Analysis
- max time kernel
150s - max time network
151s - platform
windows10_x64 - resource
win10v20201028 - submitted
12/11/2020, 14:14
Static task
static1
Behavioral task
behavioral1
Sample
Outstanding payment Overdue for Invoice INV-2644.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target Outstanding payment Overdue for Invoice INV-2644.exe
- Size 801KB
- Sample201112-4f9p8wee6n
- SHA256 d5693be3b4e0d78485c00d409aedbe5cf18fd22c413fac48b44a4eaa0bbda668
- MD5 b85b5ff7eb8a03a9bff5f05a94d307e2
- SHA1 8a0cbfa051f3030036a92b0bd146f83c12df4973
- SHA512 a89780630514c62380caa147f6bc50860f5b0ece10b46cfc0529f97b07723326464690a5e9a57d9ffbb39d33664377256f5aee76fd98b979cfe4d783f9f109a5
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.pamforprogress.com/bg8v/
Decoy
-
patrickzajda.com
-
40ye.com
-
foxyivys.com
-
higherstatusfreebook.com
-
pharmxpert.net
-
buyinglover.com
-
eresuli.com
-
officerrustensheskey.com
-
ghoster.agency
-
susanchanportfolio.com
-
etreunheros.com
-
yavcxas.com
-
jasonrbradwell.com
-
tods.info
-
hawksltd.com
-
rankpicker.net
-
rachelraydiet.com
-
foolishdrivers.com
-
amtpsychology.com
-
hffc365.com
-
triviumpoint.com
-
mymathstest.com
-
moonlightmoviestx.com
-
modelbyvmj.com
-
adhdo.net
-
melhist.com
-
masquesgratuits.com
-
lxcloakjs.site
-
zjnbxcy.com
-
designthnkr.com
-
myeyepupil.com
-
sunsetemploymentny.com
-
stkclass.com
-
octoberx2.online
-
critterapp.com
-
mytcfb.com
-
trumpdrama.com
-
sensoryshirts.com
-
inspiredartistsproductions.com
-
petereid.xyz
-
copyright-helpcentre-ig.com
-
drinkdel.com
-
kanmra.com
-
tinyhomeshopping.com
-
lb-s24b.online
-
freebayag.info
-
denso-si-solution.com
-
xifrainternacional.com
-
sausathaco.com
-
floratend.com
-
incomecoach.info
-
oarlike.com
-
dupedesigns.com
-
demanumachina.com
-
dreamwcandles.com
-
toledoinstruments.com
-
stageleftusa.com
-
jibenentreprenad.mobi
-
aconweb.com
-
wakethephoenix.com
-
veryinteresthing.com
-
reason.institute
-
adraeklo.com
-
dentistandlaboratories.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/3944-1-0x0000000000400000-0x0000000000428000-memory.dmp formbook behavioral2/memory/3944-2-0x000000000041C970-mapping.dmp formbook behavioral2/memory/636-3-0x0000000000000000-mapping.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 972 set thread context of 3944 972 Outstanding payment Overdue for Invoice INV-2644.exe 76 PID 3944 set thread context of 3012 3944 Outstanding payment Overdue for Invoice INV-2644.exe 57 PID 636 set thread context of 3012 636 netsh.exe 57 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 972 Outstanding payment Overdue for Invoice INV-2644.exe 972 Outstanding payment Overdue for Invoice INV-2644.exe 3944 Outstanding payment Overdue for Invoice INV-2644.exe 3944 Outstanding payment Overdue for Invoice INV-2644.exe 3944 Outstanding payment Overdue for Invoice INV-2644.exe 3944 Outstanding payment Overdue for Invoice INV-2644.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe 636 netsh.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 972 Outstanding payment Overdue for Invoice INV-2644.exe 3944 Outstanding payment Overdue for Invoice INV-2644.exe 3944 Outstanding payment Overdue for Invoice INV-2644.exe 3944 Outstanding payment Overdue for Invoice INV-2644.exe 636 netsh.exe 636 netsh.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3944 Outstanding payment Overdue for Invoice INV-2644.exe Token: SeDebugPrivilege 636 netsh.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3012 Explorer.EXE - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 972 wrote to memory of 3944 972 Outstanding payment Overdue for Invoice INV-2644.exe 76 PID 972 wrote to memory of 3944 972 Outstanding payment Overdue for Invoice INV-2644.exe 76 PID 972 wrote to memory of 3944 972 Outstanding payment Overdue for Invoice INV-2644.exe 76 PID 3012 wrote to memory of 636 3012 Explorer.EXE 78 PID 3012 wrote to memory of 636 3012 Explorer.EXE 78 PID 3012 wrote to memory of 636 3012 Explorer.EXE 78 PID 636 wrote to memory of 3340 636 netsh.exe 79 PID 636 wrote to memory of 3340 636 netsh.exe 79 PID 636 wrote to memory of 3340 636 netsh.exe 79
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\Outstanding payment Overdue for Invoice INV-2644.exe"C:\Users\Admin\AppData\Local\Temp\Outstanding payment Overdue for Invoice INV-2644.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\Outstanding payment Overdue for Invoice INV-2644.exe"C:\Users\Admin\AppData\Local\Temp\Outstanding payment Overdue for Invoice INV-2644.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3944
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:1932
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Outstanding payment Overdue for Invoice INV-2644.exe"3⤵PID:3340
-
-