Analysis
-
max time kernel
151s -
max time network
91s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 07:32
Static task
static1
Behavioral task
behavioral1
Sample
ORDER_LIST.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
ORDER_LIST.exe
Resource
win10v20201028
General
-
Target
ORDER_LIST.exe
-
Size
1.1MB
-
MD5
fa181a9414347d63137af021b2141cd6
-
SHA1
ccf670892b360b42fa7426de02a3e7629f333841
-
SHA256
3a04294c74c076d017ac8f59b506f735547d31472f7480cb6652dea5e3a2816c
-
SHA512
f2415e6563abfb25872b338edb2cc41a1f10a55cc6084c79c026dc4c1cec4bb952a36251b0f2bdde736d019805bfbf3d67f57e01b726d034cecb32984195e821
Malware Config
Extracted
formbook
http://www.merckcbd.com/dei5/
studiomullerphoto.com
reallionairewear.com
dogsalondoggy-tail.com
excelmache.net
bigdiscounters.com
7986799.com
ignition.guru
xiaoxu.info
jpinpd.com
solpool.info
uchooswrewards.com
everestengineeringworks.com
qianglongzhipin.com
deepimper-325.com
appliedrate.com
radsazemehr.com
vivabematividadesfisicas.com
capacitalo.com
somecore.com
listingclass.net
romel.codes
mybettermentor.com
hxc43.com
btccvil312723.com
rudiskenya.com
internationalrockmusic.com
wudiwifi.com
scienceacademyraj.com
tumulusinnovations.com
studioeduardobeninca.com
formabench.com
ribbonredwhiteandblue.com
miningequipmentrental.com
myamom.com
riversportswear.net
14505glenmarkdr.com
nikolcosmetic.com
toninopr.com
cutfortheconnect.com
nl22584.com
mezokovesd.com
rozhandesign.com
futbolki.space
rmobipanoshop.com
merchmuslim.com
recurrentcornealerosion.com
enottampan.com
vasquez.photos
koreanmindbeauty.com
andressabode.com
thetwolouises.com
weberbyroble.com
followmargpolo.com
englishclubb.online
sorryididnthearthat.com
greatlookfashion.club
cartoleriagrillocatania.com
esteprize.com
sdsej.com
phiecraft.xyz
psm-gen.com
passivefiresafe.com
homeyplantycosy.com
0343888.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/568-10-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/568-11-0x000000000041ECD0-mapping.dmp formbook behavioral1/memory/1096-21-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1168 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
ORDER_LIST.exeORDER_LIST.exesvchost.exedescription pid process target process PID 1432 set thread context of 568 1432 ORDER_LIST.exe ORDER_LIST.exe PID 568 set thread context of 1260 568 ORDER_LIST.exe Explorer.EXE PID 568 set thread context of 1260 568 ORDER_LIST.exe Explorer.EXE PID 1096 set thread context of 1260 1096 svchost.exe Explorer.EXE -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
ORDER_LIST.exeORDER_LIST.exesvchost.exepid process 1432 ORDER_LIST.exe 568 ORDER_LIST.exe 568 ORDER_LIST.exe 568 ORDER_LIST.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
ORDER_LIST.exesvchost.exepid process 568 ORDER_LIST.exe 568 ORDER_LIST.exe 568 ORDER_LIST.exe 568 ORDER_LIST.exe 1096 svchost.exe 1096 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
ORDER_LIST.exeORDER_LIST.exesvchost.exedescription pid process Token: SeDebugPrivilege 1432 ORDER_LIST.exe Token: SeDebugPrivilege 568 ORDER_LIST.exe Token: SeDebugPrivilege 1096 svchost.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
