Analysis
- max time kernel
146s - max time network
21s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 19:42
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE ORDER 11052020_pdf.exe
Resource
win7v20201028
windows7_x64
General
- Target PURCHASE ORDER 11052020_pdf.exe
- Size 357KB
- Sample201109-c7l4r7phcs
- SHA256 bbb3afd846cc51e61380effeaceabc21e15c8b4ccdab6d821697191605a00c60
- MD5 466ed09e4da8ddca014d22b654290167
- SHA1 b4e123d4d2f00c79bbf4a73fdb8488de971c7876
- SHA512 ef4af56909dc36860e7969be0d63e3bfe48385590ae3b1df03c976e66d12d785ed13d99ea98a5012b1c5e4ae88b802edd7bbcfe1e6c54afeed1d76452e402b67
- MD5 SHA1 SHA512
Malware Config
Extracted
-
formbook
-
http://www.cervox.com/jb9/
-
cloud-medical.com
-
maximtech-bd.com
-
3d-sprint.com
-
624vhw.info
-
nexdesk.net
-
flxcustomsigns.com
-
gvuzejobxa.info
-
xiaobaokm.com
-
565mt.com
-
servicioscuery.com
-
500360.biz
-
stephanieshermanart.com
-
boozebird.com
-
merckcousa.com
-
frenchkissldn.com
-
lucyfaulknerllc.com
-
egekartus.com
-
bookyabber.com
-
cardiacimaginginpractice.com
-
deucessound.com
-
loveyourlimitsyoga.com
-
sadort.com
-
pegangbola.com
-
smxjsy.com
-
grpchicago.com
-
utahofficeforvictimsofcrime.com
-
msgbm.loan
-
thebiggestapp4upgrade.date
-
cveew.info
-
2nfy.com
-
qingbeirenedu.com
-
freedietitian.com
-
alexisfisio.com
-
daymdesign.com
-
codingplato.com
-
portatilespc.com
-
hzdyfy.com
-
hichamsabia.com
-
cremagoji.info
-
prorea.net
-
gppz111.com
-
bestlunchinbendoregon.info
-
goodfeli.com
-
halcyonessentialsdev.com
-
mossbaby.com
-
changeseffect.com
-
lifefocusadvisors.net
-
kelebektv.com
-
sentinelridgeatmtsi.net
-
rebeccawelford.com
-
cutandwin.com
-
eliosretreats.com
-
sermarineshippng.com
-
helenamthouses.com
-
thesheriffmuirinn.scot
-
hy030.com
-
seolink.studio
-
trendingonskysports.com
-
bilgiburger.com
-
firegearunlimited.com
-
makler-gesucht.com
-
sdhaozhi.com
-
mightyfootball.com
-
device-kyoto.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral1/memory/1996-1-0x000000000041B5F0-mapping.dmp formbook behavioral1/memory/1996-0-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/1784-2-0x0000000000000000-mapping.dmp formbook - Deletes itself 1 IoCs
pid Process 1536 cmd.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 596 set thread context of 1996 596 PURCHASE ORDER 11052020_pdf.exe 26 PID 1996 set thread context of 1256 1996 PURCHASE ORDER 11052020_pdf.exe 21 PID 1784 set thread context of 1256 1784 msiexec.exe 21 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1996 PURCHASE ORDER 11052020_pdf.exe 1996 PURCHASE ORDER 11052020_pdf.exe 1784 msiexec.exe 1784 msiexec.exe 1784 msiexec.exe 1784 msiexec.exe 1784 msiexec.exe 1784 msiexec.exe 1784 msiexec.exe 1784 msiexec.exe 1784 msiexec.exe 1784 msiexec.exe 1784 msiexec.exe 1784 msiexec.exe 1784 msiexec.exe 1784 msiexec.exe 1784 msiexec.exe 1784 msiexec.exe 1784 msiexec.exe 1784 msiexec.exe 1784 msiexec.exe 1784 msiexec.exe 1784 msiexec.exe 1784 msiexec.exe 1784 msiexec.exe 1784 msiexec.exe 1784 msiexec.exe 1784 msiexec.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1996 PURCHASE ORDER 11052020_pdf.exe 1996 PURCHASE ORDER 11052020_pdf.exe 1996 PURCHASE ORDER 11052020_pdf.exe 1784 msiexec.exe 1784 msiexec.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1996 PURCHASE ORDER 11052020_pdf.exe Token: SeDebugPrivilege 1784 msiexec.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 596 wrote to memory of 1996 596 PURCHASE ORDER 11052020_pdf.exe 26 PID 596 wrote to memory of 1996 596 PURCHASE ORDER 11052020_pdf.exe 26 PID 596 wrote to memory of 1996 596 PURCHASE ORDER 11052020_pdf.exe 26 PID 596 wrote to memory of 1996 596 PURCHASE ORDER 11052020_pdf.exe 26 PID 596 wrote to memory of 1996 596 PURCHASE ORDER 11052020_pdf.exe 26 PID 596 wrote to memory of 1996 596 PURCHASE ORDER 11052020_pdf.exe 26 PID 596 wrote to memory of 1996 596 PURCHASE ORDER 11052020_pdf.exe 26 PID 1256 wrote to memory of 1784 1256 Explorer.EXE 28 PID 1256 wrote to memory of 1784 1256 Explorer.EXE 28 PID 1256 wrote to memory of 1784 1256 Explorer.EXE 28 PID 1256 wrote to memory of 1784 1256 Explorer.EXE 28 PID 1256 wrote to memory of 1784 1256 Explorer.EXE 28 PID 1256 wrote to memory of 1784 1256 Explorer.EXE 28 PID 1256 wrote to memory of 1784 1256 Explorer.EXE 28 PID 1784 wrote to memory of 1536 1784 msiexec.exe 31 PID 1784 wrote to memory of 1536 1784 msiexec.exe 31 PID 1784 wrote to memory of 1536 1784 msiexec.exe 31 PID 1784 wrote to memory of 1536 1784 msiexec.exe 31
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 11052020_pdf.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 11052020_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 11052020_pdf.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1996
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 11052020_pdf.exe"3⤵
- Deletes itself
PID:1536
-
-