Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-01-2021 20:03
Static task
static1
Behavioral task
behavioral1
Sample
NEW ORDER_pdf.exe
Resource
win7v20201028
General
-
Target
NEW ORDER_pdf.exe
-
Size
895KB
-
MD5
8e1ad5c73d1b372892f6c15df6bf9ccd
-
SHA1
3a48d338e78b76d76beb124a1b51f53950a2da17
-
SHA256
7ca6fd35f23ebe9ef2a3dc7a1d6e95fa1569a80eff9987e2b4126c3b757aabda
-
SHA512
0915102ee77a2115399e86699c5bf9fd5d51322d39c212cd3ee7c917d20c7d258f1bc9b6ea358f2f10ef36dae63f2104ee75b72c4b883d08befbc3f7ea27c53b
Malware Config
Extracted
formbook
http://www.freshpixels.agency/wls/
brandcamapp.com
hotels-online.net
godsbaconjitters.com
renpaulhotpot.com
bikescarznguitarz.com
amelclothing.com
zhuqiuhui.space
theolivetreeonline.com
yizddmall.com
junkshoptheatre.com
smithylabs.com
cocokaraget.com
rayscollectibles.com
encinolandscapedesign.com
trzeks1.com
jstracker.net
cloudadventure.zone
emilyshines.com
exiledfg.com
seasisterscoastal.com
danishbilal.com
freisaq.com
namastewellnesscafe.com
internationalaid.global
basketballnewsandupdates.com
vagolfapparel.com
husainramadhan.com
gentlehumans.net
sushiburgersp.com
xfinitycomcasts.com
mybestprinting.com
truckshowofficial.com
consultationindustries.com
mortgage954.com
anaisburrows.online
dukespsychologicalsupports.com
ambient.business
sergesturkishbarber.com
bobkuhn4h2o.com
proline.site
choosingwanderlust.com
runningxtreme.club
grupoecosana.com
cntmdts.com
pcstrategiesva.com
beyoutifulkuw.com
thearcadela.net
weilaitong.net
madorikun.net
kingscoldbrews.com
sindaen.com
lookouttribe.com
timfaganphotography.com
hybrid-veranstaltungen.com
vonryman.com
hhewen.com
024mtp.com
xvault.net
betwox.com
cyclingsunglassestop.com
acselleron.com
elapseachieve.xyz
timthonailonline.com
puertoricoartsandcrafts.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3592-11-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3592-12-0x000000000041EBD0-mapping.dmp formbook behavioral2/memory/2232-13-0x0000000000000000-mapping.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
NEW ORDER_pdf.exeNEW ORDER_pdf.execontrol.exedescription pid process target process PID 3992 set thread context of 3592 3992 NEW ORDER_pdf.exe NEW ORDER_pdf.exe PID 3592 set thread context of 3036 3592 NEW ORDER_pdf.exe Explorer.EXE PID 2232 set thread context of 3036 2232 control.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
NEW ORDER_pdf.execontrol.exepid process 3592 NEW ORDER_pdf.exe 3592 NEW ORDER_pdf.exe 3592 NEW ORDER_pdf.exe 3592 NEW ORDER_pdf.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe 2232 control.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
NEW ORDER_pdf.execontrol.exepid process 3592 NEW ORDER_pdf.exe 3592 NEW ORDER_pdf.exe 3592 NEW ORDER_pdf.exe 2232 control.exe 2232 control.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
NEW ORDER_pdf.execontrol.exedescription pid process Token: SeDebugPrivilege 3592 NEW ORDER_pdf.exe Token: SeDebugPrivilege 2232 control.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3036 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
NEW ORDER_pdf.exeExplorer.EXEcontrol.exedescription pid process target process PID 3992 wrote to memory of 3592 3992 NEW ORDER_pdf.exe NEW ORDER_pdf.exe PID 3992 wrote to memory of 3592 3992 NEW ORDER_pdf.exe NEW ORDER_pdf.exe PID 3992 wrote to memory of 3592 3992 NEW ORDER_pdf.exe NEW ORDER_pdf.exe PID 3992 wrote to memory of 3592 3992 NEW ORDER_pdf.exe NEW ORDER_pdf.exe PID 3992 wrote to memory of 3592 3992 NEW ORDER_pdf.exe NEW ORDER_pdf.exe PID 3992 wrote to memory of 3592 3992 NEW ORDER_pdf.exe NEW ORDER_pdf.exe PID 3036 wrote to memory of 2232 3036 Explorer.EXE control.exe PID 3036 wrote to memory of 2232 3036 Explorer.EXE control.exe PID 3036 wrote to memory of 2232 3036 Explorer.EXE control.exe PID 2232 wrote to memory of 2148 2232 control.exe cmd.exe PID 2232 wrote to memory of 2148 2232 control.exe cmd.exe PID 2232 wrote to memory of 2148 2232 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\NEW ORDER_pdf.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\NEW ORDER_pdf.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3592 -
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\NEW ORDER_pdf.exe"3⤵PID:2148
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2148-16-0x0000000000000000-mapping.dmp
-
memory/2232-17-0x00000000061C0000-0x0000000006261000-memory.dmpFilesize
644KB
-
memory/2232-15-0x0000000001090000-0x00000000010B0000-memory.dmpFilesize
128KB
-
memory/2232-14-0x0000000001090000-0x00000000010B0000-memory.dmpFilesize
128KB
-
memory/2232-13-0x0000000000000000-mapping.dmp
-
memory/3592-11-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3592-12-0x000000000041EBD0-mapping.dmp
-
memory/3992-6-0x0000000007A60000-0x0000000007A61000-memory.dmpFilesize
4KB
-
memory/3992-10-0x0000000009DC0000-0x0000000009DC1000-memory.dmpFilesize
4KB
-
memory/3992-9-0x0000000002F90000-0x0000000003022000-memory.dmpFilesize
584KB
-
memory/3992-8-0x0000000007CD0000-0x0000000007CDE000-memory.dmpFilesize
56KB
-
memory/3992-7-0x0000000005640000-0x0000000005641000-memory.dmpFilesize
4KB
-
memory/3992-2-0x00000000738E0000-0x0000000073FCE000-memory.dmpFilesize
6.9MB
-
memory/3992-5-0x0000000007F60000-0x0000000007F61000-memory.dmpFilesize
4KB
-
memory/3992-3-0x0000000000BE0000-0x0000000000BE1000-memory.dmpFilesize
4KB