Analysis
-
max time kernel
148s -
max time network
13s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
08-05-2021 08:28
Static task
static1
Behavioral task
behavioral1
Sample
NEW_ORDERS 122020 2 x 40 HQ.exe
Resource
win7v20210408
General
-
Target
NEW_ORDERS 122020 2 x 40 HQ.exe
-
Size
805KB
-
MD5
7ceac88b29ab061f0fc1f9915006060f
-
SHA1
b7cceb6c9e8c50cda1b6f8643f2d123ca100d8b2
-
SHA256
8a116bfcbc1c440c1491513ee9efde46fe7f2e7f24fcdb3f43ee21d0917face7
-
SHA512
dd6a0a57db0d85064962c8f8809d512a88294d4e773f9cb3acf033794edd647e1c4b9e24f4b774b858dcfdfc26def801c57d8f185300ae8784e8e5a0c8e44394
Malware Config
Extracted
formbook
4.1
http://www.supinapp.com/grv/
morganofatlanta.com
vz473.com
hengetelt.com
bailcally.com
virtuosoonline.com
tenthousandli.com
ohanamascota.com
digi-plates.com
prismagtech.com
we-cinema.com
372680.com
smartautoexpert.xyz
mrxzg.com
apartment-brussels.com
reverseincubator.com
linkasean.com
yummicrabva.com
diguchaye.com
reaktorfatura.com
thecatsaysno.com
mpgcommunications.net
lindustrieetleca.com
seosansar.com
alohalily.com
novergi.com
universityincanada.info
atrocity.xyz
johnsonballoonblessings.com
laurelmcintosh.com
nubedepalabras.com
ycmath.com
daveysdestinations.com
yourgutterguru.com
mayas.website
bessgarments.com
xhegu.com
mybusinessdoor.com
vivaceactivewear.com
nongyan.net
tgi-mail.net
j999a.com
slteka.com
pikipikiit.com
as0594.com
insuremydriverslicense.com
kclundsblades.com
haircleanerpro.com
charlesnwahiwe.com
ervoth.com
authentiekinnovations.com
molvmg.icu
xn--k1abtc6be.xn--p1acf
arm-srl.com
hood2healer.com
austinchapter7.com
clarityentct.com
bryllaw.com
twinworksllc.com
top-trend.website
rueschlink.com
oogilab.com
thewritersbookshelf.com
jademarkproducts.com
400city.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/756-67-0x000000000041EC20-mapping.dmp formbook behavioral1/memory/756-66-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/520-76-0x00000000000F0000-0x000000000011E000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1108 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
NEW_ORDERS 122020 2 x 40 HQ.exeNEW_ORDERS 122020 2 x 40 HQ.execmstp.exedescription pid process target process PID 1612 set thread context of 756 1612 NEW_ORDERS 122020 2 x 40 HQ.exe NEW_ORDERS 122020 2 x 40 HQ.exe PID 756 set thread context of 1272 756 NEW_ORDERS 122020 2 x 40 HQ.exe Explorer.EXE PID 520 set thread context of 1272 520 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
NEW_ORDERS 122020 2 x 40 HQ.execmstp.exepid process 756 NEW_ORDERS 122020 2 x 40 HQ.exe 756 NEW_ORDERS 122020 2 x 40 HQ.exe 520 cmstp.exe 520 cmstp.exe 520 cmstp.exe 520 cmstp.exe 520 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
NEW_ORDERS 122020 2 x 40 HQ.execmstp.exepid process 756 NEW_ORDERS 122020 2 x 40 HQ.exe 756 NEW_ORDERS 122020 2 x 40 HQ.exe 756 NEW_ORDERS 122020 2 x 40 HQ.exe 520 cmstp.exe 520 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
NEW_ORDERS 122020 2 x 40 HQ.execmstp.exedescription pid process Token: SeDebugPrivilege 756 NEW_ORDERS 122020 2 x 40 HQ.exe Token: SeDebugPrivilege 520 cmstp.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
