfjebdgdht.exeExplorer.EXElfjebdgdht.exesystray.exedescription pid process target process PID 1528 wrote to memory of 1364 1528 e-dekont.html.exe lfjebdgdht.exe PID 1528 wrote to memory of 1364 1528 e-dekont.html.exe lfjebdgdht.exe PID 1528 wrote to memory of 1364 1528 e-dekont.html.exe lfjebdgdht.exe PID 1528 wrote to memory of 1364 1528 e-dekont.html.exe lfjebdgdht.exe PID 1364 wrote to memory of 1340 1364 lfjebdgdht.exe lfjebdgdht.exe PID 1364 wrote to memory of 1340 1364 lfjebdgdht.exe lfjebdgdht.exe PID 1364 wrote to memory of 1340 1364 lfjebdgdht.exe lfjebdgdht.exe PID 1364 wrote to memory of 1340 1364 lfjebdgdht.exe lfjebdgdht.exe PID 1364 wrote to memory of 1340 1364 lfjebdgdht.exe lfjebdgdht.exe PID 1272 wrote to memory of 584 1272 Explorer.EXE systray.exe PID 1272 wrote to memory of 584 1272 Explorer.EXE systray.exe PID 1272 wrote to memory of 584 1272 Explorer.EXE systray.exe PID 1272 wrote to memory of 584 1272 Explorer.EXE systray.exe PID 1340 wrote to memory of 1496 1340 lfjebdgdht.exe systray.exe PID 1340 wrote to memory of 1496 1340 lfjebdgdht.exe systray.exe PID 1340 wrote to memory of 1496 1340 lfjebdgdht.exe systray.exe PID 1340 wrote to memory of 1496 1340 lfjebdgdht.exe systray.exe PID 1496 wrote to memory of 780 1496 systray.exe cmd.exe PID 1496 wrote to memory of 780 1496 systray.exe cmd.exe PID 1496 wrote to memory of 780 1496 systray.exe cmd.exe PID 1496 wrote to memory of 780 1496 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e-dekont.html.exe"C:\Users\Admin\AppData\Local\Temp\e-dekont.html.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lfjebdgdht.exe"C:\Users\Admin\AppData\Local\Temp\lfjebdgdht.exe" C:\Users\Admin\AppData\Local\Temp\neylxsdg.s3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lfjebdgdht.exe"C:\Users\Admin\AppData\Local\Temp\lfjebdgdht.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\lfjebdgdht.exe"6⤵
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\lfjebdgdht.exeFilesize
267KB
MD506663976b57ecf3104bfce3ef0ad9145
SHA1721a0946e77b3a1bdb5a38c574cdcf4fb651aae0
SHA25689a921ca7915d2755043e124b9f90ca9d6580f99f5b14d9325f7efc1077217d3
SHA5128be81a0088b0144999f87a22ad41f175417771e49c261ff0db2c01604b4b04b6038b1750949ab18da33f54b56ae5570874ce75bd9457785fb2814eeb3aec19ee
-
C:\Users\Admin\AppData\Local\Temp\lfjebdgdht.exeFilesize
267KB
MD506663976b57ecf3104bfce3ef0ad9145
SHA1721a0946e77b3a1bdb5a38c574cdcf4fb651aae0
SHA25689a921ca7915d2755043e124b9f90ca9d6580f99f5b14d9325f7efc1077217d3
SHA5128be81a0088b0144999f87a22ad41f175417771e49c261ff0db2c01604b4b04b6038b1750949ab18da33f54b56ae5570874ce75bd9457785fb2814eeb3aec19ee
-
C:\Users\Admin\AppData\Local\Temp\lfjebdgdht.exeFilesize
267KB
MD506663976b57ecf3104bfce3ef0ad9145
SHA1721a0946e77b3a1bdb5a38c574cdcf4fb651aae0
SHA25689a921ca7915d2755043e124b9f90ca9d6580f99f5b14d9325f7efc1077217d3
