Analysis
- max time kernel
147s - max time network
144s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:57
Static task
static1
Behavioral task
behavioral1
Sample
Payment_Advice.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target Payment_Advice.exe
- Size 815KB
- Sample201109-yfktva1qf2
- SHA256 8d692269e00163075c2d1bdeea0d8fe0ebb06c791233f692fa76e766095ec3ad
- MD5 05a028bf7e8b4118a97a57552fc4ba0c
- SHA1 9e71f8d3fd4bddb603c4c1803c867cade9be7a83
- SHA512 df27cb22cbd3ee8faa970ce11217ac408c5e91e6cb4f81ad9f50b520cdebc216fee99ac022c41db449981ceadf5fdd4516b536641dbaf5a291125053b484a867
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.lodipytu.com/tmo/
Decoy
-
myplace.design
-
geersa.info
-
rhysbdowning.com
-
pandorainiciatives.com
-
affiliate-beginning-gently.com
-
anitcruiserun.live
-
xn--6kr11w.com
-
everhopeimaging.com
-
drmdb.com
-
regen.media
-
ibizacarobcompany.com
-
keramikstubeboehme.info
-
bleedingwords.com
-
potbringer.com
-
opposingavatars.com
-
ljubljana-city.com
-
saltsmangarcia.com
-
5551071.com
-
thelawofficeofrkeithbrown.com
-
fukugyou-style.com
-
montrealdesigndeclaration.com
-
miasinky.com
-
documentingfood.com
-
jiangxijingji.com
-
germanaxis.com
-
coochao.com
-
telkindestek.com
-
assekuradeur-kontor.com
-
adamcwyk.com
-
961478.com
-
wuncemir.com
-
thenomadicview.com
-
athleticsilver.com
-
xn--fiq6i04kyoe.com
-
orderalley.com
-
opebet126.com
-
xci178.com
-
alphafinancelimited.com
-
bridgesgrp.com
-
wwwyh8800.com
-
asesoriacam.com
-
findcrazygolf.com
-
revitalizationstation.com
-
thegoodpeoplenetwork.com
-
wuyangjianshen.com
-
yong8999.com
-
crystalchanphotography.com
-
aimplem.com
-
hanaemi.design
-
ss-realestate.com
-
iyapedia.com
-
stormbuck.com
-
nonprofitmom.com
-
ahalloffamelife.net
-
lbduyi.info
-
powforecast.com
-
29sk78.com
-
lumm67671.com
-
sctalida.com
-
intelligentea.com
-
xvideospajas.com
-
qepe.ltd
-
roygonzalez.net
-
hnzhenlan.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/4980-0-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/4980-1-0x000000000041E2E0-mapping.dmp formbook behavioral2/memory/2548-3-0x0000000000000000-mapping.dmp formbook - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GDYLH08X = "C:\\Program Files (x86)\\Gg0hx5lw\\kz14l6g0e6qltx.exe" rundll32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4772 set thread context of 4980 4772 Payment_Advice.exe 72 PID 4980 set thread context of 2576 4980 Payment_Advice.exe 57 PID 2548 set thread context of 2576 2548 rundll32.exe 57 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Gg0hx5lw\kz14l6g0e6qltx.exe rundll32.exe -
description ioc Process Key created \Registry\User\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 rundll32.exe - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 4772 Payment_Advice.exe 4772 Payment_Advice.exe 4980 Payment_Advice.exe 4980 Payment_Advice.exe 4980 Payment_Advice.exe 4980 Payment_Advice.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe - Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 4772 Payment_Advice.exe 4980 Payment_Advice.exe 4980 Payment_Advice.exe 4980 Payment_Advice.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe 2548 rundll32.exe - Suspicious use of AdjustPrivilegeToken 26 IoCs
description pid Process Token: SeDebugPrivilege 4980 Payment_Advice.exe Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeDebugPrivilege 2548 rundll32.exe Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2576 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4772 wrote to memory of 4980 4772 Payment_Advice.exe 72 PID 4772 wrote to memory of 4980 4772 Payment_Advice.exe 72 PID 4772 wrote to memory of 4980 4772 Payment_Advice.exe 72 PID 2576 wrote to memory of 2548 2576 Explorer.EXE 76 PID 2576 wrote to memory of 2548 2576 Explorer.EXE 76 PID 2576 wrote to memory of 2548 2576 Explorer.EXE 76 PID 2548 wrote to memory of 2012 2548 rundll32.exe 80 PID 2548 wrote to memory of 2012 2548 rundll32.exe 80 PID 2548 wrote to memory of 2012 2548 rundll32.exe 80 PID 2548 wrote to memory of 428 2548 rundll32.exe 82 PID 2548 wrote to memory of 428 2548 rundll32.exe 82 PID 2548 wrote to memory of 428 2548 rundll32.exe 82 - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer rundll32.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\Payment_Advice.exe"C:\Users\Admin\AppData\Local\Temp\Payment_Advice.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\Payment_Advice.exe"C:\Users\Admin\AppData\Local\Temp\Payment_Advice.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4980
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2548 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Payment_Advice.exe"3⤵PID:2012
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:428
-
-