Analysis
- max time kernel
149s - max time network
135s - platform
windows10_x64 - resource
win10v20201028 - submitted
18/12/2020, 09:48
Static task
static1
Behavioral task
behavioral1
Sample
invoic.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target invoic.exe
- Size 358KB
- Sample201218-1e77twjybj
- SHA256 e59d9d9ca9e0c7dddea9a94f0dab0ae137b6a762999bade26db35b1ca35e1f72
- MD5 c283a8ac2f353078f965d522d810b43c
- SHA1 ffe1636aa203450e069146e8bb37a651dfeb85b6
- SHA512 0a4e6d3764d45e312808457d461950350eedf7d13b138e2fd7818b6773831547ae8e18b7ad01cf7b7ee9171158c9b331f26833c229b655a4894f8b1329a2e37f
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.helpmeiminmytwenties.com/oncs/
Decoy
-
premiokapuscinski.com
-
metrteor.com
-
alignablesolutions.com
-
wajevctytwe.com
-
prospervine.net
-
camsplaces.com
-
kart-im.com
-
neothecode.com
-
fishingpeer.com
-
soulcave.xyz
-
bobqp6.com
-
phonpiegift.club
-
veteranmadecontent.com
-
domini-o-pessoal.com
-
featuredtv.com
-
thebugbros.com
-
gamedesignpostmortem.com
-
equineluv.com
-
zhongden.com
-
pbwts.com
-
codedad.club
-
lookoutwineclub.com
-
rbsuee.com
-
incrediwix.com
-
jumben.xyz
-
powerbikemonkey.com
-
astrowarrier.com
-
youjustbelieve.com
-
point1properties.com
-
heredley.com
-
mgrernn.xyz
-
tdmshops.com
-
nutritionlives.com
-
pb9hytgb5wry7.net
-
discoverafrica365.com
-
ematry.com
-
disneyholics.com
-
quelbelart.com
-
worldwidetrafficker.com
-
papervapors.com
-
qhxzddc.com
-
lofifoodie.com
-
icknw.com
-
aadudnd3.life
-
getsuccesnow.com
-
qs-dress.com
-
mstaffingagency.com
-
sexmomsonsister.cloud
-
sarahbell.net
-
alltrendsbrands.com
-
tostonet.com
-
mokrie-pizdi.site
-
limpieza-facial.com
-
nordinenas.ovh
-
sietec.science
-
duecugini.com
-
domentemenegi54.net
-
15055984691.com
-
cyland.net
-
interviewsbybethany.com
-
hmg777g.com
-
ryandouglaspublishing.com
-
wineenthusiasms.com
-
thefeelgoodsisters.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/4104-2-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/4104-3-0x000000000041ED70-mapping.dmp formbook behavioral2/memory/3688-5-0x0000000000000000-mapping.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4768 set thread context of 4104 4768 invoic.exe 74 PID 4104 set thread context of 2576 4104 invoic.exe 16 PID 3688 set thread context of 2576 3688 cmd.exe 16 - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Explorer.EXE - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 4104 invoic.exe 4104 invoic.exe 4104 invoic.exe 4104 invoic.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe 3688 cmd.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 4768 invoic.exe 4104 invoic.exe 4104 invoic.exe 4104 invoic.exe 3688 cmd.exe 3688 cmd.exe - Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 4104 invoic.exe Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeDebugPrivilege 3688 cmd.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2576 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4768 wrote to memory of 4104 4768 invoic.exe 74 PID 4768 wrote to memory of 4104 4768 invoic.exe 74 PID 4768 wrote to memory of 4104 4768 invoic.exe 74 PID 4768 wrote to memory of 4104 4768 invoic.exe 74 PID 2576 wrote to memory of 3688 2576 Explorer.EXE 75 PID 2576 wrote to memory of 3688 2576 Explorer.EXE 75 PID 2576 wrote to memory of 3688 2576 Explorer.EXE 75 PID 3688 wrote to memory of 4168 3688 cmd.exe 79 PID 3688 wrote to memory of 4168 3688 cmd.exe 79 PID 3688 wrote to memory of 4168 3688 cmd.exe 79
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\invoic.exe"C:\Users\Admin\AppData\Local\Temp\invoic.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\invoic.exe"C:\Users\Admin\AppData\Local\Temp\invoic.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4104
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\invoic.exe"3⤵PID:4168
-
-