Analysis
-
max time kernel
147s -
max time network
140s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
25-02-2021 19:30
Static task
static1
Behavioral task
behavioral1
Sample
Shipment Document BL,INV and packing list.exe
Resource
win7v20201028
General
-
Target
Shipment Document BL,INV and packing list.exe
-
Size
454KB
-
MD5
553cd6156563de1a6bd068761a8b8066
-
SHA1
bb500d28f113b37cdfa4d09f160a417214188ac2
-
SHA256
10d80e3275154e9e39e98d3622a7af4f98a5fd1f0a073839d9e8d670cbd5d3e6
-
SHA512
9750b665cf70d9b9000f11edeb26a77d7a0bc8b294aaeb948e51b8abc8239c1801b5b8784bdefef887141e7cda1759263e6e68cf18d1f63432eeb211d63b032b
Malware Config
Extracted
formbook
http://www.webperb.com/nehc/
havenmaple.com
katrinasmarket.com
ccharlet.com
everestmedicalgroupusa.net
powervoc.com
crypto300cluv.com
davidrichterlaw.com
parkcitysongfest.com
videogeniusawards.com
beleave.club
gooddeedprocessing.com
synthsup.com
eceiptsworld.com
infinityanalytics.co.uk
damghair.com
sabaidate.com
guitarsir.com
thebowlingspot.com
denturelabmiami.com
mo-cooking.com
eronbon.com
appleunveils.com
gelisim-elektronik.com
cardinalvaletlax.com
ehot-tech.com
boefem.com
milliemaiden.com
phoenixpure.net
versalita.net
avon.sucks
larutasustentable.com
townleolawi.com
hyejeongfood.com
strategrowth.com
twofiveninetwo.com
bymirzaoglu.com
centrodesaludcrecer.com
pensacolahandymanservices.com
march.wtf
layer.icu
sweetpeamagnoliaco.com
palaceelysee.website
silkayra.com
integratednourishment.com
eitalasqueira.com
edfenr-invest.com
rezervacnisystem.online
viassoft.com
sfmfm.com
sangharshbharatnews.com
underdessous.com
luisxe.info
eliveyeyn.com
lavesteenjean.com
h2oworks.net
imtheonlyperson.technology
premoo.com
weareprof.com
newcotechnology.com
monnaisjouetsherbrooke.com
juegoroblox.com
ryacorcosquin.com
livetechstop.com
hnuman.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/584-14-0x000000000041ECB0-mapping.dmp formbook behavioral2/memory/584-13-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/640-21-0x0000000002B20000-0x0000000002B4E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Shipment Document BL,INV and packing list.exeShipment Document BL,INV and packing list.exerundll32.exedescription pid process target process PID 4760 set thread context of 584 4760 Shipment Document BL,INV and packing list.exe Shipment Document BL,INV and packing list.exe PID 584 set thread context of 3012 584 Shipment Document BL,INV and packing list.exe Explorer.EXE PID 640 set thread context of 3012 640 rundll32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
Shipment Document BL,INV and packing list.exeShipment Document BL,INV and packing list.exerundll32.exepid process 4760 Shipment Document BL,INV and packing list.exe 4760 Shipment Document BL,INV and packing list.exe 584 Shipment Document BL,INV and packing list.exe 584 Shipment Document BL,INV and packing list.exe 584 Shipment Document BL,INV and packing list.exe 584 Shipment Document BL,INV and packing list.exe 640 rundll32.exe 640 rundll32.exe 640 rundll32.exe 640 rundll32.exe 640 rundll32.exe 640 rundll32.exe 640 rundll32.exe 640 rundll32.exe 640 rundll32.exe 640 rundll32.exe 640 rundll32.exe 640 rundll32.exe 640 rundll32.exe 640 rundll32.exe 640 rundll32.exe 640 rundll32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Shipment Document BL,INV and packing list.exerundll32.exepid process 584 Shipment Document BL,INV and packing list.exe 584 Shipment Document BL,INV and packing list.exe 584 Shipment Document BL,INV and packing list.exe 640 rundll32.exe 640 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Shipment Document BL,INV and packing list.exeShipment Document BL,INV and packing list.exerundll32.exedescription pid process Token: SeDebugPrivilege 4760 Shipment Document BL,INV and packing list.exe Token: SeDebugPrivilege 584 Shipment Document BL,INV and packing list.exe Token: SeDebugPrivilege 640 rundll32.