Analysis
-
max time kernel
148s -
max time network
138s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 19:37
Behavioral task
behavioral1
Sample
ORDER_29741.exe
Resource
win7v20201028
General
-
Target
ORDER_29741.exe
-
Size
395KB
-
MD5
b9c6aad2753d835eefeeae486fac18ba
-
SHA1
f2744185e692cedec652edb07b8a174c34e9f327
-
SHA256
e3f68e3679fc2ab587e712ce137e107318ebaa6bd5e724a76200bb10c945312b
-
SHA512
1856ee344f1fecd55dc7823f0eb6c1999bd65a244da100b1fbf0550c9a7188c099854bf664f192a71b578a8ce5342854e1934fb2b8522082bc9412b23751fb1d
Malware Config
Extracted
formbook
http://www.nyoxibwer.com/20w/
cofounder.technology
mrbajaf.com
xn--w9s874cfjq5fk.com
haliciogluhali.net
vanessadunfordhere.com
lookguy.win
91javac.com
goldennd.com
nwatheeliteteam.net
tumpukganda.com
clarservicios.com
koghana.com
workingwithroland.com
yellowsocialbox.com
under-dawg.com
sdtjtzyz.com
banditaerialproductions.com
newssmog.com
tefnmp.men
rebelialabel.com
shubhankarthinks.com
weldlngwarehouseinc.com
cxwlkjgs.com
sfbtadvertising.com
just-climb-it.com
abigailstales.net
erreapeworld.com
ujoi0cb3td.com
adhitshet.com
loi-mezard-invest.com
shimanami-guesthouse.com
5bu3.com
koszr.info
shopgoperinnovation.com
matthiasdittert.com
stiffeducation.com
projectoverflowinc.com
v5rayp.club
dqklfr.info
jacobsonfordl.com
chicagobps.biz
bsateenalsharq.com
238bifa.com
kairui.ink
lai2151.com
simplysavvysolutions.com
watertable.win
robotica.tech
avggrfx.com
teleportcafe.com
712roofing.com
07hosting.com
quiltlux.com
implantcyrkonowy.com
gnbaccelerator.com
negusangel.com
best1caratdiamondrings.com
elizabethlampertpr.net
pinpointlocalsacramento.com
skinstradesarea.com
morganhelps.com
divarium.com
njswd.com
bfmjgame.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/668-2-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/668-3-0x000000000041B680-mapping.dmp formbook behavioral2/memory/1452-5-0x0000000000000000-mapping.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
ORDER_29741.exeORDER_29741.exeraserver.exedescription pid process target process PID 916 set thread context of 668 916 ORDER_29741.exe ORDER_29741.exe PID 668 set thread context of 2784 668 ORDER_29741.exe Explorer.EXE PID 668 set thread context of 2784 668 ORDER_29741.exe Explorer.EXE PID 1452 set thread context of 2784 1452 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
ORDER_29741.exeraserver.exepid process 668 ORDER_29741.exe 668 ORDER_29741.exe 668 ORDER_29741.exe 668 ORDER_29741.exe 668 ORDER_29741.exe 668 ORDER_29741.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe 1452 raserver.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
ORDER_29741.exeraserver.exepid process 668 ORDER_29741.exe 668 ORDER_29741.exe 668 ORDER_29741.exe 668 ORDER_29741.exe 1452 raserver.exe 1452 raserver.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
ORDER_29741.exeORDER_29741.exeraserver.exedescription pid process Token: SeDebugPrivilege 916 ORDER_29741.exe Token: SeDebugPrivilege 668 ORDER_29741.exe Token: SeDebugPrivilege 1452 raserver.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ORDER_29741.exepid process 916 ORDER_29741.exe 916 ORDER_29741.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2784 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ORDER_29741.exeExplorer.EXEraserver.exedescription pid process target process PID 916 wrote to memory of 668 916 ORDER_29741.exe ORDER_29741.exe PID 916 wrote to memory of 668 916 ORDER_29741.exe ORDER_29741.exe PID 916 wrote to memory of 668 916 ORDER_29741.exe ORDER_29741.exe PID 916 wrote to memory of 668 916 ORDER_29741.exe ORDER_29741.exe PID 916 wrote to memory of 668 916 ORDER_29741.exe ORDER_29741.exe PID 916 wrote to memory of 668 916 ORDER_29741.exe ORDER_29741.exe PID 2784 wrote to memory of 1452 2784 Explorer.EXE raserver.exe PID 2784 wrote to memory of 1452 2784 Explorer.EXE raserver.exe PID 2784 wrote to memory of 1452 2784 Explorer.EXE raserver.exe PID 1452 wrote to memory of 2988 1452 raserver.exe cmd.exe PID 1452 wrote to memory of 2988 1452 raserver.exe cmd.exe PID 1452 wrote to memory of 2988 1452 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ORDER_29741.exe"C:\Users\Admin\AppData\Local\Temp\ORDER_29741.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ORDER_29741.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ORDER_29741.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/668-2-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/668-3-0x000000000041B680-mapping.dmp
-
memory/1452-5-0x0000000000000000-mapping.dmp
-
memory/1452-6-0x00000000011D0000-0x00000000011EF000-memory.dmpFilesize
124KB
-
memory/1452-7-0x00000000011D0000-0x00000000011EF000-memory.dmpFilesize
124KB
-
memory/1452-9-0x0000000001090000-0x0000000001150000-memory.dmpFilesize
768KB
-
memory/2988-8-0x0000000000000000-mapping.dmp