SHA5128be81a0088b0144999f87a22ad41f175417771e49c261ff0db2c01604b4b04b6038b1750949ab18da33f54b56ae5570874ce75bd9457785fb2814eeb3aec19ee
-
C:\Users\Admin\AppData\Local\Temp\neylxsdg.sFilesize
5KB
MD56129ce51566021467204240af3cac6fa
SHA11bc7e72bd7f1a5fb31e2f70d90f4e3d3d3d8ea24
SHA2563917b4d440bb0ee2ba8f2842a524240a4a84007e0a0ae0b521aeb7dec3b2b35a
SHA5128dc6f7916e107322cd2d25b6f2094816484bf2367dfe3d2b1e1577d09b604539e8c82d54ea3bfebb3ab44b44bb34d3b1da54905710e8353de4930c5f801607ce
-
C:\Users\Admin\AppData\Local\Temp\thiayyv.kvuFilesize
185KB
MD5492e12d6214232a2cf8b202b0d0bdef0
SHA1ba082a23e4e5ae05b648763dc4f65ed612f08e50
SHA2565f5a8c0f4c4e538f7a102ecae8bfb0700a2f3b2198766fd6efedb365d4d1ad11
SHA5128e5625472ec098a301e328b0fb827a77bf3e30f66c4aa0af8fa6e3735b43c655a84bc6fe7e427a0cd0fbd8cb3da6e5a1acee9e577c3f2a5d0c571074485d8d83
-
\Users\Admin\AppData\Local\Temp\lfjebdgdht.exeFilesize
267KB
MD506663976b57ecf3104bfce3ef0ad9145
SHA1721a0946e77b3a1bdb5a38c574cdcf4fb651aae0
SHA25689a921ca7915d2755043e124b9f90ca9d6580f99f5b14d9325f7efc1077217d3
SHA5128be81a0088b0144999f87a22ad41f175417771e49c261ff0db2c01604b4b04b6038b1750949ab18da33f54b56ae5570874ce75bd9457785fb2814eeb3aec19ee
-
\Users\Admin\AppData\Local\Temp\lfjebdgdht.exeFilesize
267KB
MD506663976b57ecf3104bfce3ef0ad9145
SHA1721a0946e77b3a1bdb5a38c574cdcf4fb651aae0
SHA25689a921ca7915d2755043e124b9f90ca9d6580f99f5b14d9325f7efc1077217d3
SHA5128be81a0088b0144999f87a22ad41f175417771e49c261ff0db2c01604b4b04b6038b1750949ab18da33f54b56ae5570874ce75bd9457785fb2814eeb3aec19ee
-
memory/780-75-0x0000000000000000-mapping.dmp
-
memory/1272-67-0x0000000004B60000-0x0000000004CE9000-memory.dmpFilesize
1.5MB
-
memory/1272-79-0x0000000002AA0000-0x0000000002B4F000-memory.dmpFilesize
700KB
-
memory/1272-78-0x0000000002AA0000-0x0000000002B4F000-memory.dmpFilesize
700KB
-
memory/1272-73-0x0000000006DD0000-0x0000000006F6B000-memory.dmpFilesize
1.6MB
-
memory/1340-66-0x0000000000190000-0x00000000001A5000-memory.dmpFilesize
84KB
-
memory/1340-65-0x0000000000AB0000-0x0000000000DB3000-memory.dmpFilesize
3.0MB
-
memory/1340-68-0x00000000002D0000-0x00000000002E5000-memory.dmpFilesize
84KB
-
memory/1340-69-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1340-62-0x000000000041F020-mapping.dmp
-
memory/1340-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1364-56-0x0000000000000000-mapping.dmp
-
memory/1496-70-0x0000000000000000-mapping.dmp
-
memory/1496-74-0x0000000001F30000-0x0000000002233000-memory.dmpFilesize
3.0MB
-
memory/1496-72-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1496-76-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1496-77-0x0000000001DA0000-0x0000000001E34000-memory.dmpFilesize
592KB
-
memory/1496-71-0x0000000000250000-0x0000000000255000-memory.dmpFilesize
20KB
-
memory/1528-54-0x0000000075091000-0x0000000075093000-memory.dmpFilesize
8KB