Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
22-07-2021 11:17
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.exe
Resource
win7v20210410
General
-
Target
Purchase Order.exe
-
Size
916KB
-
MD5
c13f1850e9d955f826620bd1ae322368
-
SHA1
1329de0499fabc6fcffd4fa02864968acaac253e
-
SHA256
419d8b92dc042882bb3261de70dfe4a158bc9ca436c71f9bf330bb8a6917d04c
-
SHA512
8d11bbe6afadbd108f227bb3397334f27eb69859b19e82ae436ea91a9f9b6b786c83a55a2fe0f71b15875ec51df8b19f367941420e5972eb2a06e6163aed2657
Malware Config
Extracted
formbook
4.1
http://www.valiantfinancial.net/hth0/
grahamandjana.com
surfpodcastnetwork.com
valkyrie20.com
hire4looks.com
wewalkfastasone.com
saveourschoolyear.com
5g23e.com
abusinesssystems.com
telefonepantalla.com
tailorscafe.com
schwarzer-markt.net
stopwatch247.com
458grandbetting.com
xpovision.com
kutkingbarbering.life
kppp-guxxz.xyz
chuckwagon-chow.com
la-casa-delle-vita.com
creativesocials.com
negociacoeshojebr.com
conservativestyle.life
825tache.com
birthmothersmaine.com
jwrl.net
gardiantparts.com
contodosyparaelbiendetodos.com
actymall.com
oxyde.net
adagiomusicacademy.com
newjerseyscubadiving.net
87oaks.com
overt.website
home-made-gifts.com
viralgoats.com
camediahub.com
bankruptcyprobabilities.com
yourlifematterswellness.email
earnestjourneycourses.com
landonpaints.com
aesegroup.com
omegle99.com
sparklinmomma.com
cofcwzrf.com
jam-nins.com
mazacz.com
copdrule.info
cahayaqq.life
helps-paxful.com
gerado.online
patanamedia.com
fromfeartotrust.com
deux-studios.com
wallinders.com
nilton-g.com
yijiamobile.com
ocheap3dbuy.com
flima2020a.site
battlefieldtitle.site
ferrebaviera.com
plushmint.com
achievementfound.com
dontbringcovidhome.com
cultigique.com
waveplumb.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1652-68-0x000000000041ED60-mapping.dmp formbook behavioral1/memory/1652-67-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1872-76-0x0000000000090000-0x00000000000BE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 556 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Purchase Order.exePurchase Order.exerundll32.exedescription pid process target process PID 1732 set thread context of 1652 1732 Purchase Order.exe Purchase Order.exe PID 1652 set thread context of 1260 1652 Purchase Order.exe Explorer.EXE PID 1872 set thread context of 1260 1872 rundll32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
Purchase Order.exerundll32.exepid process 1652 Purchase Order.exe 1652 Purchase Order.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Purchase Order.exerundll32.exepid process 1652 Purchase Order.exe 1652 Purchase Order.exe 1652 Purchase Order.exe 1872 rundll32.exe 1872 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Purchase Order.exerundll32.exedescription pid process Token: SeDebugPrivilege 1652 Purchase Order.exe Token: SeDebugPrivilege 1872 rundll32.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Purchase Order.exeExplorer.EXErundll32.exedescription pid process target process PID 1732 wrote to memory of 1652 1732 Purchase Order.exe Purchase Order.exe PID 1732 wrote to memory of 1652 1732 Purchase Order.exe Purchase Order.exe PID 1732 wrote to memory of 1652 1732 Purchase Order.exe Purchase Order.exe PID 1732 wrote to memory of 1652 1732 Purchase Order.exe Purchase Order.exe PID 1732 wrote to memory of 1652 1732 Purchase Order.exe Purchase Order.exe PID 1732 wrote to memory of 1652 1732 Purchase Order.exe Purchase Order.exe PID 1732 wrote to memory of 1652 1732 Purchase Order.exe Purchase Order.exe PID 1260 wrote to memory of 1872 1260 Explorer.EXE rundll32.exe PID 1260 wrote to memory of 1872 1260 Explorer.EXE rundll32.exe PID 1260 wrote to memory of 1872 1260 Explorer.EXE rundll32.exe PID 1260 wrote to memory of 1872 1260 Explorer.EXE rundll32.exe PID 1260 wrote to memory of 1872 1260 Explorer.EXE rundll32.exe PID 1260 wrote to memory of 1872 1260 Explorer.EXE rundll32.exe PID 1260 wrote to memory of 1872 1260 Explorer.EXE rundll32.exe PID 1872 wrote to memory of 556 1872 rundll32.exe cmd.exe PID 1872 wrote to memory of 556 1872 rundll32.exe cmd.exe PID 1872 wrote to memory of 556 1872 rundll32.exe cmd.exe PID 1872 wrote to memory of 556 1872 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/556-74-0x0000000000000000-mapping.dmp
-
memory/1260-79-0x00000000050E0000-0x0000000005213000-memory.dmpFilesize
1.2MB
-
memory/1260-71-0x0000000004F70000-0x00000000050DB000-memory.dmpFilesize
1.4MB
-
memory/1652-67-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1652-69-0x0000000000920000-0x0000000000C23000-memory.dmpFilesize
3.0MB
-
memory/1652-70-0x0000000000280000-0x0000000000294000-memory.dmpFilesize
80KB
-
memory/1652-68-0x000000000041ED60-mapping.dmp
-
memory/1732-65-0x0000000004E80000-0x0000000004EFE000-memory.dmpFilesize
504KB
-
memory/1732-66-0x0000000000CC0000-0x0000000000CF0000-memory.dmpFilesize
192KB
-
memory/1732-60-0x0000000000D00000-0x0000000000D01000-memory.dmpFilesize
4KB
-
memory/1732-64-0x00000000008D0000-0x00000000008D2000-memory.dmpFilesize
8KB
-
memory/1732-63-0x0000000004470000-0x0000000004471000-memory.dmpFilesize
4KB
-
memory/1732-62-0x0000000000B20000-0x0000000000B7E000-memory.dmpFilesize
376KB
-
memory/1872-72-0x0000000000000000-mapping.dmp
-
memory/1872-73-0x0000000075161000-0x0000000075163000-memory.dmpFilesize
8KB
-
memory/1872-75-0x0000000000430000-0x000000000043E000-memory.dmpFilesize
56KB
-
memory/1872-76-0x0000000000090000-0x00000000000BE000-memory.dmpFilesize
184KB
-
memory/1872-77-0x0000000002050000-0x0000000002353000-memory.dmpFilesize
3.0MB
-
memory/1872-78-0x0000000001EC0000-0x0000000001F53000-memory.dmpFilesize
588KB