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Shipment Document BL,INV and packing list.exeExplorer.EXErundll32.exedescription pid process target process PID 4760 wrote to memory of 520 4760 Shipment Document BL,INV and packing list.exe Shipment Document BL,INV and packing list.exe PID 4760 wrote to memory of 520 4760 Shipment Document BL,INV and packing list.exe Shipment Document BL,INV and packing list.exe PID 4760 wrote to memory of 520 4760 Shipment Document BL,INV and packing list.exe Shipment Document BL,INV and packing list.exe PID 4760 wrote to memory of 584 4760 Shipment Document BL,INV and packing list.exe Shipment Document BL,INV and packing list.exe PID 4760 wrote to memory of 584 4760 Shipment Document BL,INV and packing list.exe Shipment Document BL,INV and packing list.exe PID 4760 wrote to memory of 584 4760 Shipment Document BL,INV and packing list.exe Shipment Document BL,INV and packing list.exe PID 4760 wrote to memory of 584 4760 Shipment Document BL,INV and packing list.exe Shipment Document BL,INV and packing list.exe PID 4760 wrote to memory of 584 4760 Shipment Document BL,INV and packing list.exe Shipment Document BL,INV and packing list.exe PID 4760 wrote to memory of 584 4760 Shipment Document BL,INV and packing list.exe Shipment Document BL,INV and packing list.exe PID 3012 wrote to memory of 640 3012 Explorer.EXE rundll32.exe PID 3012 wrote to memory of 640 3012 Explorer.EXE rundll32.exe PID 3012 wrote to memory of 640 3012 Explorer.EXE rundll32.exe PID 640 wrote to memory of 1116 640 rundll32.exe cmd.exe PID 640 wrote to memory of 1116 640 rundll32.exe cmd.exe PID 640 wrote to memory of 1116 640 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.exe"3⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:584 -
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:672
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:832
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:876
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:932
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1008
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1012
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.exe"3⤵PID:1116
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/584-14-0x000000000041ECB0-mapping.dmp
-
memory/584-17-0x0000000000A80000-0x0000000000A94000-memory.dmpFilesize
80KB
-
memory/584-16-0x0000000000F10000-0x0000000001230000-memory.dmpFilesize
3.1MB
-
memory/584-13-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/640-19-0x0000000000000000-mapping.dmp
-
memory/640-25-0x0000000004430000-0x00000000044C3000-memory.dmpFilesize
588KB
-
memory/640-23-0x00000000046C0000-0x00000000049E0000-memory.dmpFilesize
3.1MB
-
memory/640-20-0x0000000000260000-0x0000000000273000-memory.dmpFilesize
76KB
-
memory/640-21-0x0000000002B20000-0x0000000002B4E000-memory.dmpFilesize
184KB
-
memory/1116-22-0x0000000000000000-mapping.dmp
-
memory/3012-18-0x00000000030E0000-0x00000000031B1000-memory.dmpFilesize
836KB
-
memory/3012-26-0x00000000058F0000-0x0000000005A1F000-memory.dmpFilesize
1.2MB
-
memory/4760-12-0x0000000007B00000-0x0000000007B54000-memory.dmpFilesize
336KB
-
memory/4760-3-0x0000000000F10000-0x0000000000F11000-memory.dmpFilesize
4KB
-
memory/4760-5-0x00000000057B0000-0x00000000057B1000-memory.dmpFilesize
4KB
-
memory/4760-2-0x0000000073150000-0x000000007383E000-memory.dmpFilesize
6.9MB
-
memory/4760-6-0x0000000005D50000-0x0000000005D51000-memory.dmpFilesize
4KB
-
memory/4760-7-0x00000000058F0000-0x00000000058F1000-memory.dmpFilesize
4KB
-
memory/4760-8-0x00000000057A0000-0x00000000057A1000-memory.dmpFilesize
4KB
-
memory/4760-11-0x0000000005AA0000-0x0000000005AA3000-memory.dmpFilesize
12KB
-
memory/4760-10-0x00000000058B0000-0x00000000058B1000-memory.dmpFilesize
4KB
-
memory/4760-9-0x0000000005AC0000-0x0000000005AC1000-memory.dmpFilesize
4KB