Analysis
-
max time kernel
149s -
max time network
44s -
platform
windows7_x64 -
resource
win7 -
submitted
28-10-2020 07:50
Static task
static1
Behavioral task
behavioral1
Sample
New Order2922 & Inquiry.exe
Resource
win7
General
-
Target
New Order2922 & Inquiry.exe
-
Size
325KB
-
MD5
5af741e9c6b6cdb708a61026db90e451
-
SHA1
28f970bffc61d21ba560d24f7b944383b72b5bb9
-
SHA256
eb4e7cd83e6986a52a3ad673a6994c6e917dd6bc70adfbccdf2c1a5348b72a0b
-
SHA512
91ac168add92a3717cef7db22f810d4ab67e56570303e8f7f66a3e4f20f3afdca4150c282166ecb8d0ebaeac6c9cc5df09a897e5883184e7ce2ce5248cb49d18
Malware Config
Extracted
formbook
http://www.mahallagate.com/g09b/
poultryconservancy.com
theafterdarkcafe.com
falkenranger.com
sahafideccan.com
domlikevista.com
kensbackhoeservice.com
helpmefindaplan.com
feedbackcounselling.com
brandbrights.com
guiefer.com
sharkwithdraw.com
iamfeelingmyself.com
hauteandcood.com
phoenixnewhomesales.com
floratend.com
multipanelyaceros.com
yuceyasi.com
cqweihz.com
sitiobemviver.com
meugovapp.com
heartlymap.com
qualitypetsbeds.com
argeliaponceinteriorismo.com
mullersurminski.com
5adsfbstyerdbvshfge.xyz
candidatesupto71.viajes
ciiiko.com
varpartners.com
buddhisto.com
universolofi.com
willowsageevents.com
cabane-de-raisin.com
avancehomes.com
aabs59.com
nylyy.ltd
keenstore.online
pathsiteofficial.com
revolvedistribution.com
esteticafinuras.com
rajasthanimovies.com
darkerheavens.com
stevebana.xyz
ivonovanti.com
yourpaints.com
mislove.net
systemupdetkasserller.com
remainsilentnolonger.com
yingkou-tex.com
iartadvisor.com
mychartatminuteclinic.com
alnahdaschools.com
mangu.digital
zhuhaihz.com
rpesamregistration.com
paypal-relief.com
myfirstpoint.com
hfjxsm.com
essentialehome.com
urbanprepllc.com
prime1dentalimplants.com
trackspotrelocation.com
idahandyman.com
multimedic-peru.com
lifiasitaly.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1072-5-0x0000000000400000-0x000000000045E000-memory.dmp formbook behavioral1/memory/1072-6-0x000000000041ED30-mapping.dmp formbook behavioral1/memory/1428-10-0x0000000000000000-mapping.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1544 cmd.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
Processes:
New Order2922 & Inquiry.exepid process 1084 New Order2922 & Inquiry.exe 1084 New Order2922 & Inquiry.exe 1084 New Order2922 & Inquiry.exe 1084 New Order2922 & Inquiry.exe 1084 New Order2922 & Inquiry.exe 1084 New Order2922 & Inquiry.exe 1084 New Order2922 & Inquiry.exe 1084 New Order2922 & Inquiry.exe 1084 New Order2922 & Inquiry.exe 1084 New Order2922 & Inquiry.exe 1084 New Order2922 & Inquiry.exe 1084 New Order2922 & Inquiry.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
New Order2922 & Inquiry.exeNew Order2922 & Inquiry.exesvchost.exedescription pid process target process PID 1084 set thread context of 1072 1084 New Order2922 & Inquiry.exe New Order2922 & Inquiry.exe PID 1072 set thread context of 1288 1072 New Order2922 & Inquiry.exe Explorer.EXE PID 1428 set thread context of 1288 1428 svchost.exe Explorer.EXE -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1936 timeout.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
New Order2922 & Inquiry.exeNew Order2922 & Inquiry.exesvchost.exepid process 1084 New Order2922 & Inquiry.exe 1084 New Order2922 & Inquiry.exe 1084 New Order2922 & Inquiry.exe 1072 New Order2922 & Inquiry.exe 1072 New Order2922 & Inquiry.exe 1428 svchost.exe 1428 svchost.exe 1428 svchost.exe 1428 svchost.exe 1428 svchost.exe 1428 svchost.exe 1428 svchost.exe 1428 svchost.exe 1428 svchost.exe 1428 svchost.exe 1428 svchost.exe 1428 svchost.exe 1428 svchost.exe 1428 svchost.exe 1428 svchost.exe 1428 svchost.exe 1428 svchost.exe 1428 svchost.exe 1428 svchost.exe 1428 svchost.exe 1428 svchost.exe 1428 svchost.exe 1428 svchost.exe 1428 svchost.exe 1428 svchost.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
