Analysis
-
max time kernel
152s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
08-12-2022 16:17
Static task
static1
Behavioral task
behavioral1
Sample
http___185.246.221.143_pl2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
http___185.246.221.143_pl2.exe
Resource
win10v2004-20221111-en
General
-
Target
http___185.246.221.143_pl2.exe
-
Size
266KB
-
MD5
f919de1034edc7b8a4a5a8aa8f0067dd
-
SHA1
ce50421738d5fb3108fe147dfdea5733fb01e19e
-
SHA256
81ce31f6f3cd9a6a6037c411a1485bee35eaa93965fc6ccc2bd857c991fcad90
-
SHA512
946fafde24bf34a659d8df5bcd0db2ff3791b92c0fd36d96a9273436bbc75244cfb26cc9bf00d86370fc92d13d3e791905bc8f8fe97eb74e1ea3b556cd649b70
-
SSDEEP
6144:MtXZXPanzcQUuLgsNG0BPspB4nAFmklJB:Mtsz5DLgsp5ngDlj
Malware Config
Extracted
formbook
4.1
d06c
douglasdetoledopiza.com
yxcc.online
primo.llc
mediamomos.com
cosmetiq-pro.com
22labs.tech
turbowashing.com
lindaivell.site
princess-bed.club
groundget.cfd
agretaminiousa.com
lomoni.com
nessesse.us
lexgo.cloud
halilsener.xyz
kirokubo.cloud
corotip.sbs
meghq.net
5y6s.world
weasib.online
threelights.tokyo
brownandbrowniplaw.net
watchomesafe.xyz
ky4468.com
nonhodgkinslymphoma.space
promaster.africa
lightypn.tech
dqhongyan.com
66880.love
ncloud.tech
jdpipes.info
yaman-style.com
ky8257.com
watercoolerbot.com
medyspace.xyz
historicalstones.com
ecobrain.biz
tvebaoxz.com
droveit.net
haoloi.skin
iyzwux.xyz
formula5.online
fourseasonsapparelstore.com
matrix158.com
donkeysforsale.net
foozitive.com
curcumabrasil.online
sest-m5eg.net
abkirtoogooni.club
tinttheory.com
digitalfp.online
mrsestudio.store
report-24.com
protectific.com
deovolenteventures.com
tanizaon.website
workastrology.com
kiwifarms.life
6scout.net
vj238.vip
urbanproject.app
adjqodjqw.top
clubtripsite.com
zoe-dev.click
theconciergepeople.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1064-71-0x0000000000400000-0x0000000001462000-memory.dmp formbook behavioral1/memory/1064-72-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1064-77-0x0000000000401000-0x0000000001462000-memory.dmp formbook behavioral1/memory/1688-86-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook -
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
http___185.246.221.143_pl2.exehttp___185.246.221.143_pl2.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe http___185.246.221.143_pl2.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe http___185.246.221.143_pl2.exe -
Loads dropped DLL 1 IoCs
Processes:
http___185.246.221.143_pl2.exepid process 1704 http___185.246.221.143_pl2.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
http___185.246.221.143_pl2.exepid process 1064 http___185.246.221.143_pl2.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
http___185.246.221.143_pl2.exehttp___185.246.221.143_pl2.exepid process 1704 http___185.246.221.143_pl2.exe 1064 http___185.246.221.143_pl2.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
http___185.246.221.143_pl2.exehttp___185.246.221.143_pl2.exedescription pid process target process PID 1704 set thread context of 1064 1704 http___185.246.221.143_pl2.exe http___185.246.221.143_pl2.exe PID 1064 set thread context of 1248 1064 http___185.246.221.143_pl2.exe Explorer.EXE PID 1064 set thread context of 1248 1064 http___185.246.221.143_pl2.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
http___185.246.221.143_pl2.exemsdt.exepid process 1064 http___185.246.221.143_pl2.exe 1064 http___185.246.221.143_pl2.exe 1064 http___185.246.221.143_pl2.exe 1688 msdt.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
http___185.246.221.143_pl2.exehttp___185.246.221.143_pl2.exepid process 1704 http___185.246.221.143_pl2.exe 1064 http___185.246.221.143_pl2.exe 1064 http___185.246.221.143_pl2.exe 1064 http___185.246.221.143_pl2.exe 1064 http___185.246.221.143_pl2.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
