Analysis
- max time kernel
149s - max time network
146s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:42
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE ORDER 11052020_pdf.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target PURCHASE ORDER 11052020_pdf.exe
- Size 357KB
- Sample201109-c7l4r7phcs
- SHA256 bbb3afd846cc51e61380effeaceabc21e15c8b4ccdab6d821697191605a00c60
- MD5 466ed09e4da8ddca014d22b654290167
- SHA1 b4e123d4d2f00c79bbf4a73fdb8488de971c7876
- SHA512 ef4af56909dc36860e7969be0d63e3bfe48385590ae3b1df03c976e66d12d785ed13d99ea98a5012b1c5e4ae88b802edd7bbcfe1e6c54afeed1d76452e402b67
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.cervox.com/jb9/
Decoy
-
cloud-medical.com
-
maximtech-bd.com
-
3d-sprint.com
-
624vhw.info
-
nexdesk.net
-
flxcustomsigns.com
-
gvuzejobxa.info
-
xiaobaokm.com
-
565mt.com
-
servicioscuery.com
-
500360.biz
-
stephanieshermanart.com
-
boozebird.com
-
merckcousa.com
-
frenchkissldn.com
-
lucyfaulknerllc.com
-
egekartus.com
-
bookyabber.com
-
cardiacimaginginpractice.com
-
deucessound.com
-
loveyourlimitsyoga.com
-
sadort.com
-
pegangbola.com
-
smxjsy.com
-
grpchicago.com
-
utahofficeforvictimsofcrime.com
-
msgbm.loan
-
thebiggestapp4upgrade.date
-
cveew.info
-
2nfy.com
-
qingbeirenedu.com
-
freedietitian.com
-
alexisfisio.com
-
daymdesign.com
-
codingplato.com
-
portatilespc.com
-
hzdyfy.com
-
hichamsabia.com
-
cremagoji.info
-
prorea.net
-
gppz111.com
-
bestlunchinbendoregon.info
-
goodfeli.com
-
halcyonessentialsdev.com
-
mossbaby.com
-
changeseffect.com
-
lifefocusadvisors.net
-
kelebektv.com
-
sentinelridgeatmtsi.net
-
rebeccawelford.com
-
cutandwin.com
-
eliosretreats.com
-
sermarineshippng.com
-
helenamthouses.com
-
thesheriffmuirinn.scot
-
hy030.com
-
seolink.studio
-
trendingonskysports.com
-
bilgiburger.com
-
firegearunlimited.com
-
makler-gesucht.com
-
sdhaozhi.com
-
mightyfootball.com
-
device-kyoto.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/60-1-0x000000000041B5F0-mapping.dmp formbook behavioral2/memory/60-0-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/960-3-0x0000000000000000-mapping.dmp formbook - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run mstsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\R6WXO8AXCZK = "C:\\Program Files (x86)\\Lyfxt8z\\txylh08hvpxd3tvp.exe" mstsc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1100 set thread context of 60 1100 PURCHASE ORDER 11052020_pdf.exe 76 PID 60 set thread context of 2588 60 PURCHASE ORDER 11052020_pdf.exe 57 PID 960 set thread context of 2588 960 mstsc.exe 57 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Lyfxt8z\txylh08hvpxd3tvp.exe mstsc.exe -
description ioc Process Key created \Registry\User\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 mstsc.exe - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 60 PURCHASE ORDER 11052020_pdf.exe 60 PURCHASE ORDER 11052020_pdf.exe 60 PURCHASE ORDER 11052020_pdf.exe 60 PURCHASE ORDER 11052020_pdf.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe 960 mstsc.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 60 PURCHASE ORDER 11052020_pdf.exe 60 PURCHASE ORDER 11052020_pdf.exe 60 PURCHASE ORDER 11052020_pdf.exe 960 mstsc.exe 960 mstsc.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 60 PURCHASE ORDER 11052020_pdf.exe Token: SeDebugPrivilege 960 mstsc.exe Token: SeShutdownPrivilege 2588 Explorer.EXE Token: SeCreatePagefilePrivilege 2588 Explorer.EXE Token: SeShutdownPrivilege 2588 Explorer.EXE Token: SeCreatePagefilePrivilege 2588 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2588 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1100 wrote to memory of 60 1100 PURCHASE ORDER 11052020_pdf.exe 76 PID 1100 wrote to memory of 60 1100 PURCHASE ORDER 11052020_pdf.exe 76 PID 1100 wrote to memory of 60 1100 PURCHASE ORDER 11052020_pdf.exe 76 PID 1100 wrote to memory of 60 1100 PURCHASE ORDER 11052020_pdf.exe 76 PID 1100 wrote to memory of 60 1100 PURCHASE ORDER 11052020_pdf.exe 76 PID 1100 wrote to memory of 60 1100 PURCHASE ORDER 11052020_pdf.exe 76 PID 2588 wrote to memory of 960 2588 Explorer.EXE 77 PID 2588 wrote to memory of 960 2588 Explorer.EXE 77 PID 2588 wrote to memory of 960 2588 Explorer.EXE 77 PID 960 wrote to memory of 1468 960 mstsc.exe 81 PID 960 wrote to memory of 1468 960 mstsc.exe 81 PID 960 wrote to memory of 1468 960 mstsc.exe 81
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 11052020_pdf.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 11052020_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 11052020_pdf.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:60
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 11052020_pdf.exe"3⤵PID:1468
-
-