Analysis
- max time kernel
149s - max time network
144s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:08
Static task
static1
Behavioral task
behavioral1
Sample
CONFIRM ORDER.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target CONFIRM ORDER.exe
- Size 377KB
- Sample201109-n3lbn3exvx
- SHA256 e75e9eb97fb635737341ed9fcfd25471fdd9889e75305bbb6b32bbee19b32d52
- MD5 497d3c3fb025b66cde405926f5ed4943
- SHA1 f6906ed10c236f360253f8ff28b85263d42eebda
- SHA512 f4fe42c836409f2e3bf3ba6067a8bcd72f8bbc046a19674ef9c7bc00b288c13151c07a79b81bd8b0e232bccddfe0c92e0fd3edb24387424fad07f2be2155833c
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.nyoxibwer.com/20w/
Decoy
-
cofounder.technology
-
mrbajaf.com
-
xn--w9s874cfjq5fk.com
-
haliciogluhali.net
-
vanessadunfordhere.com
-
lookguy.win
-
91javac.com
-
goldennd.com
-
nwatheeliteteam.net
-
tumpukganda.com
-
clarservicios.com
-
koghana.com
-
workingwithroland.com
-
yellowsocialbox.com
-
under-dawg.com
-
sdtjtzyz.com
-
banditaerialproductions.com
-
newssmog.com
-
tefnmp.men
-
rebelialabel.com
-
shubhankarthinks.com
-
weldlngwarehouseinc.com
-
cxwlkjgs.com
-
sfbtadvertising.com
-
just-climb-it.com
-
abigailstales.net
-
erreapeworld.com
-
ujoi0cb3td.com
-
adhitshet.com
-
loi-mezard-invest.com
-
shimanami-guesthouse.com
-
5bu3.com
-
koszr.info
-
shopgoperinnovation.com
-
matthiasdittert.com
-
stiffeducation.com
-
projectoverflowinc.com
-
v5rayp.club
-
dqklfr.info
-
jacobsonfordl.com
-
chicagobps.biz
-
bsateenalsharq.com
-
238bifa.com
-
kairui.ink
-
lai2151.com
-
simplysavvysolutions.com
-
watertable.win
-
robotica.tech
-
avggrfx.com
-
teleportcafe.com
-
712roofing.com
-
07hosting.com
-
quiltlux.com
-
implantcyrkonowy.com
-
gnbaccelerator.com
-
negusangel.com
-
best1caratdiamondrings.com
-
elizabethlampertpr.net
-
pinpointlocalsacramento.com
-
skinstradesarea.com
-
morganhelps.com
-
divarium.com
-
njswd.com
-
bfmjgame.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/1000-5-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/1000-6-0x000000000041B680-mapping.dmp formbook behavioral2/memory/196-8-0x0000000000000000-mapping.dmp formbook - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run help.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EXOHRBMXCN = "C:\\Program Files (x86)\\Pnlohzl\\systrayfbc.exe" help.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1156 set thread context of 1000 1156 CONFIRM ORDER.exe 77 PID 1000 set thread context of 2624 1000 CONFIRM ORDER.exe 57 PID 196 set thread context of 2624 196 help.exe 57 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Pnlohzl\systrayfbc.exe help.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 584 schtasks.exe -
description ioc Process Key created \Registry\User\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 help.exe - Suspicious behavior: EnumeratesProcesses 61 IoCs
pid Process 1156 CONFIRM ORDER.exe 1000 CONFIRM ORDER.exe 1000 CONFIRM ORDER.exe 1000 CONFIRM ORDER.exe 1000 CONFIRM ORDER.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe 196 help.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1000 CONFIRM ORDER.exe 1000 CONFIRM ORDER.exe 1000 CONFIRM ORDER.exe 196 help.exe 196 help.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 1156 CONFIRM ORDER.exe Token: SeDebugPrivilege 1000 CONFIRM ORDER.exe Token: SeDebugPrivilege 196 help.exe Token: SeShutdownPrivilege 2624 Explorer.EXE Token: SeCreatePagefilePrivilege 2624 Explorer.EXE Token: SeShutdownPrivilege 2624 Explorer.EXE Token: SeCreatePagefilePrivilege 2624 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1156 wrote to memory of 584 1156 CONFIRM ORDER.exe 75 PID 1156 wrote to memory of 584 1156 CONFIRM ORDER.exe 75 PID 1156 wrote to memory of 584 1156 CONFIRM ORDER.exe 75 PID 1156 wrote to memory of 1000 1156 CONFIRM ORDER.exe 77 PID 1156 wrote to memory of 1000 1156 CONFIRM ORDER.exe 77 PID 1156 wrote to memory of 1000 1156 CONFIRM ORDER.exe 77 PID 1156 wrote to memory of 1000 1156 CONFIRM ORDER.exe 77 PID 1156 wrote to memory of 1000 1156 CONFIRM ORDER.exe 77 PID 1156 wrote to memory of 1000 1156 CONFIRM ORDER.exe 77 PID 2624 wrote to memory of 196 2624 Explorer.EXE 78 PID 2624 wrote to memory of 196 2624 Explorer.EXE 78 PID 2624 wrote to memory of 196 2624 Explorer.EXE 78 PID 196 wrote to memory of 3676 196 help.exe 82 PID 196 wrote to memory of 3676 196 help.exe 82 PID 196 wrote to memory of 3676 196 help.exe 82
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\CONFIRM ORDER.exe"C:\Users\Admin\AppData\Local\Temp\CONFIRM ORDER.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JvupWZrgHdjg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7E1F.tmp"3⤵
- Creates scheduled task(s)
PID:584
-
-
C:\Users\Admin\AppData\Local\Temp\CONFIRM ORDER.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1000
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:196 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\CONFIRM ORDER.exe"3⤵PID:3676
-
-