Analysis
- max time kernel
148s - max time network
148s - platform
windows10_x64 - resource
win10v20201028 - submitted
19/11/2020, 08:55
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order 40,7045.exe
Resource
win7v20201028
windows7_x64
General
- Target Purchase Order 40,7045.exe
- Size 468KB
- Sample201119-8y7nfacbte
- SHA256 7ab132d4889dabc0385ba4dd9ca727ccbc241791f851da7ab1afb09858fe8634
- MD5 933a6917e05e16398d30a2dbe2989234
- SHA1 88c730277f77560bdff4836fb689f24a7ad81b5e
- SHA512 f4ea0651ee49683414d1170bc17b02af5878632cb9f48473c0902a6a8f3640aea8c517ee268fe7960ebe4e624e902db458927b1f5ee398530e84ed1b0db09e62
- MD5 SHA1 SHA512
Malware Config
Extracted
-
formbook
-
http://www.sweetbasilmarketing.com/igqu/
-
coveloungewineandwhiskey.com
-
chemtradent.com
-
educare.cloud
-
shopnicknaks.com
-
realitytvstockwatch.com
-
handsfreedocs.com
-
trafegopago.com
-
ariasu-nakanokaikei.com
-
allmm.info
-
elleatx.com
-
erpsystem.site
-
whatisastaxanthin.com
-
hemparcade.com
-
ownumo.com
-
pasumaisangam.com
-
theoutdoorbed.com
-
plantpowered.energy
-
elevenelevenapparelcompany.com
-
vrspace.ltd
-
justsoldbykristen.com
-
pintudada.com
-
147design.com
-
cashintl.com
-
atal.ltd
-
forbigdogs.com
-
onlineshoppingisbest.com
-
pharmacysouq.com
-
placeduconfort.com
-
lotoencasa.com
-
mobileoilxchange.com
-
rockinglifefromhome.com
-
covid19salivatestdirect.com
-
hyx20140813.com
-
indorebodybilaspur.com
-
heartandcrowncloset.com
-
fireandcrystal.com
-
rbnrf.com
-
obsessingwealth.com
-
yslh88.com
-
guidesgold.net
-
thoughtslate.com
-
primeworldgroup.com
-
yogapants.xyz
-
lostandfoundpetsalabaster.com
-
dua.fund
-
namofast.com
-
royaloakpublishing.com
-
gayfuse.com
-
tumulusanalytics.com
-
kayapallisgaard.com
-
ppc-listing.info
-
allan-wren.com
-
uneducationofamerica.com
-
majhulworld.com
-
the-gongs.com
-
hybrideve.com
-
lwpevolve.com
-
fahufu.com
-
k-fpa.com
-
roboleadsystem.com
-
capitalcitybombers.com
-
searchnehomes.com
-
maninhatphoto.com
-
happinestbuilders.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/1704-0-0x0000000000400000-0x0000000000428000-memory.dmp formbook behavioral2/memory/1704-1-0x000000000041CA30-mapping.dmp formbook behavioral2/memory/2408-4-0x0000000000000000-mapping.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 640 set thread context of 1704 640 Purchase Order 40,7045.exe 74 PID 1704 set thread context of 2968 1704 Purchase Order 40,7045.exe 57 PID 2408 set thread context of 2968 2408 rundll32.exe 57 - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1704 Purchase Order 40,7045.exe 1704 Purchase Order 40,7045.exe 1704 Purchase Order 40,7045.exe 1704 Purchase Order 40,7045.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 640 Purchase Order 40,7045.exe 1704 Purchase Order 40,7045.exe 1704 Purchase Order 40,7045.exe 1704 Purchase Order 40,7045.exe 2408 rundll32.exe 2408 rundll32.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1704 Purchase Order 40,7045.exe Token: SeShutdownPrivilege 2968 Explorer.EXE Token: SeCreatePagefilePrivilege 2968 Explorer.EXE Token: SeShutdownPrivilege 2968 Explorer.EXE Token: SeCreatePagefilePrivilege 2968 Explorer.EXE Token: SeDebugPrivilege 2408 rundll32.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2968 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 640 wrote to memory of 1704 640 Purchase Order 40,7045.exe 74 PID 640 wrote to memory of 1704 640 Purchase Order 40,7045.exe 74 PID 640 wrote to memory of 1704 640 Purchase Order 40,7045.exe 74 PID 640 wrote to memory of 1704 640 Purchase Order 40,7045.exe 74 PID 2968 wrote to memory of 2408 2968 Explorer.EXE 76 PID 2968 wrote to memory of 2408 2968 Explorer.EXE 76 PID 2968 wrote to memory of 2408 2968 Explorer.EXE 76 PID 2408 wrote to memory of 4072 2408 rundll32.exe 79 PID 2408 wrote to memory of 4072 2408 rundll32.exe 79 PID 2408 wrote to memory of 4072 2408 rundll32.exe 79
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\Purchase Order 40,7045.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order 40,7045.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\Purchase Order 40,7045.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order 40,7045.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1704
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order 40,7045.exe"3⤵PID:4072
-
-