Analysis
-
max time kernel
146s -
max time network
136s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-01-2021 06:58
Static task
static1
Behavioral task
behavioral1
Sample
NEW ORDER_pdf.exe
Resource
win7v20201028
General
-
Target
NEW ORDER_pdf.exe
-
Size
602KB
-
MD5
dc743359268cefe59904fa804112f012
-
SHA1
fcc10908413f0122fec5b19e15135957678c70d3
-
SHA256
3df48002a1199ab680bea952851cdc0a93f905f21d09245889d6332af639fe68
-
SHA512
8608789bd57073f65675ff160522fb29f771c6242d508ab0ca391ba22310ff030a1f40bcce5c79c1985c8ca05c3bb3528f488f6246d6d160dd4d152dad2b9752
Malware Config
Extracted
formbook
http://www.freshpixels.agency/wls/
brandcamapp.com
hotels-online.net
godsbaconjitters.com
renpaulhotpot.com
bikescarznguitarz.com
amelclothing.com
zhuqiuhui.space
theolivetreeonline.com
yizddmall.com
junkshoptheatre.com
smithylabs.com
cocokaraget.com
rayscollectibles.com
encinolandscapedesign.com
trzeks1.com
jstracker.net
cloudadventure.zone
emilyshines.com
exiledfg.com
seasisterscoastal.com
danishbilal.com
freisaq.com
namastewellnesscafe.com
internationalaid.global
basketballnewsandupdates.com
vagolfapparel.com
husainramadhan.com
gentlehumans.net
sushiburgersp.com
xfinitycomcasts.com
mybestprinting.com
truckshowofficial.com
consultationindustries.com
mortgage954.com
anaisburrows.online
dukespsychologicalsupports.com
ambient.business
sergesturkishbarber.com
bobkuhn4h2o.com
proline.site
choosingwanderlust.com
runningxtreme.club
grupoecosana.com
cntmdts.com
pcstrategiesva.com
beyoutifulkuw.com
thearcadela.net
weilaitong.net
madorikun.net
kingscoldbrews.com
sindaen.com
lookouttribe.com
timfaganphotography.com
hybrid-veranstaltungen.com
vonryman.com
hhewen.com
024mtp.com
xvault.net
betwox.com
cyclingsunglassestop.com
acselleron.com
elapseachieve.xyz
timthonailonline.com
puertoricoartsandcrafts.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2336-11-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2336-12-0x000000000041EBD0-mapping.dmp formbook behavioral2/memory/2924-14-0x0000000000000000-mapping.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
NEW ORDER_pdf.exeNEW ORDER_pdf.exeNETSTAT.EXEdescription pid process target process PID 576 set thread context of 2336 576 NEW ORDER_pdf.exe NEW ORDER_pdf.exe PID 2336 set thread context of 3040 2336 NEW ORDER_pdf.exe Explorer.EXE PID 2924 set thread context of 3040 2924 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 2924 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
NEW ORDER_pdf.exeNETSTAT.EXEpid process 2336 NEW ORDER_pdf.exe 2336 NEW ORDER_pdf.exe 2336 NEW ORDER_pdf.exe 2336 NEW ORDER_pdf.exe 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE 2924 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
NEW ORDER_pdf.exeNETSTAT.EXEpid process 2336 NEW ORDER_pdf.exe 2336 NEW ORDER_pdf.exe 2336 NEW ORDER_pdf.exe 2924 NETSTAT.EXE 2924 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
NEW ORDER_pdf.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 2336 NEW ORDER_pdf.exe Token: SeDebugPrivilege 2924 NETSTAT.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3040 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
NEW ORDER_pdf.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 576 wrote to memory of 2336 576 NEW ORDER_pdf.exe NEW ORDER_pdf.exe PID 576 wrote to memory of 2336 576 NEW ORDER_pdf.exe NEW ORDER_pdf.exe PID 576 wrote to memory of 2336 576 NEW ORDER_pdf.exe NEW ORDER_pdf.exe PID 576 wrote to memory of 2336 576 NEW ORDER_pdf.exe NEW ORDER_pdf.exe PID 576 wrote to memory of 2336 576 NEW ORDER_pdf.exe NEW ORDER_pdf.exe PID 576 wrote to memory of 2336 576 NEW ORDER_pdf.exe NEW ORDER_pdf.exe PID 3040 wrote to memory of 2924 3040 Explorer.EXE NETSTAT.EXE PID 3040 wrote to memory of 2924 3040 Explorer.EXE NETSTAT.EXE PID 3040 wrote to memory of 2924 3040 Explorer.EXE NETSTAT.EXE PID 2924 wrote to memory of 1444 2924 NETSTAT.EXE cmd.exe PID 2924 wrote to memory of 1444 2924 NETSTAT.EXE cmd.exe PID 2924 wrote to memory of 1444 2924 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER_pdf.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER_pdf.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\NEW ORDER_pdf.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/576-9-0x00000000061A0000-0x0000000006220000-memory.dmpFilesize
512KB
-
memory/576-5-0x0000000005800000-0x0000000005801000-memory.dmpFilesize
4KB
-
memory/576-6-0x00000000053A0000-0x00000000053A1000-memory.dmpFilesize
4KB
-
memory/576-7-0x0000000005510000-0x0000000005511000-memory.dmpFilesize
4KB
-
memory/576-8-0x0000000005590000-0x000000000559E000-memory.dmpFilesize
56KB
-
memory/576-3-0x0000000000970000-0x0000000000971000-memory.dmpFilesize
4KB
-
memory/576-10-0x00000000062C0000-0x00000000062C1000-memory.dmpFilesize
4KB
-
memory/576-2-0x0000000073190000-0x000000007387E000-memory.dmpFilesize
6.9MB
-
memory/1444-17-0x0000000000000000-mapping.dmp
-
memory/2336-11-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2336-12-0x000000000041EBD0-mapping.dmp
-
memory/2924-14-0x0000000000000000-mapping.dmp
-
memory/2924-15-0x0000000000A50000-0x0000000000A5B000-memory.dmpFilesize
44KB
-
memory/2924-16-0x0000000000A50000-0x0000000000A5B000-memory.dmpFilesize
44KB
-
memory/2924-18-0x0000000004480000-0x0000000004516000-memory.dmpFilesize
600KB