Analysis
- max time kernel
150s - max time network
136s - platform
windows10_x64 - resource
win10v20201028 - submitted
08/04/2021, 09:48
Static task
static1
Behavioral task
behavioral1
Sample
Invoicee.exe
Resource
win7v20201028
windows7_x64
General
- Target Invoicee.exe
- Size 511KB
- Sample210408-pr7qd72v6e
- SHA256 9b9218d3692f38654cde45d5a9b01a6d5cb83aa5442c286fc4e073a6348e08d1
- MD5 1832c0cee417fe037896caea05871046
- SHA1 99b409f1d4eb642ab2d09f46ae4fd8d98292f8e6
- SHA512 094a9d0390bd9f1f0a1c5c7b955d58b933d0e64f75d109238ec62a6dd173ebfcdfc7000ca1ee3390928551f6a627df124a9154e21f9d30c5c9be3dadadef8d8c
- MD5 SHA1 SHA512
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.boldoval.com/ch65/
-
jobhuizhan.com
-
madeinarcade.com
-
germanyromeo.club
-
gsxguru.com
-
widedepot.com
-
aboutthemwheels.com
-
roboticmarkets.com
-
triy.club
-
primetrust.foundation
-
raulmendez.design
-
reddingvideos.com
-
cyclingsunglassestrend.com
-
sacredstarmystic.com
-
juxrams.info
-
multacolors.com
-
focusonevolving.com
-
kimmoniqueboutique.com
-
palomadepapel.com
-
stanleywatches.com
-
lafamiliagomez.com
-
sukatalde.com
-
champetonline.com
-
projectweho.com
-
wajeovcoo.com
-
arcticblastairheat.com
-
makeuptipsonline.com
-
lovelessons102.com
-
hastibaba.com
-
wg226.com
-
artista.digital
-
atelier9.info
-
successpuntocom.com
-
miningtradefast.com
-
amazonaonlineact.com
-
rockospizzaforney.com
-
sosyalduvar.com
-
trueutility.net
-
jwkk86.com
-
easyfreedomlifestyle.com
-
lightstailor.com
-
theflightcap.com
-
doculinc.com
-
shahzor30.com
-
chadsautocare.com
-
damonneutzling.com
-
bestsellngus.com
-
myseedsmenu.com
-
sanfordfinancialsolutions.com
-
circlecandles.com
-
madeinsusanville.com
-
artistmaecenas.com
-
sihilanimalhealth.com
-
wildnectarlandscaping.com
-
smoothmediadesigns.com
-
debarillas.com
-
francesexeshop.com
-
hphometeam.com
-
corpverify.com
-
justtop5.com
-
jeeljadeed.com
-
findyourxmg.com
-
winewhinegirls.com
-
thelettucelady.com
-
tango-akademie.com
Signatures
- Formbook Payload 2 IoCs
resource yara_rule behavioral2/memory/3208-117-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2768-124-0x00000000009C0000-0x00000000009EE000-memory.dmp formbook - Loads dropped DLL 1 IoCs
pid Process 1212 Invoicee.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1212 set thread context of 3208 1212 Invoicee.exe 74 PID 3208 set thread context of 2396 3208 Invoicee.exe 21 PID 2768 set thread context of 2396 2768 netsh.exe 21 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3208 Invoicee.exe 3208 Invoicee.exe 3208 Invoicee.exe 3208 Invoicee.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe 2768 netsh.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2396 Explorer.EXE - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1212 Invoicee.exe 3208 Invoicee.exe 3208 Invoicee.exe 3208 Invoicee.exe 2768 netsh.exe 2768 netsh.exe - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeDebugPrivilege 3208 Invoicee.exe Token: SeShutdownPrivilege 2396 Explorer.EXE Token: SeCreatePagefilePrivilege 2396 Explorer.EXE Token: SeShutdownPrivilege 2396 Explorer.EXE Token: SeCreatePagefilePrivilege 2396 Explorer.EXE Token: SeShutdownPrivilege 2396 Explorer.EXE Token: SeCreatePagefilePrivilege 2396 Explorer.EXE Token: SeShutdownPrivilege 2396 Explorer.EXE Token: SeCreatePagefilePrivilege 2396 Explorer.EXE Token: SeShutdownPrivilege 2396 Explorer.EXE Token: SeCreatePagefilePrivilege 2396 Explorer.EXE Token: SeShutdownPrivilege 2396 Explorer.EXE Token: SeCreatePagefilePrivilege 2396 Explorer.EXE Token: SeShutdownPrivilege 2396 Explorer.EXE Token: SeCreatePagefilePrivilege 2396 Explorer.EXE Token: SeShutdownPrivilege 2396 Explorer.EXE Token: SeCreatePagefilePrivilege 2396 Explorer.EXE Token: SeDebugPrivilege 2768 netsh.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2396 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1212 wrote to memory of 3208 1212 Invoicee.exe 74 PID 1212 wrote to memory of 3208 1212 Invoicee.exe 74 PID 1212 wrote to memory of 3208 1212 Invoicee.exe 74 PID 1212 wrote to memory of 3208 1212 Invoicee.exe 74 PID 2396 wrote to memory of 2768 2396 Explorer.EXE 77 PID 2396 wrote to memory of 2768 2396 Explorer.EXE 77 PID 2396 wrote to memory of 2768 2396 Explorer.EXE 77 PID 2768 wrote to memory of 2204 2768 netsh.exe 81 PID 2768 wrote to memory of 2204 2768 netsh.exe 81 PID 2768 wrote to memory of 2204 2768 netsh.exe 81
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\Invoicee.exe"C:\Users\Admin\AppData\Local\Temp\Invoicee.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\Invoicee.exe"C:\Users\Admin\AppData\Local\Temp\Invoicee.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3208
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Invoicee.exe"3⤵PID:2204
-
-