Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
09-12-2022 10:20
Static task
static1
Behavioral task
behavioral1
Sample
Beyan bilgileri.exe
Resource
win7-20220812-en
General
-
Target
Beyan bilgileri.exe
-
Size
320KB
-
MD5
170180f6600397459bd336d784f68d29
-
SHA1
d1a3b3b37326d4f3f229785370a6207d3a4c18cc
-
SHA256
bcb4b428f2487d1dfc2d5f36fdd7f334e7915a5fad15f46835f6a8420002c327
-
SHA512
ddf9d91ce714e3dc0c85df6f98a6e6705730ffaff1cbb1973578a8783db532bb76a455e31c080255e7fcf8693ae860bfac42462823bef912dd59d32ef0c03297
-
SSDEEP
6144:9kwqnbxKVJjrA3CSa/2jgPhOJUoPTJd4U87psxJMUzU:ksS3CSW2GmUoPTcU87pcRw
Malware Config
Extracted
formbook
4.1
tc10
mwigyu.com
sepuluholx.com
nsdigitalagency.com
horrorkore.com
santaclaracoimbrakarate.com
myeternalsummer.com
laosmidnight-lotto.com
haremp.xyz
boyace.top
unusualwithdrawal.com
wildflowerkidsri.com
backlitvps.dev
topwellgas.com
k3nnsworld3.com
wanbang.xyz
cntvc.net
sjcamden.church
pussit24.com
claml.com
statisticsturkey.com
gamebetservice.site
medicfield.com
richardsargeant.com
power-stabilizer.com
xn--budgetarakiralama-isb.com
jizzblow.com
instantphotography.online
sy-kaili.com
procurriengineers.com
tudoffers.store
nc125f.fun
vegangangster.com
paidthinking.com
jzecca.com
hr-energys.com
mnsms.com
thediplomatrealty.com
egenolfmachine.site
kedao.top
serenitisolutions.com
agprograms.tech
sinymp.com
dichoscolombia.com
chancesbetting.com
blackfoxmusicgroup.com
salvoconducto.online
webrangro.com
petsworthy.com
epergun.com
1013637.xyz
raitarantula.com
all-about-chandeliers.com
boothclothingco.com
stfidelis.net
data-science-13819.com
coraphsyicaltherapy.com
hotronixheatpresses.com
bernardnelfadigital.com
monarchmunchies.com
tasbo.online
equity321.com
jesocial.com
dlwhzs.com
twomobi.com
rhondarisley.site
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2016-65-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2016-72-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1440-74-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/1440-79-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
Processes:
sxdjahtyxs.exesxdjahtyxs.exepid process 1072 sxdjahtyxs.exe 2016 sxdjahtyxs.exe -
Loads dropped DLL 3 IoCs
Processes:
Beyan bilgileri.exesxdjahtyxs.exepid process 1220 Beyan bilgileri.exe 1220 Beyan bilgileri.exe 1072 sxdjahtyxs.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
sxdjahtyxs.exesxdjahtyxs.exenetsh.exedescription pid process target process PID 1072 set thread context of 2016 1072 sxdjahtyxs.exe sxdjahtyxs.exe PID 2016 set thread context of 1284 2016 sxdjahtyxs.exe Explorer.EXE PID 2016 set thread context of 1284 2016 sxdjahtyxs.exe Explorer.EXE PID 1440 set thread context of 1284 1440 netsh.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
sxdjahtyxs.exenetsh.exepid process 2016 sxdjahtyxs.exe 2016 sxdjahtyxs.exe 2016 sxdjahtyxs.exe 1440 netsh.exe 1440 netsh.exe 1440 netsh.exe 1440 netsh.exe 1440 netsh.exe 1440 netsh.exe 1440 netsh.exe 1440 netsh.exe 1440 netsh.exe 1440 netsh.exe 1440 netsh.exe 1440 netsh.exe 1440 netsh.exe 1440 netsh.exe 1440 netsh.exe 1440 netsh.exe 1440 netsh.exe 1440 netsh.exe 1440 netsh.exe 1440 netsh.exe 1440 netsh.exe 1440 netsh.exe 1440 netsh.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
