Analysis
- max time kernel
148s - max time network
140s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:37
Static task
static1
Behavioral task
behavioral1
Sample
invoice copy.scanned-view-intl.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target invoice copy.scanned-view-intl.exe
- Size 353KB
- Sample201109-85gllk595a
- SHA256 a0c49ccef1033cbd0119355f93a8109dccf48d53f0fc155e152efaa7ebf44a5a
- MD5 28fcf0d7d61f5f19e97e295726fb6fb7
- SHA1 f0e1edcb9fa36a79b98e74c4a53078d9cc60e4da
- SHA512 e2838614fb14098ab544dbe6ecce8742a307eda34849844747f0768558c54f5e992826609286cbd3bebd8fda6363e26639589f960998f7806e24ac34a4b44d47
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.allixanes.com/ka30/
Decoy
-
szzxkgp.com
-
classicbeachproperty.com
-
dingshengmfj.com
-
pinnsight.life
-
luxuryhomesphoto.com
-
mekawardduilawyer.com
-
orthodontistnapervilleil.com
-
constructorarabguar.com
-
upstairsblogs.com
-
wwwjsh001.com
-
lambandpeeples.com
-
delraybeacheyelashes.com
-
therebelpetunia.com
-
127ctg.info
-
cupid-finance.com
-
havuzlukonakclub.com
-
reganconstruction.wales
-
chickenpawequipments.com
-
lifeinmyhometown.com
-
xn--1cto73au6k3ka.net
-
icookbyrecipe.com
-
tatlifilmizle.com
-
suneeandscott.com
-
diyfishingsource.net
-
spinstrongfitness.com
-
teatshirts.com
-
blaguedebof.com
-
expressinfomatics.com
-
ryanmortonoffice.com
-
putlockerrhq.com
-
gcashflow.com
-
seot0.com
-
banbanjf.com
-
ilbagliodelpoeta.com
-
baerlanma.com
-
foxinan.com
-
zxhtwl.com
-
madewelltx.com
-
vertexdesk.com
-
madosport.com
-
dolphinfirst.com
-
tlk-folio.com
-
smart-sitting.com
-
chainalbeads.com
-
satellite.international
-
infohubcommercial.com
-
550292.top
-
confettixsprinkles.com
-
weaponsinstruction.com
-
femrdu.online
-
sahie.com
-
putasysexo.com
-
shoukainomadoguchi.com
-
floriot-rehab.com
-
zoneprnt.com
-
xbjkprt.com
-
photstom.com
-
lv-tong.net
-
oxnffr.info
-
yichenxiaoshuo.com
-
coinpaymets.com
-
genissiscredit.com
-
sh-zyw.com
-
aaliyaht.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/4052-4-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/4052-5-0x000000000041B6A0-mapping.dmp formbook behavioral2/memory/3704-6-0x0000000000000000-mapping.dmp formbook - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run wlanext.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KBOLGZIX9NI = "C:\\Program Files (x86)\\K3fd0qvw\\tzodyj8pe0or.exe" wlanext.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 412 set thread context of 4052 412 invoice copy.scanned-view-intl.exe 78 PID 4052 set thread context of 2876 4052 invoice copy.scanned-view-intl.exe 57 PID 3704 set thread context of 2876 3704 wlanext.exe 57 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\K3fd0qvw\tzodyj8pe0or.exe wlanext.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3168 schtasks.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wlanext.exe - Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 412 invoice copy.scanned-view-intl.exe 412 invoice copy.scanned-view-intl.exe 412 invoice copy.scanned-view-intl.exe 412 invoice copy.scanned-view-intl.exe 412 invoice copy.scanned-view-intl.exe 4052 invoice copy.scanned-view-intl.exe 4052 invoice copy.scanned-view-intl.exe 4052 invoice copy.scanned-view-intl.exe 4052 invoice copy.scanned-view-intl.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe 3704 wlanext.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 4052 invoice copy.scanned-view-intl.exe 4052 invoice copy.scanned-view-intl.exe 4052 invoice copy.scanned-view-intl.exe 3704 wlanext.exe 3704 wlanext.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 412 invoice copy.scanned-view-intl.exe Token: SeDebugPrivilege 4052 invoice copy.scanned-view-intl.exe Token: SeDebugPrivilege 3704 wlanext.exe Token: SeShutdownPrivilege 2876 Explorer.EXE Token: SeCreatePagefilePrivilege 2876 Explorer.EXE Token: SeShutdownPrivilege 2876 Explorer.EXE Token: SeCreatePagefilePrivilege 2876 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2876 Explorer.EXE - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 412 wrote to memory of 3168 412 invoice copy.scanned-view-intl.exe 75 PID 412 wrote to memory of 3168 412 invoice copy.scanned-view-intl.exe 75 PID 412 wrote to memory of 3168 412 invoice copy.scanned-view-intl.exe 75 PID 412 wrote to memory of 3988 412 invoice copy.scanned-view-intl.exe 77 PID 412 wrote to memory of 3988 412 invoice copy.scanned-view-intl.exe 77 PID 412 wrote to memory of 3988 412 invoice copy.scanned-view-intl.exe 77 PID 412 wrote to memory of 4052 412 invoice copy.scanned-view-intl.exe 78 PID 412 wrote to memory of 4052 412 invoice copy.scanned-view-intl.exe 78 PID 412 wrote to memory of 4052 412 invoice copy.scanned-view-intl.exe 78 PID 412 wrote to memory of 4052 412 invoice copy.scanned-view-intl.exe 78 PID 412 wrote to memory of 4052 412 invoice copy.scanned-view-intl.exe 78 PID 412 wrote to memory of 4052 412 invoice copy.scanned-view-intl.exe 78 PID 2876 wrote to memory of 3704 2876 Explorer.EXE 79 PID 2876 wrote to memory of 3704 2876 Explorer.EXE 79 PID 2876 wrote to memory of 3704 2876 Explorer.EXE 79 PID 3704 wrote to memory of 2764 3704 wlanext.exe 83 PID 3704 wrote to memory of 2764 3704 wlanext.exe 83 PID 3704 wrote to memory of 2764 3704 wlanext.exe 83
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\invoice copy.scanned-view-intl.exe"C:\Users\Admin\AppData\Local\Temp\invoice copy.scanned-view-intl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fdUYji" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7D92.tmp"3⤵
- Creates scheduled task(s)
PID:3168
-
-
C:\Users\Admin\AppData\Local\Temp\invoice copy.scanned-view-intl.exe"{path}"3⤵PID:3988
-
-
C:\Users\Admin\AppData\Local\Temp\invoice copy.scanned-view-intl.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4052
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\invoice copy.scanned-view-intl.exe"3⤵PID:2764
-
-