Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-01-2021 18:20
Static task
static1
Behavioral task
behavioral1
Sample
order no.0118-21.exe
Resource
win7v20201028
General
-
Target
order no.0118-21.exe
-
Size
1.1MB
-
MD5
ea3b95545772a4401f0978721eef7353
-
SHA1
1828a711a093a3f974a420cf12fa3d67c48bd3a8
-
SHA256
6a7659b4614c990d4feba15eeef035d47dcb8f46d92320620205eb6131eaf6a4
-
SHA512
2dc1946ae0113e51c248c7308aa7efc59a6cdea9bb40b17e6bf6b69660095eb64af71f3b3f0ec6657bf800e00938d51b3f53060e9da8065703c22067e0b2c342
Malware Config
Extracted
formbook
http://www.paniciagency.com/n6sn/
siearrasmission.com
exploringcharlotte.com
michaelthomasgunn.com
automationmarketers.com
vynxcl3kv3.com
df2229.com
vazivaimmo.net
usful.info
vescuderoabogados.com
janidevco.com
newshum.com
teamworkgod.com
snowwayconstruction.com
s8fyit.com
economicidentity.com
jennysay.com
gamoauction.com
thebooksofblood.com
graymatter-bi.com
newtownquick.net
howtoopenabeerwith.com
titimo.com
triangleurope.com
kayleecorner.com
aloveforbooks.com
pausmam.com
soldbylydia.com
unangelo.online
crohix.com
biezonskyrealty.net
nasmgmt.com
customersforlifeworkshop.com
mobilecomputerreps.com
rorricsafaris.com
3937899.com
driftcoin.com
vict.pro
allseasonsroofingsiding.net
finelinecare.com
consultantsapp.com
rangers3.xyz
les-bocaux.com
sou1.net
toddsmenswear.com
neptuneresto.com
barrierbeat.com
kordantravel.com
letterstogeorgie.com
brcond.com
slowcourt.com
shopsituyenphuongxuan.com
surwitlife.com
bklovecoach.com
albertafreeman.com
takingcarababiea.com
cnhremandealerservice.com
specializednurse.com
mymelodiousworld.com
kboom.fan
wildalaskacodcompany.com
temperpoint.com
coingrave.com
hosefire.com
heyimlulu.xyz
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1096-14-0x000000000041ED20-mapping.dmp formbook behavioral2/memory/1096-13-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/564-21-0x0000000002370000-0x000000000239E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
order no.0118-21.exeorder no.0118-21.exewlanext.exedescription pid process target process PID 4092 set thread context of 1096 4092 order no.0118-21.exe order no.0118-21.exe PID 1096 set thread context of 2756 1096 order no.0118-21.exe Explorer.EXE PID 564 set thread context of 2756 564 wlanext.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
order no.0118-21.exewlanext.exepid process 1096 order no.0118-21.exe 1096 order no.0118-21.exe 1096 order no.0118-21.exe 1096 order no.0118-21.exe 564 wlanext.exe 564 wlanext.exe 564 wlanext.exe 564 wlanext.exe 564 wlanext.exe 564 wlanext.exe 564 wlanext.exe 564 wlanext.exe 564 wlanext.exe 564 wlanext.exe 564 wlanext.exe 564 wlanext.exe 564 wlanext.exe 564 wlanext.exe 564 wlanext.exe 564 wlanext.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
order no.0118-21.exewlanext.exepid process 1096 order no.0118-21.exe 1096 order no.0118-21.exe 1096 order no.0118-21.exe 564 wlanext.exe 564 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
order no.0118-21.exewlanext.exedescription pid process Token: SeDebugPrivilege 1096 order no.0118-21.exe Token: SeDebugPrivilege 564 wlanext.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
order no.0118-21.exeExplorer.EXEwlanext.exedescription pid process target process PID 4092 wrote to memory of 1096 4092 order no.0118-21.exe order no.0118-21.exe PID 4092 wrote to memory of 1096 4092 order no.0118-21.exe order no.0118-21.exe PID 4092 wrote to memory of 1096 4092 order no.0118-21.exe order no.0118-21.exe PID 4092 wrote to memory of 1096 4092 order no.0118-21.exe order no.0118-21.exe PID 4092 wrote to memory of 1096 4092 order no.0118-21.exe order no.0118-21.exe PID 4092 wrote to memory of 1096 4092 order no.0118-21.exe order no.0118-21.exe PID 2756 wrote to memory of 564 2756 Explorer.EXE wlanext.exe PID 2756 wrote to memory of 564 2756 Explorer.EXE wlanext.exe PID 2756 wrote to memory of 564 2756 Explorer.EXE wlanext.exe PID 564 wrote to memory of 1424 564 wlanext.exe cmd.exe PID 564 wrote to memory of 1424 564 wlanext.exe cmd.exe PID 564 wrote to memory of 1424 564 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\order no.0118-21.exe"C:\Users\Admin\AppData\Local\Temp\order no.0118-21.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\order no.0118-21.exe"C:\Users\Admin\AppData\Local\Temp\order no.0118-21.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1096 -
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\order no.0118-21.exe"3⤵PID:1424
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/564-19-0x0000000000000000-mapping.dmp
-
memory/564-24-0x0000000002F70000-0x0000000003003000-memory.dmpFilesize
588KB
-
memory/564-23-0x0000000002C50000-0x0000000002F70000-memory.dmpFilesize
3.1MB
-
memory/564-20-0x0000000000350000-0x0000000000367000-memory.dmpFilesize
92KB
-
memory/564-21-0x0000000002370000-0x000000000239E000-memory.dmpFilesize
184KB
-
memory/1096-14-0x000000000041ED20-mapping.dmp
-
memory/1096-13-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1096-17-0x0000000001610000-0x0000000001624000-memory.dmpFilesize
80KB
-
memory/1096-16-0x0000000001AD0000-0x0000000001DF0000-memory.dmpFilesize
3.1MB
-
memory/1424-22-0x0000000000000000-mapping.dmp
-
memory/2756-18-0x0000000002B60000-0x0000000002C84000-memory.dmpFilesize
1.1MB
-
memory/2756-25-0x00000000065A0000-0x00000000066B8000-memory.dmpFilesize
1.1MB
-
memory/4092-2-0x00000000739A0000-0x000000007408E000-memory.dmpFilesize
6.9MB
-
memory/4092-12-0x00000000015E0000-0x0000000001690000-memory.dmpFilesize
704KB
-
memory/4092-11-0x0000000005740000-0x0000000005753000-memory.dmpFilesize
76KB
-
memory/4092-9-0x0000000005970000-0x0000000005971000-memory.dmpFilesize
4KB
-
memory/4092-8-0x0000000003230000-0x0000000003231000-memory.dmpFilesize
4KB
-
memory/4092-7-0x0000000005810000-0x0000000005811000-memory.dmpFilesize
4KB
-
memory/4092-6-0x0000000005D10000-0x0000000005D11000-memory.dmpFilesize
4KB
-
memory/4092-10-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/4092-5-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/4092-3-0x0000000000D40000-0x0000000000D41000-memory.dmpFilesize
4KB