Analysis
- max time kernel
145s - max time network
138s - platform
windows10_x64 - resource
win10 - submitted
16/08/2020, 13:56
Static task
static1
Behavioral task
behavioral1
Sample
offer order.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target offer order.exe
- Size 1.6MB
- Sample200816-79qsfn5rmn
- SHA256 c0307fdf9dcf72e69b33cb4327608c3d27bc5a26ce4552a1eae074f2557482dc
- MD5 285273676607fd7b36bde1127b76d153
- SHA1 d058bd70b5bfa4cfea2aba116600b54193858b4d
- SHA512 6c01b44838ea66e0d466d15740485cb068313b70e94be301de788682542f8c2d6771e1caa9b8dfbd5f316682ffef0c7ee3e5ff0d9f940b1f0c62435a0177c2ec
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.joomlas123.info/n7ak/
Decoy
-
audereventur.com
-
huro14.com
-
wwwjinsha155.com
-
antiquevendor.com
-
samuraisoulfood.net
-
traffic4updates.download
-
hypersarv.com
-
rapport-happy-wedding.com
-
rokutechnosupport.online
-
allworljob.com
-
hanaleedossmann.com
-
kauai-marathon.com
-
bepbosch.com
-
kangen-international.com
-
zoneshopemenowz.com
-
belviderewrestling.com
-
ipllink.com
-
sellingforcreators.com
-
wwwswty6655.com
-
qtumboa.com
-
bazarmoney.net
-
librosdecienciaficcion.com
-
shopmomsthebomb.com
-
vanjacob.com
-
tgyaa.com
-
theporncollective.net
-
hydrabadproperties.com
-
brindesecologicos.com
-
sayagayrimenkul.net
-
4btoken.com
-
shycedu.com
-
overall789.top
-
maison-pierre-bayle.com
-
elitemediamasters.com
-
sharmasfabrics.com
-
hoshamp.com
-
myultimateleadgenerator.com
-
office4u.info
-
thaimart1.com
-
ultimatewindowusa.com
-
twoblazesartworks.com
-
airteloffer.com
-
shoupaizhao.com
-
741dakotadr.info
-
books4arab.net
-
artedelcioccolato.biz
-
tjqcu.info
-
teccoop.net
-
maturebridesdressguide.com
-
excelcapfunding.com
-
bitcoinak.com
-
profileorderflow.com
-
unbelievabowboutique.com
-
midlandshomesolutionsltd.com
-
healthywithhook.com
-
stirlingpiper.com
-
manfast.online
-
arikorin.com
-
texastrustedinsurance.com
-
moodandmystery.com
-
yh77808.com
-
s-immotanger.com
-
runzexd.com
-
meteoannecy.net
Signatures
- Formbook Payload 4 IoCs
resource yara_rule behavioral2/memory/3068-2-0x0000000010410000-0x000000001043D000-memory.dmp formbook behavioral2/memory/3068-2-0x0000000010410000-0x000000001043D000-memory.dmp formbook behavioral2/memory/3000-3-0x0000000000000000-mapping.dmp formbook behavioral2/memory/3012-4-0x0000000000000000-mapping.dmp formbook - Adds policy Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wlanext.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run wlanext.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\NDIXWNLX7V = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" wlanext.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3000 set thread context of 3016 3000 ieinstal.exe 56 PID 3012 set thread context of 3016 3012 wlanext.exe 56 -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wlanext.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 offer order.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030106082b0601050507030706082b0601050507030206082b0601050507030406082b0601050507030353000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e offer order.exe - Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 3000 ieinstal.exe 3000 ieinstal.exe 3000 ieinstal.exe 3000 ieinstal.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 3000 ieinstal.exe 3000 ieinstal.exe 3000 ieinstal.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe 3012 wlanext.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 3000 ieinstal.exe Token: SeDebugPrivilege 3012 wlanext.exe Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3016 Explorer.EXE 3016 Explorer.EXE - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3016 Explorer.EXE 3016 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3068 wrote to memory of 3000 3068 offer order.exe 67 PID 3068 wrote to memory of 3000 3068 offer order.exe 67 PID 3068 wrote to memory of 3000 3068 offer order.exe 67 PID 3068 wrote to memory of 3000 3068 offer order.exe 67 PID 3068 wrote to memory of 3000 3068 offer order.exe 67 PID 3068 wrote to memory of 3000 3068 offer order.exe 67 PID 3016 wrote to memory of 3012 3016 Explorer.EXE 68 PID 3016 wrote to memory of 3012 3016 Explorer.EXE 68 PID 3016 wrote to memory of 3012 3016 Explorer.EXE 68 PID 3012 wrote to memory of 3988 3012 wlanext.exe 69 PID 3012 wrote to memory of 3988 3012 wlanext.exe 69 PID 3012 wrote to memory of 3988 3012 wlanext.exe 69 PID 3012 wrote to memory of 4004 3012 wlanext.exe 71 PID 3012 wrote to memory of 4004 3012 wlanext.exe 71 PID 3012 wrote to memory of 4004 3012 wlanext.exe 71
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\offer order.exe"C:\Users\Admin\AppData\Local\Temp\offer order.exe"2⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3000
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3988
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:4004
-
-