Analysis
- max time kernel
150s - max time network
135s - platform
windows10_x64 - resource
win10v20201028 - submitted
07/01/2021, 14:10
Static task
static1
Behavioral task
behavioral1
Sample
Order.exe
Resource
win7v20201028
windows7_x64
General
- Target Order.exe
- Size 197KB
- Sample210107-rem2pwysqj
- SHA256 ee8ac19b40be65306741e69e41cc3768e469fedd9a55b8a1ff3a24723f6fd6da
- MD5 2c70b05c931e9d4c5a419fbbfa036ce5
- SHA1 9cc17b0fca3d206f7d47f6e75dbbe1b57f49cbcf
- SHA512 09840fdf9c466917d4dd32ee10ee772b3c951fbd0390cbfd7be3c567ccabf3e41b88943e61ce907d6a306074bb1851fa9c4569a9168dcbdf1e1a37e179646436
- MD5 SHA1 SHA512
Malware Config
Extracted
-
formbook
-
http://www.nationshiphop.com/hko6/
-
apartmentsineverettwa.com
-
forritcu.net
-
hotroodes.com
-
skinnerttc.com
-
royaltrustmyanmar.com
-
adreslog.com
-
kaysbridalboutiques.com
-
multitask-improvements.com
-
geniiforum.com
-
smarthomehatinh.asia
-
banglikeaboss.com
-
javlover.club
-
affiliateclubindia.com
-
mycapecoralhomevalue.com
-
comparamuebles.online
-
newrochellenissan.com
-
nairobi-paris.com
-
fwk.xyz
-
downdepot.com
-
nextgenmemorabilia.com
-
achonabu.com
-
stevebana.xyz
-
jacmkt.com
-
weownthenight187.com
-
divshop.pro
-
wewearceylon.com
-
skyreadymix.net
-
jaffacorner.com
-
bakerlibra.icu
-
femalecoliving.com
-
best20banks.com
-
millcityloam.com
-
signature-office.com
-
qlifepharmacy.com
-
dextermind.net
-
fittcycleacademy.com
-
davidoff.sucks
-
1033393.com
-
tutorsboulder.com
-
bonicc.com
-
goodberryjuice.com
-
zhaowulu.com
-
teryaq.media
-
a-zsolutionsllc.com
-
bitcoincandy.xyz
-
cfmfair.com
-
annefontain.com
-
princesssexyluxwear.com
-
prodigybrushes.com
-
zzhqp.com
-
hwcailing.com
-
translatiions.com
-
azery.site
-
wy1917.com
-
ringohouse.info
-
chartershome.com
-
thongtinhay.net
-
2201virginiacondo5.com
-
laurieryork.net
-
mujeresnegociantes.com
-
anchoriaswimwear.com
-
michaelsala.com
-
esdeportebici.com
-
ninjitsoo.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/2388-2-0x0000000000700000-0x000000000072E000-memory.dmp formbook behavioral2/memory/2388-3-0x000000000071ECF0-mapping.dmp formbook behavioral2/memory/2856-7-0x0000000000000000-mapping.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 988 set thread context of 2388 988 Order.exe 75 PID 2388 set thread context of 2784 2388 Order.exe 21 PID 2856 set thread context of 2784 2856 svchost.exe 21 - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 2388 Order.exe 2388 Order.exe 2388 Order.exe 2388 Order.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 988 Order.exe 988 Order.exe 2388 Order.exe 2388 Order.exe 2388 Order.exe 2856 svchost.exe 2856 svchost.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2388 Order.exe Token: SeDebugPrivilege 2856 svchost.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2784 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 988 wrote to memory of 2388 988 Order.exe 75 PID 988 wrote to memory of 2388 988 Order.exe 75 PID 988 wrote to memory of 2388 988 Order.exe 75 PID 988 wrote to memory of 2388 988 Order.exe 75 PID 2784 wrote to memory of 2856 2784 Explorer.EXE 76 PID 2784 wrote to memory of 2856 2784 Explorer.EXE 76 PID 2784 wrote to memory of 2856 2784 Explorer.EXE 76 PID 2856 wrote to memory of 204 2856 svchost.exe 80 PID 2856 wrote to memory of 204 2856 svchost.exe 80 PID 2856 wrote to memory of 204 2856 svchost.exe 80
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\Order.exe"C:\Users\Admin\AppData\Local\Temp\Order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\Order.exe"C:\Users\Admin\AppData\Local\Temp\Order.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2388
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Order.exe"3⤵PID:204
-
-