Analysis
- max time kernel
145s - max time network
129s - platform
windows7_x64 - resource
win7v20201028 - submitted
22/12/2020, 08:20
Static task
static1
Behavioral task
behavioral1
Sample
Payment Order Inv.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Payment Order Inv.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target Payment Order Inv.exe
- Size 770KB
- Sample201222-sdnwbnfm6s
- SHA256 5b59e08e82994cd78df8856c5d7cfd4b30be947a9f7329af1a13d47652b189fc
- MD5 66a395765d579f24cf42766d37072416
- SHA1 e1884c073f2a3c11decba1f914e0ca4d3dc0eb11
- SHA512 2fdf5f7f709ba0b77ba7b9707a8f532e1e5019087c1617b6eeaf362d466a40b7d47672d80a61e0a6c8e249c4ddc1f25d697ba51fd8c33d94cc83c11a020dd3e1
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.plantbasedtransporter.com/m98/
Decoy
-
anesbensghair.com
-
crewsquid.com
-
thetekapp.com
-
africaisin.com
-
dodailyworkout.com
-
al-sultangate.com
-
aliciafowens.com
-
bbluebelt3dwdbuy.com
-
qjpay.pro
-
emotionalgun.club
-
guapasnatural.com
-
myessentials2020.com
-
cw-mag.com
-
petrousd.com
-
byyter.com
-
hima-tubusi.com
-
chapelcouture.com
-
thehollowcause.site
-
moskovganteng.com
-
2024project.com
-
olenfex.com
-
caiyisan.com
-
1d2g3m.com
-
aronaw.com
-
frontierautoglasslockport.com
-
pay-misfeel.com
-
noemiluquerodin.com
-
860703.com
-
management-h2g.com
-
chinadrac.com
-
click2hr.com
-
turf-safe.com
-
siltect.com
-
ash3ntv.com
-
carinsurably.com
-
saamacapital.com
-
bruceeng.com
-
agenciaebano.com
-
moscowcity.business
-
yogapants.xyz
-
lagoseyecenter.com
-
forccartex-tw.com
-
mytravel.travel
-
support-login-online.network
-
drinksbyfuego.com
-
quicksigningdoc.com
-
mikmake.net
-
sineflik.com
-
ekreysert.com
-
lifeinspiredgifts.com
-
ezpassnny.com
-
diskrab.com
-
masterbrandcabinetry.com
-
cosplaymaroc.com
-
xr3m.com
-
lakecharlesloan.com
-
parcelwolf.com
-
hellosunnyco.com
-
misery-indexrain.com
-
mysweetdreamsart.com
-
rothretirementsolutions.com
-
conecsa.group
-
onlinepedidos.com
-
learnstartupdesign.com
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Formbook Payload 3 IoCs
resource yara_rule behavioral1/memory/1636-4-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1636-5-0x000000000041EB30-mapping.dmp formbook behavioral1/memory/428-6-0x0000000000000000-mapping.dmp formbook - ModiLoader First Stage 1 IoCs
resource yara_rule behavioral1/memory/1084-2-0x00000000002B0000-0x00000000002CA000-memory.dmp modiloader_stage1 - Adds policy Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-293278959-2699126792-324916226-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run systray.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\tjlG = "C:\\Users\\Admin\\AppData\\Local\\tjlG.url" Payment Order Inv.exe Key created \Registry\User\S-1-5-21-293278959-2699126792-324916226-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run systray.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\HX4XDXN0V = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" systray.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1084 set thread context of 1636 1084 Payment Order Inv.exe 31 PID 1636 set thread context of 1236 1636 ieinstal.exe 11 PID 428 set thread context of 1236 428 systray.exe 11 -
description ioc Process Key created \Registry\User\S-1-5-21-293278959-2699126792-324916226-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 systray.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Payment Order Inv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Payment Order Inv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Payment Order Inv.exe - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1636 ieinstal.exe 1636 ieinstal.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1636 ieinstal.exe 1636 ieinstal.exe 1636 ieinstal.exe 428 systray.exe 428 systray.exe 428 systray.exe 428 systray.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1636 ieinstal.exe Token: SeDebugPrivilege 428 systray.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1084 wrote to memory of 1636 1084 Payment Order Inv.exe 31 PID 1084 wrote to memory of 1636 1084 Payment Order Inv.exe 31 PID 1084 wrote to memory of 1636 1084 Payment Order Inv.exe 31 PID 1084 wrote to memory of 1636 1084 Payment Order Inv.exe 31 PID 1084 wrote to memory of 1636 1084 Payment Order Inv.exe 31 PID 1084 wrote to memory of 1636 1084 Payment Order Inv.exe 31 PID 1084 wrote to memory of 1636 1084 Payment Order Inv.exe 31 PID 1084 wrote to memory of 1636 1084 Payment Order Inv.exe 31 PID 1084 wrote to memory of 1636 1084 Payment Order Inv.exe 31 PID 1236 wrote to memory of 428 1236 Explorer.EXE 32 PID 1236 wrote to memory of 428 1236 Explorer.EXE 32 PID 1236 wrote to memory of 428 1236 Explorer.EXE 32 PID 1236 wrote to memory of 428 1236 Explorer.EXE 32 PID 428 wrote to memory of 748 428 systray.exe 33 PID 428 wrote to memory of 748 428 systray.exe 33 PID 428 wrote to memory of 748 428 systray.exe 33 PID 428 wrote to memory of 748 428 systray.exe 33 PID 428 wrote to memory of 748 428 systray.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\Payment Order Inv.exe"C:\Users\Admin\AppData\Local\Temp\Payment Order Inv.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1636
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:748
-
-