Analysis
-
max time kernel
145s -
max time network
129s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
22-12-2020 08:20
Static task
static1
Behavioral task
behavioral1
Sample
Payment Order Inv.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Payment Order Inv.exe
Resource
win10v20201028
General
-
Target
Payment Order Inv.exe
-
Size
770KB
-
MD5
66a395765d579f24cf42766d37072416
-
SHA1
e1884c073f2a3c11decba1f914e0ca4d3dc0eb11
-
SHA256
5b59e08e82994cd78df8856c5d7cfd4b30be947a9f7329af1a13d47652b189fc
-
SHA512
2fdf5f7f709ba0b77ba7b9707a8f532e1e5019087c1617b6eeaf362d466a40b7d47672d80a61e0a6c8e249c4ddc1f25d697ba51fd8c33d94cc83c11a020dd3e1
Malware Config
Extracted
formbook
http://www.plantbasedtransporter.com/m98/
anesbensghair.com
crewsquid.com
thetekapp.com
africaisin.com
dodailyworkout.com
al-sultangate.com
aliciafowens.com
bbluebelt3dwdbuy.com
qjpay.pro
emotionalgun.club
guapasnatural.com
myessentials2020.com
cw-mag.com
petrousd.com
byyter.com
hima-tubusi.com
chapelcouture.com
thehollowcause.site
moskovganteng.com
2024project.com
olenfex.com
caiyisan.com
1d2g3m.com
aronaw.com
frontierautoglasslockport.com
pay-misfeel.com
noemiluquerodin.com
860703.com
management-h2g.com
chinadrac.com
click2hr.com
turf-safe.com
siltect.com
ash3ntv.com
carinsurably.com
saamacapital.com
bruceeng.com
agenciaebano.com
moscowcity.business
yogapants.xyz
lagoseyecenter.com
forccartex-tw.com
mytravel.travel
support-login-online.network
drinksbyfuego.com
quicksigningdoc.com
mikmake.net
sineflik.com
ekreysert.com
lifeinspiredgifts.com
ezpassnny.com
diskrab.com
masterbrandcabinetry.com
cosplaymaroc.com
xr3m.com
lakecharlesloan.com
parcelwolf.com
hellosunnyco.com
misery-indexrain.com
mysweetdreamsart.com
rothretirementsolutions.com
conecsa.group
onlinepedidos.com
learnstartupdesign.com
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1636-4-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1636-5-0x000000000041EB30-mapping.dmp formbook behavioral1/memory/428-6-0x0000000000000000-mapping.dmp formbook -
ModiLoader First Stage 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1084-2-0x00000000002B0000-0x00000000002CA000-memory.dmp modiloader_stage1 -
Adds policy Run key to start application 2 TTPs 1 IoCs
Processes:
systray.exedescription ioc process Key created \Registry\User\S-1-5-21-293278959-2699126792-324916226-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run systray.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
Payment Order Inv.exesystray.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\tjlG = "C:\\Users\\Admin\\AppData\\Local\\tjlG.url" Payment Order Inv.exe Key created \Registry\User\S-1-5-21-293278959-2699126792-324916226-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run systray.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\HX4XDXN0V = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" systray.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Payment Order Inv.exeieinstal.exesystray.exedescription pid process target process PID 1084 set thread context of 1636 1084 Payment Order Inv.exe ieinstal.exe PID 1636 set thread context of 1236 1636 ieinstal.exe Explorer.EXE PID 428 set thread context of 1236 428 systray.exe Explorer.EXE -
Processes:
systray.exedescription ioc process Key created \Registry\User\S-1-5-21-293278959-2699126792-324916226-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 systray.exe -
Processes:
Payment Order Inv.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Payment Order Inv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Payment Order Inv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Payment Order Inv.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
ieinstal.exesystray.exepid process 1636 ieinstal.exe 1636 ieinstal.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
ieinstal.exesystray.exepid process 1636 ieinstal.exe 1636 ieinstal.exe 1636 ieinstal.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ieinstal.exesystray.exedescription pid process Token: SeDebugPrivilege 1636 ieinstal.exe Token: SeDebugPrivilege 428 systray.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Payment Order Inv.exeExplorer.EXEsystray.exedescription pid process target process PID 1084 wrote to memory of 1636 1084 Payment Order Inv.exe ieinstal.exe PID 1084 wrote to memory of 1636 1084 Payment Order Inv.exe ieinstal.exe PID 1084 wrote to memory of 1636 1084 Payment Order Inv.exe ieinstal.exe PID 1084 wrote to memory of 1636 1084 Payment Order Inv.exe ieinstal.exe PID 1084 wrote to memory of 1636 1084 Payment Order Inv.exe ieinstal.exe PID 1084 wrote to memory of 1636 1084 Payment Order Inv.exe ieinstal.exe PID 1084 wrote to memory of 1636 1084 Payment Order Inv.exe ieinstal.exe PID 1084 wrote to memory of 1636 1084 Payment Order Inv.exe ieinstal.exe PID 1084 wrote to memory of 1636 1084 Payment Order Inv.exe ieinstal.exe PID 1236 wrote to memory of 428 1236 Explorer.EXE systray.exe PID 1236 wrote to memory of 428 1236 Explorer.EXE systray.exe PID 1236 wrote to memory of 428 1236 Explorer.EXE systray.exe PID 1236 wrote to memory of 428 1236 Explorer.EXE systray.exe PID 428 wrote to memory of 748 428 systray.exe Firefox.exe PID 428 wrote to memory of 748 428 systray.exe Firefox.exe PID 428 wrote to memory of 748 428 systray.exe Firefox.exe PID 428 wrote to memory of 748 428 systray.exe Firefox.exe PID 428 wrote to memory of 748 428 systray.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment Order Inv.exe"C:\Users\Admin\AppData\Local\Temp\Payment Order Inv.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/428-6-0x0000000000000000-mapping.dmp
-
memory/428-7-0x0000000000220000-0x0000000000225000-memory.dmpFilesize
20KB
-
memory/428-8-0x0000000003740000-0x0000000003889000-memory.dmpFilesize
1.3MB
-
memory/428-9-0x0000000003920000-0x0000000003A66000-memory.dmpFilesize
1.3MB
-
memory/568-3-0x000007FEF7800000-0x000007FEF7A7A000-memory.dmpFilesize
2.5MB
-
memory/748-10-0x0000000000000000-mapping.dmp
-
memory/748-11-0x000000013F590000-0x000000013F623000-memory.dmpFilesize
588KB
-
memory/1084-2-0x00000000002B0000-0x00000000002CA000-memory.dmpFilesize
104KB
-
memory/1636-4-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1636-5-0x000000000041EB30-mapping.dmp