Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
21-11-2020 07:51
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order 40,7045.exe
Resource
win7v20201028
General
-
Target
Purchase Order 40,7045.exe
-
Size
339KB
-
MD5
2566aac2faf57e27d8778f2c61bac6d3
-
SHA1
b163ec807fe59a0f85f2d964fe1e8ffa8adab77e
-
SHA256
7d4d5ddf016f84445c94bf5ee4d715be092f8711b70ebd17f48f2956fba0487d
-
SHA512
f4e1fabcb5036f7adda5789f91dfdcfeada6dbfb0c8ed33ff76acf7d42f8f0e74041332684310572bd449b23ec5a7f10ef25245f78007fa70a10c14d646c6250
Malware Config
Extracted
formbook
http://www.sweetbasilmarketing.com/igqu/
coveloungewineandwhiskey.com
chemtradent.com
educare.cloud
shopnicknaks.com
realitytvstockwatch.com
handsfreedocs.com
trafegopago.com
ariasu-nakanokaikei.com
allmm.info
elleatx.com
erpsystem.site
whatisastaxanthin.com
hemparcade.com
ownumo.com
pasumaisangam.com
theoutdoorbed.com
plantpowered.energy
elevenelevenapparelcompany.com
vrspace.ltd
justsoldbykristen.com
pintudada.com
147design.com
cashintl.com
atal.ltd
forbigdogs.com
onlineshoppingisbest.com
pharmacysouq.com
placeduconfort.com
lotoencasa.com
mobileoilxchange.com
rockinglifefromhome.com
covid19salivatestdirect.com
hyx20140813.com
indorebodybilaspur.com
heartandcrowncloset.com
fireandcrystal.com
rbnrf.com
obsessingwealth.com
yslh88.com
guidesgold.net
thoughtslate.com
primeworldgroup.com
yogapants.xyz
lostandfoundpetsalabaster.com
dua.fund
namofast.com
royaloakpublishing.com
gayfuse.com
tumulusanalytics.com
kayapallisgaard.com
ppc-listing.info
allan-wren.com
uneducationofamerica.com
majhulworld.com
the-gongs.com
hybrideve.com
lwpevolve.com
fahufu.com
k-fpa.com
roboleadsystem.com
capitalcitybombers.com
searchnehomes.com
maninhatphoto.com
happinestbuilders.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3440-0-0x0000000000400000-0x0000000000428000-memory.dmp formbook behavioral2/memory/3440-1-0x000000000041CA30-mapping.dmp formbook behavioral2/memory/4152-4-0x0000000000000000-mapping.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Purchase Order 40,7045.exePurchase Order 40,7045.exemstsc.exedescription pid process target process PID 4688 set thread context of 3440 4688 Purchase Order 40,7045.exe Purchase Order 40,7045.exe PID 3440 set thread context of 3028 3440 Purchase Order 40,7045.exe Explorer.EXE PID 4152 set thread context of 3028 4152 mstsc.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
Purchase Order 40,7045.exemstsc.exepid process 3440 Purchase Order 40,7045.exe 3440 Purchase Order 40,7045.exe 3440 Purchase Order 40,7045.exe 3440 Purchase Order 40,7045.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe 4152 mstsc.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Purchase Order 40,7045.exePurchase Order 40,7045.exemstsc.exepid process 4688 Purchase Order 40,7045.exe 3440 Purchase Order 40,7045.exe 3440 Purchase Order 40,7045.exe 3440 Purchase Order 40,7045.exe 4152 mstsc.exe 4152 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
Purchase Order 40,7045.exeExplorer.EXEmstsc.exedescription pid process Token: SeDebugPrivilege 3440 Purchase Order 40,7045.exe Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeDebugPrivilege 4152 mstsc.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3028 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Purchase Order 40,7045.exeExplorer.EXEmstsc.exedescription pid process target process PID 4688 wrote to memory of 3440 4688 Purchase Order 40,7045.exe Purchase Order 40,7045.exe PID 4688 wrote to memory of 3440 4688 Purchase Order 40,7045.exe Purchase Order 40,7045.exe PID 4688 wrote to memory of 3440 4688 Purchase Order 40,7045.exe Purchase Order 40,7045.exe PID 4688 wrote to memory of 3440 4688 Purchase Order 40,7045.exe Purchase Order 40,7045.exe PID 3028 wrote to memory of 4152 3028 Explorer.EXE mstsc.exe PID 3028 wrote to memory of 4152 3028 Explorer.EXE mstsc.exe PID 3028 wrote to memory of 4152 3028 Explorer.EXE mstsc.exe PID 4152 wrote to memory of 2848 4152 mstsc.exe cmd.exe PID 4152 wrote to memory of 2848 4152 mstsc.exe cmd.exe PID 4152 wrote to memory of 2848 4152 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order 40,7045.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order 40,7045.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order 40,7045.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order 40,7045.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order 40,7045.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2848-7-0x0000000000000000-mapping.dmp
-
memory/3440-0-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3440-1-0x000000000041CA30-mapping.dmp
-
memory/4152-4-0x0000000000000000-mapping.dmp
-
memory/4152-5-0x0000000000B30000-0x0000000000E2C000-memory.dmpFilesize
3.0MB
-
memory/4152-6-0x0000000000B30000-0x0000000000E2C000-memory.dmpFilesize
3.0MB
-
memory/4152-8-0x0000000005BF0000-0x0000000005D1B000-memory.dmpFilesize
1.2MB