Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
08-05-2021 07:03
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order #330716o.exe
Resource
win7v20210408
General
-
Target
Purchase Order #330716o.exe
-
Size
704KB
-
MD5
96b356e875a0578b468ae325279bbbdf
-
SHA1
6f3ab69ca49850f49a8b67a76c7788e9988868f1
-
SHA256
cb44a6f7264ae4707ae8b0db82d0f62766f996f7bd37586401e11e5bccb30bd7
-
SHA512
de07bdc4e658c76da605f9fa45e22844b01f81bc9ec893d2e8cef44fe419b986527c49f6b7fb27a5dad7f2118d07ae3dbfc74c8791dc0b4745041852450086dd
Malware Config
Extracted
formbook
4.1
http://www.itoatoapparel.com/hfg/
0nqcaw.com
seamtube.com
chinachongren.com
shop-deinen-deal.com
socialmediabutler.net
careerenabler.net
trumpmasksshop.com
theopulencegroups.com
meshfacilities.com
sedaifu.com
ahesitanttraveler.com
xn--nbkvf9b5bzfx438ch6sa.com
iqrafootwearbd.com
akurasushinewyorkny.com
paginasny.com
www7shire.com
frenchyoutlet.com
lw14.com
nmdetransports.net
advjuniorconsultoria.com
microsoftdynamicsgroup.com
tuila.online
snapfinance-vip.com
melodiestreety.com
sepulcrovacio.com
corsgrupo.com
lavenso.net
bedbudandbeyond.net
grantsawinganddrilling.com
szhuayingt.com
lacuevazaragoza.com
msmommycaribbeanmarket.com
azaleafitch.net
hdfreeunlinited.com
cardiologianordelta.com
3in1toothfairy.com
xfsdgy.com
true92essentials.com
devis-danseuse-bresilienne.com
helpinghandsrecoveryaz.com
yngygcgs.com
arkavion.com
superteamexpansion.com
pintax.info
rainbowswim.net
webtinchap.com
projecteutopia.com
leuwvwgwvw.net
smithmountainrentals.com
economicimpactanalysis.com
lifeclub.pro
pitchforprofits.com
chaytel.com
akhlaghnews.com
xn--1-vr6ek4e.com
revicadsolutions.com
nuitek.com
bootersatlanta.com
yapasphoto.online
quant-china.xyz
xn--7dv6eu89e.com
diecasttalk.com
bracebaby.com
sonderbach.net
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/360-124-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/360-125-0x000000000041EBA0-mapping.dmp formbook behavioral2/memory/3904-133-0x0000000000A60000-0x0000000000A8E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Purchase Order #330716o.exePurchase Order #330716o.exesvchost.exedescription pid process target process PID 3876 set thread context of 360 3876 Purchase Order #330716o.exe Purchase Order #330716o.exe PID 360 set thread context of 3016 360 Purchase Order #330716o.exe Explorer.EXE PID 3904 set thread context of 3016 3904 svchost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
Purchase Order #330716o.exesvchost.exepid process 360 Purchase Order #330716o.exe 360 Purchase Order #330716o.exe 360 Purchase Order #330716o.exe 360 Purchase Order #330716o.exe 3904 svchost.exe 3904 svchost.exe 3904 svchost.exe 3904 svchost.exe 3904 svchost.exe 3904 svchost.exe 3904 svchost.exe 3904 svchost.exe 3904 svchost.exe 3904 svchost.exe 3904 svchost.exe 3904 svchost.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Purchase Order #330716o.exesvchost.exepid process 360 Purchase Order #330716o.exe 360 Purchase Order #330716o.exe 360 Purchase Order #330716o.exe 3904 svchost.exe 3904 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Purchase Order #330716o.exesvchost.exedescription pid process Token: SeDebugPrivilege 360 Purchase Order #330716o.exe Token: SeDebugPrivilege 3904 svchost.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Purchase Order #330716o.exeExplorer.EXEsvchost.exedescription pid process target process PID 3876 wrote to memory of 360 3876 Purchase Order #330716o.exe Purchase Order #330716o.exe PID 3876 wrote to memory of 360 3876 Purchase Order #330716o.exe Purchase Order #330716o.exe PID 3876 wrote to memory of 360 3876 Purchase Order #330716o.exe Purchase Order #330716o.exe PID 3876 wrote to memory of 360 3876 Purchase Order #330716o.exe Purchase Order #330716o.exe PID 3876 wrote to memory of 360 3876 Purchase Order #330716o.exe Purchase Order #330716o.exe PID 3876 wrote to memory of 360 3876 Purchase Order #330716o.exe Purchase Order #330716o.exe PID 3016 wrote to memory of 3904 3016 Explorer.EXE svchost.exe PID 3016 wrote to memory of 3904 3016 Explorer.EXE svchost.exe PID 3016 wrote to memory of 3904 3016 Explorer.EXE svchost.exe PID 3904 wrote to memory of 2084 3904 svchost.exe cmd.exe PID 3904 wrote to memory of 2084 3904 svchost.exe cmd.exe PID 3904 wrote to memory of 2084 3904 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order #330716o.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order #330716o.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order #330716o.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order #330716o.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order #330716o.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/360-124-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/360-127-0x0000000001920000-0x0000000001C40000-memory.dmpFilesize
3.1MB
-
memory/360-128-0x00000000018F0000-0x0000000001904000-memory.dmpFilesize
80KB
-
memory/360-125-0x000000000041EBA0-mapping.dmp
-
memory/2084-131-0x0000000000000000-mapping.dmp
-
memory/3016-129-0x0000000002930000-0x0000000002A05000-memory.dmpFilesize
852KB
-
memory/3016-136-0x0000000005C60000-0x0000000005D49000-memory.dmpFilesize
932KB
-
memory/3876-119-0x0000000004FA0000-0x0000000004FA1000-memory.dmpFilesize
4KB
-
memory/3876-121-0x0000000005120000-0x000000000512E000-memory.dmpFilesize
56KB
-
memory/3876-120-0x0000000005010000-0x000000000550E000-memory.dmpFilesize
5.0MB
-
memory/3876-118-0x0000000004ED0000-0x0000000004ED1000-memory.dmpFilesize
4KB
-
memory/3876-117-0x0000000004E30000-0x0000000004E31000-memory.dmpFilesize
4KB
-
memory/3876-116-0x0000000005510000-0x0000000005511000-memory.dmpFilesize
4KB
-
memory/3876-122-0x0000000002620000-0x00000000026BC000-memory.dmpFilesize
624KB
-
memory/3876-123-0x0000000000C20000-0x0000000000C75000-memory.dmpFilesize
340KB
-
memory/3876-114-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/3904-130-0x0000000000000000-mapping.dmp
-
memory/3904-132-0x0000000000B60000-0x0000000000B6C000-memory.dmpFilesize
48KB
-
memory/3904-134-0x0000000003620000-0x0000000003940000-memory.dmpFilesize
3.1MB
-
memory/3904-133-0x0000000000A60000-0x0000000000A8E000-memory.dmpFilesize
184KB
-
memory/3904-135-0x0000000003560000-0x00000000035F3000-memory.dmpFilesize
588KB