Analysis
- max time kernel
147s - max time network
142s - platform
windows10_x64 - resource
win10v20201028 - submitted
20/11/2020, 07:39
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order 40,7045$.exe
Resource
win7v20201028
windows7_x64
General
- Target Purchase Order 40,7045$.exe
- Size 361KB
- Sample201120-bxvpamwsyn
- SHA256 fd94ea05d07271de517e92af291ec6a8cff49cc83bb59f112efb6d5fec56809c
- MD5 4142c1713da2f4f94bec71bfed46587b
- SHA1 06cc7bd53758a0936f4b674847411a4f912fd654
- SHA512 1693379c66da547efb6e200d5cfc33fe7a49f38ca5f4121690e371ed5e7aaea389363f88cbba68eef1f1c9ea6e8f2d42c3472ebb38f2d9bf2185178bd3f2e245
- MD5 SHA1 SHA512
Malware Config
Extracted
-
formbook
-
http://www.sweetbasilmarketing.com/igqu/
-
coveloungewineandwhiskey.com
-
chemtradent.com
-
educare.cloud
-
shopnicknaks.com
-
realitytvstockwatch.com
-
handsfreedocs.com
-
trafegopago.com
-
ariasu-nakanokaikei.com
-
allmm.info
-
elleatx.com
-
erpsystem.site
-
whatisastaxanthin.com
-
hemparcade.com
-
ownumo.com
-
pasumaisangam.com
-
theoutdoorbed.com
-
plantpowered.energy
-
elevenelevenapparelcompany.com
-
vrspace.ltd
-
justsoldbykristen.com
-
pintudada.com
-
147design.com
-
cashintl.com
-
atal.ltd
-
forbigdogs.com
-
onlineshoppingisbest.com
-
pharmacysouq.com
-
placeduconfort.com
-
lotoencasa.com
-
mobileoilxchange.com
-
rockinglifefromhome.com
-
covid19salivatestdirect.com
-
hyx20140813.com
-
indorebodybilaspur.com
-
heartandcrowncloset.com
-
fireandcrystal.com
-
rbnrf.com
-
obsessingwealth.com
-
yslh88.com
-
guidesgold.net
-
thoughtslate.com
-
primeworldgroup.com
-
yogapants.xyz
-
lostandfoundpetsalabaster.com
-
dua.fund
-
namofast.com
-
royaloakpublishing.com
-
gayfuse.com
-
tumulusanalytics.com
-
kayapallisgaard.com
-
ppc-listing.info
-
allan-wren.com
-
uneducationofamerica.com
-
majhulworld.com
-
the-gongs.com
-
hybrideve.com
-
lwpevolve.com
-
fahufu.com
-
k-fpa.com
-
roboleadsystem.com
-
capitalcitybombers.com
-
searchnehomes.com
-
maninhatphoto.com
-
happinestbuilders.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/2856-0-0x0000000000400000-0x0000000000428000-memory.dmp formbook behavioral2/memory/2856-1-0x000000000041CA30-mapping.dmp formbook behavioral2/memory/3172-3-0x0000000000000000-mapping.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 500 set thread context of 2856 500 Purchase Order 40,7045$.exe 75 PID 2856 set thread context of 3032 2856 Purchase Order 40,7045$.exe 57 PID 3172 set thread context of 3032 3172 rundll32.exe 57 - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 2856 Purchase Order 40,7045$.exe 2856 Purchase Order 40,7045$.exe 2856 Purchase Order 40,7045$.exe 2856 Purchase Order 40,7045$.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe 3172 rundll32.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 500 Purchase Order 40,7045$.exe 2856 Purchase Order 40,7045$.exe 2856 Purchase Order 40,7045$.exe 2856 Purchase Order 40,7045$.exe 3172 rundll32.exe 3172 rundll32.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2856 Purchase Order 40,7045$.exe Token: SeDebugPrivilege 3172 rundll32.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 500 wrote to memory of 2856 500 Purchase Order 40,7045$.exe 75 PID 500 wrote to memory of 2856 500 Purchase Order 40,7045$.exe 75 PID 500 wrote to memory of 2856 500 Purchase Order 40,7045$.exe 75 PID 500 wrote to memory of 2856 500 Purchase Order 40,7045$.exe 75 PID 3032 wrote to memory of 3172 3032 Explorer.EXE 77 PID 3032 wrote to memory of 3172 3032 Explorer.EXE 77 PID 3032 wrote to memory of 3172 3032 Explorer.EXE 77 PID 3172 wrote to memory of 3716 3172 rundll32.exe 78 PID 3172 wrote to memory of 3716 3172 rundll32.exe 78 PID 3172 wrote to memory of 3716 3172 rundll32.exe 78
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\Purchase Order 40,7045$.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order 40,7045$.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:500 -
C:\Users\Admin\AppData\Local\Temp\Purchase Order 40,7045$.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order 40,7045$.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:1836
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order 40,7045$.exe"3⤵PID:3716
-
-