Analysis
- max time kernel
150s - max time network
8s - platform
windows7_x64 - resource
win7v20201028 - submitted
21/11/2020, 07:51
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order 40,7045.exe
Resource
win7v20201028
windows7_x64
General
- Target Purchase Order 40,7045.exe
- Size 339KB
- Sample201121-blaeav9v7x
- SHA256 7d4d5ddf016f84445c94bf5ee4d715be092f8711b70ebd17f48f2956fba0487d
- MD5 2566aac2faf57e27d8778f2c61bac6d3
- SHA1 b163ec807fe59a0f85f2d964fe1e8ffa8adab77e
- SHA512 f4e1fabcb5036f7adda5789f91dfdcfeada6dbfb0c8ed33ff76acf7d42f8f0e74041332684310572bd449b23ec5a7f10ef25245f78007fa70a10c14d646c6250
- MD5 SHA1 SHA512
Malware Config
Extracted
-
formbook
-
http://www.sweetbasilmarketing.com/igqu/
-
coveloungewineandwhiskey.com
-
chemtradent.com
-
educare.cloud
-
shopnicknaks.com
-
realitytvstockwatch.com
-
handsfreedocs.com
-
trafegopago.com
-
ariasu-nakanokaikei.com
-
allmm.info
-
elleatx.com
-
erpsystem.site
-
whatisastaxanthin.com
-
hemparcade.com
-
ownumo.com
-
pasumaisangam.com
-
theoutdoorbed.com
-
plantpowered.energy
-
elevenelevenapparelcompany.com
-
vrspace.ltd
-
justsoldbykristen.com
-
pintudada.com
-
147design.com
-
cashintl.com
-
atal.ltd
-
forbigdogs.com
-
onlineshoppingisbest.com
-
pharmacysouq.com
-
placeduconfort.com
-
lotoencasa.com
-
mobileoilxchange.com
-
rockinglifefromhome.com
-
covid19salivatestdirect.com
-
hyx20140813.com
-
indorebodybilaspur.com
-
heartandcrowncloset.com
-
fireandcrystal.com
-
rbnrf.com
-
obsessingwealth.com
-
yslh88.com
-
guidesgold.net
-
thoughtslate.com
-
primeworldgroup.com
-
yogapants.xyz
-
lostandfoundpetsalabaster.com
-
dua.fund
-
namofast.com
-
royaloakpublishing.com
-
gayfuse.com
-
tumulusanalytics.com
-
kayapallisgaard.com
-
ppc-listing.info
-
allan-wren.com
-
uneducationofamerica.com
-
majhulworld.com
-
the-gongs.com
-
hybrideve.com
-
lwpevolve.com
-
fahufu.com
-
k-fpa.com
-
roboleadsystem.com
-
capitalcitybombers.com
-
searchnehomes.com
-
maninhatphoto.com
-
happinestbuilders.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral1/memory/1124-0-0x0000000000400000-0x0000000000428000-memory.dmp formbook behavioral1/memory/1124-1-0x000000000041CA30-mapping.dmp formbook behavioral1/memory/1156-3-0x0000000000000000-mapping.dmp formbook - Deletes itself 1 IoCs
pid Process 1616 cmd.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1808 set thread context of 1124 1808 Purchase Order 40,7045.exe 26 PID 1124 set thread context of 1244 1124 Purchase Order 40,7045.exe 21 PID 1156 set thread context of 1244 1156 NAPSTAT.EXE 21 - Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 1124 Purchase Order 40,7045.exe 1124 Purchase Order 40,7045.exe 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1808 Purchase Order 40,7045.exe 1124 Purchase Order 40,7045.exe 1124 Purchase Order 40,7045.exe 1124 Purchase Order 40,7045.exe 1156 NAPSTAT.EXE 1156 NAPSTAT.EXE - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1124 Purchase Order 40,7045.exe Token: SeDebugPrivilege 1156 NAPSTAT.EXE - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1808 wrote to memory of 1124 1808 Purchase Order 40,7045.exe 26 PID 1808 wrote to memory of 1124 1808 Purchase Order 40,7045.exe 26 PID 1808 wrote to memory of 1124 1808 Purchase Order 40,7045.exe 26 PID 1808 wrote to memory of 1124 1808 Purchase Order 40,7045.exe 26 PID 1808 wrote to memory of 1124 1808 Purchase Order 40,7045.exe 26 PID 1244 wrote to memory of 1156 1244 Explorer.EXE 28 PID 1244 wrote to memory of 1156 1244 Explorer.EXE 28 PID 1244 wrote to memory of 1156 1244 Explorer.EXE 28 PID 1244 wrote to memory of 1156 1244 Explorer.EXE 28 PID 1156 wrote to memory of 1616 1156 NAPSTAT.EXE 31 PID 1156 wrote to memory of 1616 1156 NAPSTAT.EXE 31 PID 1156 wrote to memory of 1616 1156 NAPSTAT.EXE 31 PID 1156 wrote to memory of 1616 1156 NAPSTAT.EXE 31
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\Purchase Order 40,7045.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order 40,7045.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\Purchase Order 40,7045.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order 40,7045.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1124
-
-
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order 40,7045.exe"3⤵
- Deletes itself
PID:1616
-
-