Analysis
-
max time kernel
150s -
max time network
86s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 19:37
Behavioral task
behavioral1
Sample
ORDER_29741.exe
Resource
win7v20201028
General
-
Target
ORDER_29741.exe
-
Size
395KB
-
MD5
b9c6aad2753d835eefeeae486fac18ba
-
SHA1
f2744185e692cedec652edb07b8a174c34e9f327
-
SHA256
e3f68e3679fc2ab587e712ce137e107318ebaa6bd5e724a76200bb10c945312b
-
SHA512
1856ee344f1fecd55dc7823f0eb6c1999bd65a244da100b1fbf0550c9a7188c099854bf664f192a71b578a8ce5342854e1934fb2b8522082bc9412b23751fb1d
Malware Config
Extracted
formbook
http://www.nyoxibwer.com/20w/
cofounder.technology
mrbajaf.com
xn--w9s874cfjq5fk.com
haliciogluhali.net
vanessadunfordhere.com
lookguy.win
91javac.com
goldennd.com
nwatheeliteteam.net
tumpukganda.com
clarservicios.com
koghana.com
workingwithroland.com
yellowsocialbox.com
under-dawg.com
sdtjtzyz.com
banditaerialproductions.com
newssmog.com
tefnmp.men
rebelialabel.com
shubhankarthinks.com
weldlngwarehouseinc.com
cxwlkjgs.com
sfbtadvertising.com
just-climb-it.com
abigailstales.net
erreapeworld.com
ujoi0cb3td.com
adhitshet.com
loi-mezard-invest.com
shimanami-guesthouse.com
5bu3.com
koszr.info
shopgoperinnovation.com
matthiasdittert.com
stiffeducation.com
projectoverflowinc.com
v5rayp.club
dqklfr.info
jacobsonfordl.com
chicagobps.biz
bsateenalsharq.com
238bifa.com
kairui.ink
lai2151.com
simplysavvysolutions.com
watertable.win
robotica.tech
avggrfx.com
teleportcafe.com
712roofing.com
07hosting.com
quiltlux.com
implantcyrkonowy.com
gnbaccelerator.com
negusangel.com
best1caratdiamondrings.com
elizabethlampertpr.net
pinpointlocalsacramento.com
skinstradesarea.com
morganhelps.com
divarium.com
njswd.com
bfmjgame.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1808-68-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/1808-69-0x000000000041B680-mapping.dmp formbook behavioral1/memory/1848-70-0x0000000000000000-mapping.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1392 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
ORDER_29741.exeORDER_29741.exemstsc.exedescription pid process target process PID 1916 set thread context of 1808 1916 ORDER_29741.exe ORDER_29741.exe PID 1808 set thread context of 1196 1808 ORDER_29741.exe Explorer.EXE PID 1848 set thread context of 1196 1848 mstsc.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
ORDER_29741.exemstsc.exepid process 1808 ORDER_29741.exe 1808 ORDER_29741.exe 1848 mstsc.exe 1848 mstsc.exe 1848 mstsc.exe 1848 mstsc.exe 1848 mstsc.exe 1848 mstsc.exe 1848 mstsc.exe 1848 mstsc.exe 1848 mstsc.exe 1848 mstsc.exe 1848 mstsc.exe 1848 mstsc.exe 1848 mstsc.exe 1848 mstsc.exe 1848 mstsc.exe 1848 mstsc.exe 1848 mstsc.exe 1848 mstsc.exe 1848 mstsc.exe 1848 mstsc.exe 1848 mstsc.exe 1848 mstsc.exe 1848 mstsc.exe 1848 mstsc.exe 1848 mstsc.exe 1848 mstsc.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
ORDER_29741.exemstsc.exepid process 1808 ORDER_29741.exe 1808 ORDER_29741.exe 1808 ORDER_29741.exe 1848 mstsc.exe 1848 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
ORDER_29741.exeORDER_29741.exemstsc.exedescription pid process Token: SeDebugPrivilege 1916 ORDER_29741.exe Token: SeDebugPrivilege 1808 ORDER_29741.exe Token: SeDebugPrivilege 1848 mstsc.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ORDER_29741.exepid process 1916 ORDER_29741.exe 1916 ORDER_29741.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
ORDER_29741.exeExplorer.EXEmstsc.exedescription pid process target process PID 1916 wrote to memory of 1808 1916 ORDER_29741.exe ORDER_29741.exe PID 1916 wrote to memory of 1808 1916 ORDER_29741.exe ORDER_29741.exe PID 1916 wrote to memory of 1808 1916 ORDER_29741.exe ORDER_29741.exe PID 1916 wrote to memory of 1808 1916 ORDER_29741.exe ORDER_29741.exe PID 1916 wrote to memory of 1808 1916 ORDER_29741.exe ORDER_29741.exe PID 1916 wrote to memory of 1808 1916 ORDER_29741.exe ORDER_29741.exe PID 1916 wrote to memory of 1808 1916 ORDER_29741.exe ORDER_29741.exe PID 1196 wrote to memory of 1848 1196 Explorer.EXE mstsc.exe PID 1196 wrote to memory of 1848 1196 Explorer.EXE mstsc.exe PID 1196 wrote to memory of 1848 1196 Explorer.EXE mstsc.exe PID 1196 wrote to memory of 1848 1196 Explorer.EXE mstsc.exe PID 1848 wrote to memory of 1392 1848 mstsc.exe cmd.exe PID 1848 wrote to memory of 1392 1848 mstsc.exe cmd.exe PID 1848 wrote to memory of 1392 1848 mstsc.exe cmd.exe PID 1848 wrote to memory of 1392 1848 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ORDER_29741.exe"C:\Users\Admin\AppData\Local\Temp\ORDER_29741.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ORDER_29741.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ORDER_29741.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1392-72-0x0000000000000000-mapping.dmp
-
memory/1808-68-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1808-69-0x000000000041B680-mapping.dmp
-
memory/1848-70-0x0000000000000000-mapping.dmp
-
memory/1848-71-0x0000000000230000-0x0000000000334000-memory.dmpFilesize
1.0MB
-
memory/1848-73-0x0000000001F80000-0x000000000203E000-memory.dmpFilesize
760KB
-
memory/1968-67-0x000007FEF7D20000-0x000007FEF7F9A000-memory.dmpFilesize
2.5MB