Analysis
- max time kernel
146s - max time network
145s - platform
windows10_x64 - resource
win10 - submitted
18/08/2020, 06:21
Static task
static1
Behavioral task
behavioral1
Sample
Commercial Invoice.exe
Resource
win7v200722
windows7_x64
General
- Target Commercial Invoice.exe
- Size 809KB
- Sample200818-9lfrjp211a
- SHA256 2bde8d605b2ce54ea697cab8be4daff0c2349322b42a96c8a9237ac7eff35314
- MD5 b9acbd74ef64764ea09a0f21eb887ba2
- SHA1 f32bd69bd927e98f13cd6168d2cd75b93bb1c27e
- SHA512 c23f7e7bf3da74af8e3dcd6bc349f46d58eee6c327ce3ab1176fc0d2e0160570c4d43cbde4ab5910e69693cdff48f00faa5e6e7be2aa0c15c8a7f7abe2a6152f
- MD5 SHA1 SHA512
Malware Config
Extracted
-
formbook
-
http://www.regulars5.com/evcy/
-
coolroof26.com
-
branchpcb.com
-
globalstudenthelpline.com
-
beikonwiremesh.com
-
locations-hibscus.com
-
sqhjjs.com
-
delan-africa.com
-
phytphysios.com
-
w662017.com
-
collincountyopenhomeslist.com
-
tianshuimould.com
-
cyberrome.com
-
skydiveteuge.com
-
regalbuildingsupplies.com
-
yes-exports.com
-
dtjrsc.com
-
chaovod.info
-
blissfulcreations.store
-
pascarlmedia.com
-
wirbelstrom.info
-
santaselvesdenver.net
-
peacelovelashes.life
-
roofingscontractors.com
-
4ey7t.com
-
cable-isp-choice.rocks
-
drakorsubindo.site
-
jumel.studio
-
qingdaolianwan.com
-
zahrv.info
-
finchprovisionssolutions.com
-
sealriteinsulation.net
-
labellafirma.com
-
news3044.movie
-
restaurantkilimanjaro.com
-
coniigy.com
-
www274123.com
-
tacoselprecioso.com
-
rabentire.biz
-
4357nlincoln4.info
-
thepet.world
-
mercedesben-thainguyen.com
-
pmtpvt.com
-
whimsically-beautiful.com
-
spdnets.info
-
keeperoftimephotography.com
-
iotcrane.com
-
healthybettermarket.com
-
kozijnen-tilburg.com
-
koisuru-denwa-uranai.com
-
andresanz.photography
-
rave-love.com
-
amoebot.net
-
suespence99.com
-
rebelgirladventure.com
-
rickandmortysupply.com
-
beejson.com
-
aerialcollection.info
-
chinaonus.com
-
malta-expo.com
-
x9031.com
-
55oaks.com
-
usp-labs.com
-
manx065.com
-
breezytrail.com
Signatures
- Formbook Payload 4 IoCs
resource yara_rule behavioral2/memory/3672-0-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/3672-0-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/3672-1-0x000000000041E320-mapping.dmp formbook behavioral2/memory/3952-2-0x0000000000000000-mapping.dmp formbook - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3588 set thread context of 3672 3588 Commercial Invoice.exe 67 PID 3672 set thread context of 2972 3672 Commercial Invoice.exe 56 PID 3672 set thread context of 2972 3672 Commercial Invoice.exe 56 PID 3952 set thread context of 2972 3952 msdt.exe 56 - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3588 Commercial Invoice.exe 3588 Commercial Invoice.exe 3672 Commercial Invoice.exe 3672 Commercial Invoice.exe 3672 Commercial Invoice.exe 3672 Commercial Invoice.exe 3672 Commercial Invoice.exe 3672 Commercial Invoice.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe 3952 msdt.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 3588 Commercial Invoice.exe 3672 Commercial Invoice.exe 3672 Commercial Invoice.exe 3672 Commercial Invoice.exe 3672 Commercial Invoice.exe 3952 msdt.exe 3952 msdt.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 3672 Commercial Invoice.exe Token: SeShutdownPrivilege 2972 Explorer.EXE Token: SeCreatePagefilePrivilege 2972 Explorer.EXE Token: SeDebugPrivilege 3952 msdt.exe Token: SeShutdownPrivilege 2972 Explorer.EXE Token: SeCreatePagefilePrivilege 2972 Explorer.EXE Token: SeShutdownPrivilege 2972 Explorer.EXE Token: SeCreatePagefilePrivilege 2972 Explorer.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2972 Explorer.EXE - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2972 Explorer.EXE - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3588 wrote to memory of 3672 3588 Commercial Invoice.exe 67 PID 3588 wrote to memory of 3672 3588 Commercial Invoice.exe 67 PID 3588 wrote to memory of 3672 3588 Commercial Invoice.exe 67 PID 2972 wrote to memory of 3952 2972 Explorer.EXE 68 PID 2972 wrote to memory of 3952 2972 Explorer.EXE 68 PID 2972 wrote to memory of 3952 2972 Explorer.EXE 68 PID 3952 wrote to memory of 3788 3952 msdt.exe 69 PID 3952 wrote to memory of 3788 3952 msdt.exe 69 PID 3952 wrote to memory of 3788 3952 msdt.exe 69
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\Commercial Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Commercial Invoice.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\Commercial Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Commercial Invoice.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3672
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Commercial Invoice.exe"3⤵PID:3788
-
-