sxdjahtyxs.exesxdjahtyxs.exenetsh.exepid process 1072 sxdjahtyxs.exe 2016 sxdjahtyxs.exe 2016 sxdjahtyxs.exe 2016 sxdjahtyxs.exe 2016 sxdjahtyxs.exe 1440 netsh.exe 1440 netsh.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
sxdjahtyxs.exenetsh.exedescription pid process Token: SeDebugPrivilege 2016 sxdjahtyxs.exe Token: SeDebugPrivilege 1440 netsh.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Beyan bilgileri.exesxdjahtyxs.exeExplorer.EXEnetsh.exedescription pid process target process PID 1220 wrote to memory of 1072 1220 Beyan bilgileri.exe sxdjahtyxs.exe PID 1220 wrote to memory of 1072 1220 Beyan bilgileri.exe sxdjahtyxs.exe PID 1220 wrote to memory of 1072 1220 Beyan bilgileri.exe sxdjahtyxs.exe PID 1220 wrote to memory of 1072 1220 Beyan bilgileri.exe sxdjahtyxs.exe PID 1072 wrote to memory of 2016 1072 sxdjahtyxs.exe sxdjahtyxs.exe PID 1072 wrote to memory of 2016 1072 sxdjahtyxs.exe sxdjahtyxs.exe PID 1072 wrote to memory of 2016 1072 sxdjahtyxs.exe sxdjahtyxs.exe PID 1072 wrote to memory of 2016 1072 sxdjahtyxs.exe sxdjahtyxs.exe PID 1072 wrote to memory of 2016 1072 sxdjahtyxs.exe sxdjahtyxs.exe PID 1284 wrote to memory of 1440 1284 Explorer.EXE netsh.exe PID 1284 wrote to memory of 1440 1284 Explorer.EXE netsh.exe PID 1284 wrote to memory of 1440 1284 Explorer.EXE netsh.exe PID 1284 wrote to memory of 1440 1284 Explorer.EXE netsh.exe PID 1440 wrote to memory of 1188 1440 netsh.exe cmd.exe PID 1440 wrote to memory of 1188 1440 netsh.exe cmd.exe PID 1440 wrote to memory of 1188 1440 netsh.exe cmd.exe PID 1440 wrote to memory of 1188 1440 netsh.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\Beyan bilgileri.exe"C:\Users\Admin\AppData\Local\Temp\Beyan bilgileri.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\sxdjahtyxs.exe"C:\Users\Admin\AppData\Local\Temp\sxdjahtyxs.exe" C:\Users\Admin\AppData\Local\Temp\juhfdccvz.zs3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\sxdjahtyxs.exe"C:\Users\Admin\AppData\Local\Temp\sxdjahtyxs.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2016 -
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:1488
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\sxdjahtyxs.exe"3⤵PID:1188
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\crqsdy.sFilesize
185KB
MD508d14e71049e4c2e82035f2e5d166092
SHA1836354041c895bd4e4e77dc0900d5b654db2c669
SHA2560b949d745439686a16dcb7a23dd15a371ac09b0f5d9ad7f66c8520ba1df5947b
SHA5125a2e10693749d254d06ad39f2632766c18af7463e5b9beda95106b022b1c448e44b1861f58358b609d55a248706f4e450a4c87cc956fc6eb377edbb0ab81d16b
-
C:\Users\Admin\AppData\Local\Temp\juhfdccvz.zsFilesize
5KB
MD5af1548c7a4eda52ae9b4440e3aa543a6
SHA1eb4a7522d4b30d89ac3ea451269af04bd34e6578
SHA25668594204c523f2531c8e6d5e2df1369bae0b406179c64cf563389c95f715e777
SHA512ab700a3f4d29c1af8dbb3a84da55192ab11150936c922e3d109e57c7b7f388473c35bf182c32152ca5adaf91792b6f87e18575134d4038a20063368fbc435f80
-
C:\Users\Admin\AppData\Local\Temp\sxdjahtyxs.exeFilesize
276KB
MD572ccf0ff6003ca8af9babe0eb60fc193
SHA1a74d85ff6614e881d427ece7d107d6f0aafaf976
SHA25631341c01ac1463ce0d4aa155ab5dd32eb9e207c00aff341cdfdc8043d8bb2e5a