ORDER_LIST.exeExplorer.EXEsvchost.exedescription pid process target process PID 1432 wrote to memory of 1272 1432 ORDER_LIST.exe schtasks.exe PID 1432 wrote to memory of 1272 1432 ORDER_LIST.exe schtasks.exe PID 1432 wrote to memory of 1272 1432 ORDER_LIST.exe schtasks.exe PID 1432 wrote to memory of 1272 1432 ORDER_LIST.exe schtasks.exe PID 1432 wrote to memory of 568 1432 ORDER_LIST.exe ORDER_LIST.exe PID 1432 wrote to memory of 568 1432 ORDER_LIST.exe ORDER_LIST.exe PID 1432 wrote to memory of 568 1432 ORDER_LIST.exe ORDER_LIST.exe PID 1432 wrote to memory of 568 1432 ORDER_LIST.exe ORDER_LIST.exe PID 1432 wrote to memory of 568 1432 ORDER_LIST.exe ORDER_LIST.exe PID 1432 wrote to memory of 568 1432 ORDER_LIST.exe ORDER_LIST.exe PID 1432 wrote to memory of 568 1432 ORDER_LIST.exe ORDER_LIST.exe PID 1260 wrote to memory of 1096 1260 Explorer.EXE svchost.exe PID 1260 wrote to memory of 1096 1260 Explorer.EXE svchost.exe PID 1260 wrote to memory of 1096 1260 Explorer.EXE svchost.exe PID 1260 wrote to memory of 1096 1260 Explorer.EXE svchost.exe PID 1096 wrote to memory of 1168 1096 svchost.exe cmd.exe PID 1096 wrote to memory of 1168 1096 svchost.exe cmd.exe PID 1096 wrote to memory of 1168 1096 svchost.exe cmd.exe PID 1096 wrote to memory of 1168 1096 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ORDER_LIST.exe"C:\Users\Admin\AppData\Local\Temp\ORDER_LIST.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bEWIuckEckK" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFCB6.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\ORDER_LIST.exe"C:\Users\Admin\AppData\Local\Temp\ORDER_LIST.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ORDER_LIST.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpFCB6.tmpMD5
50786655978535d57106b578f7fd933b
SHA16122315c5f2a4e0ef643eea847ea85e87a6108b2
SHA256abbd2c57276206d9bdaa27a1e9d075b50968e504749dc4f5a0db1f1b34339d0c
SHA512e9c3b1dfc3c5041186d27a0e5bb54f116846873f24bf730fe079cc03d376ee6e2fe8e67e58684416ce081a0d4aa9cc4e108b3d2f403d688b8a1993525cc76d44
-
memory/568-16-0x0000000000370000-0x0000000000384000-memory.dmpFilesize
80KB
-
memory/568-10-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/568-11-0x000000000041ECD0-mapping.dmp
-
memory/568-13-0x0000000000810000-0x0000000000B13000-memory.dmpFilesize
3.0MB
-
memory/568-14-0x00000000001D0000-0x00000000001E4000-memory.dmpFilesize
80KB
-
memory/1096-23-0x0000000000580000-0x0000000000613000-memory.dmpFilesize
588KB
-
memory/1096-22-0x0000000000960000-0x0000000000C63000-memory.dmpFilesize
3.0MB
-
memory/1096-21-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/1096-20-0x0000000000450000-0x0000000000458000-memory.dmpFilesize
32KB
-
memory/1096-18-0x0000000000000000-mapping.dmp
-
memory/1168-19-0x0000000000000000-mapping.dmp
-
memory/1260-15-0x0000000006600000-0x000000000677F000-memory.dmpFilesize
1.5MB
-
memory/1260-17-0x0000000006F00000-0x00000000070A8000-memory.dmpFilesize
1.7MB
-
memory/1272-8-0x0000000000000000-mapping.dmp
-
memory/1432-2-0x0000000074520000-0x0000000074C0E000-memory.dmpFilesize
6.9MB
-
memory/1432-7-0x0000000002100000-0x00000000021AD000-memory.dmpFilesize
692KB
-
memory/1432-6-0x0000000000660000-0x0000000000673000-memory.dmpFilesize
76KB
-
memory/1432-5-0x0000000004E30000-0x0000000004E31000-memory.dmpFilesize
4KB
-
memory/1432-3-0x0000000000BD0000-0x0000000000BD1000-memory.dmpFilesize
4KB