New Order2922 & Inquiry.exesvchost.exepid process 1072 New Order2922 & Inquiry.exe 1072 New Order2922 & Inquiry.exe 1072 New Order2922 & Inquiry.exe 1428 svchost.exe 1428 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
New Order2922 & Inquiry.exeNew Order2922 & Inquiry.exesvchost.exedescription pid process Token: SeDebugPrivilege 1084 New Order2922 & Inquiry.exe Token: SeDebugPrivilege 1072 New Order2922 & Inquiry.exe Token: SeDebugPrivilege 1428 svchost.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
New Order2922 & Inquiry.exeExplorer.EXEsvchost.exedescription pid process target process PID 1084 wrote to memory of 1936 1084 New Order2922 & Inquiry.exe timeout.exe PID 1084 wrote to memory of 1936 1084 New Order2922 & Inquiry.exe timeout.exe PID 1084 wrote to memory of 1936 1084 New Order2922 & Inquiry.exe timeout.exe PID 1084 wrote to memory of 1936 1084 New Order2922 & Inquiry.exe timeout.exe PID 1084 wrote to memory of 1072 1084 New Order2922 & Inquiry.exe New Order2922 & Inquiry.exe PID 1084 wrote to memory of 1072 1084 New Order2922 & Inquiry.exe New Order2922 & Inquiry.exe PID 1084 wrote to memory of 1072 1084 New Order2922 & Inquiry.exe New Order2922 & Inquiry.exe PID 1084 wrote to memory of 1072 1084 New Order2922 & Inquiry.exe New Order2922 & Inquiry.exe PID 1084 wrote to memory of 1072 1084 New Order2922 & Inquiry.exe New Order2922 & Inquiry.exe PID 1084 wrote to memory of 1072 1084 New Order2922 & Inquiry.exe New Order2922 & Inquiry.exe PID 1084 wrote to memory of 1072 1084 New Order2922 & Inquiry.exe New Order2922 & Inquiry.exe PID 1084 wrote to memory of 1072 1084 New Order2922 & Inquiry.exe New Order2922 & Inquiry.exe PID 1288 wrote to memory of 1428 1288 Explorer.EXE svchost.exe PID 1288 wrote to memory of 1428 1288 Explorer.EXE svchost.exe PID 1288 wrote to memory of 1428 1288 Explorer.EXE svchost.exe PID 1288 wrote to memory of 1428 1288 Explorer.EXE svchost.exe PID 1428 wrote to memory of 1544 1428 svchost.exe cmd.exe PID 1428 wrote to memory of 1544 1428 svchost.exe cmd.exe PID 1428 wrote to memory of 1544 1428 svchost.exe cmd.exe PID 1428 wrote to memory of 1544 1428 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New Order2922 & Inquiry.exe"C:\Users\Admin\AppData\Local\Temp\New Order2922 & Inquiry.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout3⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\New Order2922 & Inquiry.exe"C:\Users\Admin\AppData\Local\Temp\New Order2922 & Inquiry.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\New Order2922 & Inquiry.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1072-5-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/1072-6-0x000000000041ED30-mapping.dmp
-
memory/1084-7-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/1084-4-0x0000000005250000-0x00000000052FC000-memory.dmpFilesize
688KB
-
memory/1084-1-0x0000000000890000-0x0000000000891000-memory.dmpFilesize
4KB
-
memory/1084-0-0x0000000074C50000-0x000000007533E000-memory.dmpFilesize
6.9MB
-
memory/1084-8-0x00000000007FA000-0x0000000000822000-memory.dmpFilesize
160KB
-
memory/1084-9-0x00000000007FA000-0x0000000000822000-memory.dmpFilesize
160KB
-
memory/1428-10-0x0000000000000000-mapping.dmp
-
memory/1428-11-0x0000000000340000-0x0000000000348000-memory.dmpFilesize
32KB
-
memory/1428-13-0x0000000003050000-0x00000000031D0000-memory.dmpFilesize
1.5MB
-
memory/1544-12-0x0000000000000000-mapping.dmp
-
memory/1936-3-0x0000000000000000-mapping.dmp