http___185.246.221.143_pl2.exeExplorer.EXEmsdt.exedescription pid process Token: SeDebugPrivilege 1064 http___185.246.221.143_pl2.exe Token: SeShutdownPrivilege 1248 Explorer.EXE Token: SeDebugPrivilege 1688 msdt.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
http___185.246.221.143_pl2.exeExplorer.EXEdescription pid process target process PID 1704 wrote to memory of 1064 1704 http___185.246.221.143_pl2.exe http___185.246.221.143_pl2.exe PID 1704 wrote to memory of 1064 1704 http___185.246.221.143_pl2.exe http___185.246.221.143_pl2.exe PID 1704 wrote to memory of 1064 1704 http___185.246.221.143_pl2.exe http___185.246.221.143_pl2.exe PID 1704 wrote to memory of 1064 1704 http___185.246.221.143_pl2.exe http___185.246.221.143_pl2.exe PID 1704 wrote to memory of 1064 1704 http___185.246.221.143_pl2.exe http___185.246.221.143_pl2.exe PID 1248 wrote to memory of 1688 1248 Explorer.EXE msdt.exe PID 1248 wrote to memory of 1688 1248 Explorer.EXE msdt.exe PID 1248 wrote to memory of 1688 1248 Explorer.EXE msdt.exe PID 1248 wrote to memory of 1688 1248 Explorer.EXE msdt.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\http___185.246.221.143_pl2.exe"C:\Users\Admin\AppData\Local\Temp\http___185.246.221.143_pl2.exe"2⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\http___185.246.221.143_pl2.exe"C:\Users\Admin\AppData\Local\Temp\http___185.246.221.143_pl2.exe"3⤵
- Checks QEMU agent file
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1064 -
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1688 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\http___185.246.221.143_pl2.exe"3⤵PID:1988
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nst7C26.tmp\System.dllFilesize
11KB
MD57399323923e3946fe9140132ac388132
SHA1728257d06c452449b1241769b459f091aabcffc5
SHA2565a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
SHA512d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1
-
memory/1064-62-0x0000000000400000-0x0000000001462000-memory.dmpFilesize
16.4MB
-
memory/1064-83-0x00000000772A0000-0x0000000077420000-memory.dmpFilesize
1.5MB
-
memory/1064-82-0x00000000001C0000-0x00000000002C0000-memory.dmpFilesize
1024KB
-
memory/1064-78-0x0000000000080000-0x0000000000094000-memory.dmpFilesize
80KB
-
memory/1064-61-0x0000000000403358-mapping.dmp
-
memory/1064-73-0x000000001D290000-0x000000001D593000-memory.dmpFilesize
3.0MB
-
memory/1064-77-0x0000000000401000-0x0000000001462000-memory.dmpFilesize
16.4MB
-
memory/1064-64-0x00000000001C0000-0x00000000002C0000-memory.dmpFilesize
1024KB
-
memory/1064-74-0x000000001CF20000-0x000000001CF34000-memory.dmpFilesize
80KB
-
memory/1064-66-0x00000000001C0000-0x00000000002C0000-memory.dmpFilesize
1024KB
-
memory/1064-67-0x00000000770C0000-0x0000000077269000-memory.dmpFilesize
1.7MB
-
memory/1064-70-0x00000000772A0000-0x0000000077420000-memory.dmpFilesize
1.5MB
-
memory/1064-71-0x0000000000400000-0x0000000001462000-memory.dmpFilesize
16.4MB
-
memory/1064-72-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1248-79-0x0000000007350000-0x000000000748B000-memory.dmpFilesize
1.2MB
-
memory/1248-75-0x0000000004B10000-0x0000000004BD6000-memory.dmpFilesize
792KB
-
memory/1248-84-0x0000000007350000-0x000000000748B000-memory.dmpFilesize
1.2MB
-
memory/1688-80-0x0000000000000000-mapping.dmp
-
memory/1688-87-0x00000000021D0000-0x00000000024D3000-memory.dmpFilesize
3.0MB
-
memory/1688-86-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB
-
memory/1688-85-0x00000000007D0000-0x00000000008C4000-memory.dmpFilesize
976KB
-
memory/1704-63-0x00000000772A0000-0x0000000077420000-memory.dmpFilesize
1.5MB
-
memory/1704-57-0x00000000770C0000-0x0000000077269000-memory.dmpFilesize
1.7MB
-
memory/1704-56-0x0000000003640000-0x000000000379C000-memory.dmpFilesize
1.4MB
-
memory/1704-54-0x00000000752B1000-0x00000000752B3000-memory.dmpFilesize
8KB
-
memory/1704-59-0x00000000772A0000-0x0000000077420000-memory.dmpFilesize
1.5MB
-
memory/1704-65-0x00000000772A0000-0x0000000077420000-memory.dmpFilesize
1.5MB
-
memory/1704-76-0x00000000772A0000-0x0000000077420000-memory.dmpFilesize
1.5MB