Analysis
- max time kernel
150s - max time network
142s - platform
windows10_x64 - resource
win10 - submitted
17/08/2020, 05:42
Static task
static1
Behavioral task
behavioral1
Sample
new order inquiry.exe
Resource
win7v200722
windows7_x64
General
- Target new order inquiry.exe
- Size 530KB
- Sample200817-c66f7wsjs6
- SHA256 b1c87bb82c46e28ccb5188475def1c24b3239f0508372163cd75d2abc6eaf049
- MD5 ad53fb0296bc9beba3c63015f90f2821
- SHA1 206548a47e53d5f50bb5bd08a0101f79b96c70c3
- SHA512 3f1e09cc0fbf4dc51f810ac2775b370ee3f1466241dcda26e9e54bed0f2283caad5d5940995a051fa0edec4c0aa69840fa6381d3b10b621741dd69c01dfc0b17
- MD5 SHA1 SHA512
Malware Config
Extracted
-
formbook
-
http://www.yofdyk.com/gbr/
-
webstransfer.com
-
windycity.online
-
xzlrln.com
-
bzplp.loan
-
ps3scenefiles.com
-
leeasy.info
-
utpwqh.info
-
mitchellbomberger.com
-
news3032.construction
-
08je.com
-
tlcequipolatino.com
-
raservicesbiling.com
-
stripesinvestment.com
-
m7token.com
-
megacurioso04.men
-
defineturumbo.com
-
monarchbycomputerease.com
-
matteoclerici.com
-
projectpint.com
-
tonsfortatas.com
-
skybizcorp.net
-
oceahosting.com
-
theskincarebusiness.com
-
sheilainc.com
-
kp613g.info
-
millennialfinances.com
-
tatieandre.com
-
mimik.store
-
oneamericaappeal.net
-
ibmscoach-meral.com
-
jutmfe.info
-
plrpedia.com
-
sry9nfw6d.biz
-
packagelady.win
-
thealzheimersreport.com
-
bpknyhxhnwldaacpv.com
-
objetsconnectes-store.com
-
kristopherforever.com
-
avacationpro.com
-
tayla-corney.com
-
xuhrsw.com
-
pyro-fd.com
-
parstabesh.com
-
tzzzm.com
-
myongcatering.com
-
vismarketingmanagement.com
-
tnmyersdowdie.com
-
freetraffic4updatesall.review
-
energyqrpm.science
-
xuudvq.com
-
zhizhangyun.com
-
craftersguild.online
-
horsemetalwallart.com
-
snelkookpanreclame.com
-
takibito.com
-
xn--53tp1d.com
-
collingswoodlandscaping.com
-
jlionbrands.com
-
jkhasdhjsdaf.com
-
rowletttxroofer.com
-
tooja-gimpo.com
-
kktse.net
-
decibaby.com
-
venicevideography.com
Signatures
- Formbook Payload 4 IoCs
resource yara_rule behavioral2/memory/3920-8-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/3920-8-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/3920-9-0x000000000041E2B0-mapping.dmp formbook behavioral2/memory/3176-12-0x0000000000000000-mapping.dmp formbook - Executes dropped EXE 1 IoCs
pid Process 3920 AddInProcess32.exe - Loads dropped DLL 1 IoCs
pid Process 3704 new order inquiry.exe - Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule behavioral2/memory/3704-3-0x0000000004DC0000-0x0000000004DE1000-memory.dmp agile_net behavioral2/memory/3704-3-0x0000000004DC0000-0x0000000004DE1000-memory.dmp agile_net - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3704 set thread context of 3920 3704 new order inquiry.exe 67 PID 3920 set thread context of 2976 3920 AddInProcess32.exe 56 PID 3176 set thread context of 2976 3176 colorcpl.exe 56 - Suspicious behavior: EnumeratesProcesses 47 IoCs
pid Process 3704 new order inquiry.exe 3704 new order inquiry.exe 3704 new order inquiry.exe 3920 AddInProcess32.exe 3920 AddInProcess32.exe 3920 AddInProcess32.exe 3920 AddInProcess32.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe 3176 colorcpl.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3920 AddInProcess32.exe 3920 AddInProcess32.exe 3920 AddInProcess32.exe 3176 colorcpl.exe 3176 colorcpl.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 3704 new order inquiry.exe Token: SeDebugPrivilege 3920 AddInProcess32.exe Token: SeDebugPrivilege 3176 colorcpl.exe Token: SeShutdownPrivilege 2976 Explorer.EXE Token: SeCreatePagefilePrivilege 2976 Explorer.EXE Token: SeShutdownPrivilege 2976 Explorer.EXE Token: SeCreatePagefilePrivilege 2976 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3704 wrote to memory of 3920 3704 new order inquiry.exe 67 PID 3704 wrote to memory of 3920 3704 new order inquiry.exe 67 PID 3704 wrote to memory of 3920 3704 new order inquiry.exe 67 PID 3704 wrote to memory of 3920 3704 new order inquiry.exe 67 PID 3704 wrote to memory of 3920 3704 new order inquiry.exe 67 PID 3704 wrote to memory of 3920 3704 new order inquiry.exe 67 PID 2976 wrote to memory of 3176 2976 Explorer.EXE 68 PID 2976 wrote to memory of 3176 2976 Explorer.EXE 68 PID 2976 wrote to memory of 3176 2976 Explorer.EXE 68 PID 3176 wrote to memory of 4000 3176 colorcpl.exe 69 PID 3176 wrote to memory of 4000 3176 colorcpl.exe 69 PID 3176 wrote to memory of 4000 3176 colorcpl.exe 69
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\new order inquiry.exe"C:\Users\Admin\AppData\Local\Temp\new order inquiry.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3920
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵PID:4000
-
-