NEW_ORDERS 122020 2 x 40 HQ.exeExplorer.EXEcmstp.exedescription pid process target process PID 1612 wrote to memory of 756 1612 NEW_ORDERS 122020 2 x 40 HQ.exe NEW_ORDERS 122020 2 x 40 HQ.exe PID 1612 wrote to memory of 756 1612 NEW_ORDERS 122020 2 x 40 HQ.exe NEW_ORDERS 122020 2 x 40 HQ.exe PID 1612 wrote to memory of 756 1612 NEW_ORDERS 122020 2 x 40 HQ.exe NEW_ORDERS 122020 2 x 40 HQ.exe PID 1612 wrote to memory of 756 1612 NEW_ORDERS 122020 2 x 40 HQ.exe NEW_ORDERS 122020 2 x 40 HQ.exe PID 1612 wrote to memory of 756 1612 NEW_ORDERS 122020 2 x 40 HQ.exe NEW_ORDERS 122020 2 x 40 HQ.exe PID 1612 wrote to memory of 756 1612 NEW_ORDERS 122020 2 x 40 HQ.exe NEW_ORDERS 122020 2 x 40 HQ.exe PID 1612 wrote to memory of 756 1612 NEW_ORDERS 122020 2 x 40 HQ.exe NEW_ORDERS 122020 2 x 40 HQ.exe PID 1272 wrote to memory of 520 1272 Explorer.EXE cmstp.exe PID 1272 wrote to memory of 520 1272 Explorer.EXE cmstp.exe PID 1272 wrote to memory of 520 1272 Explorer.EXE cmstp.exe PID 1272 wrote to memory of 520 1272 Explorer.EXE cmstp.exe PID 1272 wrote to memory of 520 1272 Explorer.EXE cmstp.exe PID 1272 wrote to memory of 520 1272 Explorer.EXE cmstp.exe PID 1272 wrote to memory of 520 1272 Explorer.EXE cmstp.exe PID 520 wrote to memory of 1108 520 cmstp.exe cmd.exe PID 520 wrote to memory of 1108 520 cmstp.exe cmd.exe PID 520 wrote to memory of 1108 520 cmstp.exe cmd.exe PID 520 wrote to memory of 1108 520 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW_ORDERS 122020 2 x 40 HQ.exe"C:\Users\Admin\AppData\Local\Temp\NEW_ORDERS 122020 2 x 40 HQ.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW_ORDERS 122020 2 x 40 HQ.exe"C:\Users\Admin\AppData\Local\Temp\NEW_ORDERS 122020 2 x 40 HQ.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\NEW_ORDERS 122020 2 x 40 HQ.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/520-72-0x0000000000000000-mapping.dmp
-
memory/520-78-0x0000000001E30000-0x0000000001EC3000-memory.dmpFilesize
588KB
-
memory/520-77-0x0000000001FF0000-0x00000000022F3000-memory.dmpFilesize
3.0MB
-
memory/520-76-0x00000000000F0000-0x000000000011E000-memory.dmpFilesize
184KB
-
memory/520-75-0x00000000003B0000-0x00000000003C8000-memory.dmpFilesize
96KB
-
memory/520-73-0x0000000075D51000-0x0000000075D53000-memory.dmpFilesize
8KB
-
memory/756-67-0x000000000041EC20-mapping.dmp
-
memory/756-66-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/756-70-0x0000000000360000-0x0000000000374000-memory.dmpFilesize
80KB
-
memory/756-69-0x0000000000880000-0x0000000000B83000-memory.dmpFilesize
3.0MB
-
memory/1108-74-0x0000000000000000-mapping.dmp
-
memory/1272-71-0x0000000007410000-0x00000000075B9000-memory.dmpFilesize
1.7MB
-
memory/1272-79-0x0000000004B90000-0x0000000004C2D000-memory.dmpFilesize
628KB
-
memory/1612-60-0x00000000011F0000-0x00000000011F1000-memory.dmpFilesize
4KB
-
memory/1612-65-0x0000000000EE0000-0x0000000000F3C000-memory.dmpFilesize
368KB
-
memory/1612-64-0x0000000005160000-0x0000000005203000-memory.dmpFilesize
652KB
-
memory/1612-63-0x00000000004F0000-0x00000000004FE000-memory.dmpFilesize
56KB
-
memory/1612-62-0x0000000005120000-0x0000000005121000-memory.dmpFilesize
4KB