SHA51259f395e7a54d1a0eb3628d2c89b9b448d46538917a050c8b5fd5c52aeb08da16fe0442e5bd5196ebd338fb149ff446ce1b6daab85f9187425f27f7a2da5be3aa
-
C:\Users\Admin\AppData\Local\Temp\sxdjahtyxs.exeFilesize
276KB
MD572ccf0ff6003ca8af9babe0eb60fc193
SHA1a74d85ff6614e881d427ece7d107d6f0aafaf976
SHA25631341c01ac1463ce0d4aa155ab5dd32eb9e207c00aff341cdfdc8043d8bb2e5a
SHA51259f395e7a54d1a0eb3628d2c89b9b448d46538917a050c8b5fd5c52aeb08da16fe0442e5bd5196ebd338fb149ff446ce1b6daab85f9187425f27f7a2da5be3aa
-
C:\Users\Admin\AppData\Local\Temp\sxdjahtyxs.exeFilesize
276KB
MD572ccf0ff6003ca8af9babe0eb60fc193
SHA1a74d85ff6614e881d427ece7d107d6f0aafaf976
SHA25631341c01ac1463ce0d4aa155ab5dd32eb9e207c00aff341cdfdc8043d8bb2e5a
SHA51259f395e7a54d1a0eb3628d2c89b9b448d46538917a050c8b5fd5c52aeb08da16fe0442e5bd5196ebd338fb149ff446ce1b6daab85f9187425f27f7a2da5be3aa
-
\Users\Admin\AppData\Local\Temp\sxdjahtyxs.exeFilesize
276KB
MD572ccf0ff6003ca8af9babe0eb60fc193
SHA1a74d85ff6614e881d427ece7d107d6f0aafaf976
SHA25631341c01ac1463ce0d4aa155ab5dd32eb9e207c00aff341cdfdc8043d8bb2e5a
SHA51259f395e7a54d1a0eb3628d2c89b9b448d46538917a050c8b5fd5c52aeb08da16fe0442e5bd5196ebd338fb149ff446ce1b6daab85f9187425f27f7a2da5be3aa
-
\Users\Admin\AppData\Local\Temp\sxdjahtyxs.exeFilesize
276KB
MD572ccf0ff6003ca8af9babe0eb60fc193
SHA1a74d85ff6614e881d427ece7d107d6f0aafaf976
SHA25631341c01ac1463ce0d4aa155ab5dd32eb9e207c00aff341cdfdc8043d8bb2e5a
SHA51259f395e7a54d1a0eb3628d2c89b9b448d46538917a050c8b5fd5c52aeb08da16fe0442e5bd5196ebd338fb149ff446ce1b6daab85f9187425f27f7a2da5be3aa
-
\Users\Admin\AppData\Local\Temp\sxdjahtyxs.exeFilesize
276KB
MD572ccf0ff6003ca8af9babe0eb60fc193
SHA1a74d85ff6614e881d427ece7d107d6f0aafaf976
SHA25631341c01ac1463ce0d4aa155ab5dd32eb9e207c00aff341cdfdc8043d8bb2e5a
SHA51259f395e7a54d1a0eb3628d2c89b9b448d46538917a050c8b5fd5c52aeb08da16fe0442e5bd5196ebd338fb149ff446ce1b6daab85f9187425f27f7a2da5be3aa
-
memory/1072-57-0x0000000000000000-mapping.dmp
-
memory/1188-75-0x0000000000000000-mapping.dmp
-
memory/1220-54-0x0000000074D81000-0x0000000074D83000-memory.dmpFilesize
8KB
-
memory/1284-78-0x0000000004410000-0x00000000044E4000-memory.dmpFilesize
848KB
-
memory/1284-80-0x0000000004410000-0x00000000044E4000-memory.dmpFilesize
848KB
-
memory/1284-68-0x0000000006A30000-0x0000000006B52000-memory.dmpFilesize
1.1MB
-
memory/1284-70-0x0000000006C10000-0x0000000006D2D000-memory.dmpFilesize
1.1MB
-
memory/1440-79-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1440-77-0x0000000000A50000-0x0000000000AE3000-memory.dmpFilesize
588KB
-
memory/1440-71-0x0000000000000000-mapping.dmp
-
memory/1440-76-0x0000000002180000-0x0000000002483000-memory.dmpFilesize
3.0MB
-
memory/1440-73-0x0000000000D60000-0x0000000000D7B000-memory.dmpFilesize
108KB
-
memory/1440-74-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/2016-66-0x0000000000810000-0x0000000000B13000-memory.dmpFilesize
3.0MB
-
memory/2016-72-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2016-69-0x0000000000380000-0x0000000000394000-memory.dmpFilesize
80KB
-
memory/2016-67-0x00000000002B0000-0x00000000002C4000-memory.dmpFilesize
80KB
-
memory/2016-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2016-63-0x000000000041F0E0-mapping.dmp