Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
22-07-2021 11:17
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.exe
Resource
win7v20210410
General
-
Target
Purchase Order.exe
-
Size
916KB
-
MD5
c13f1850e9d955f826620bd1ae322368
-
SHA1
1329de0499fabc6fcffd4fa02864968acaac253e
-
SHA256
419d8b92dc042882bb3261de70dfe4a158bc9ca436c71f9bf330bb8a6917d04c
-
SHA512
8d11bbe6afadbd108f227bb3397334f27eb69859b19e82ae436ea91a9f9b6b786c83a55a2fe0f71b15875ec51df8b19f367941420e5972eb2a06e6163aed2657
Malware Config
Extracted
formbook
4.1
http://www.valiantfinancial.net/hth0/
grahamandjana.com
surfpodcastnetwork.com
valkyrie20.com
hire4looks.com
wewalkfastasone.com
saveourschoolyear.com
5g23e.com
abusinesssystems.com
telefonepantalla.com
tailorscafe.com
schwarzer-markt.net
stopwatch247.com
458grandbetting.com
xpovision.com
kutkingbarbering.life
kppp-guxxz.xyz
chuckwagon-chow.com
la-casa-delle-vita.com
creativesocials.com
negociacoeshojebr.com
conservativestyle.life
825tache.com
birthmothersmaine.com
jwrl.net
gardiantparts.com
contodosyparaelbiendetodos.com
actymall.com
oxyde.net
adagiomusicacademy.com
newjerseyscubadiving.net
87oaks.com
overt.website
home-made-gifts.com
viralgoats.com
camediahub.com
bankruptcyprobabilities.com
yourlifematterswellness.email
earnestjourneycourses.com
landonpaints.com
aesegroup.com
omegle99.com
sparklinmomma.com
cofcwzrf.com
jam-nins.com
mazacz.com
copdrule.info
cahayaqq.life
helps-paxful.com
gerado.online
patanamedia.com
fromfeartotrust.com
deux-studios.com
wallinders.com
nilton-g.com
yijiamobile.com
ocheap3dbuy.com
flima2020a.site
battlefieldtitle.site
ferrebaviera.com
plushmint.com
achievementfound.com
dontbringcovidhome.com
cultigique.com
waveplumb.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1988-125-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/1988-126-0x000000000041ED60-mapping.dmp formbook behavioral2/memory/3812-133-0x0000000000110000-0x000000000013E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Purchase Order.exePurchase Order.execmmon32.exedescription pid process target process PID 632 set thread context of 1988 632 Purchase Order.exe Purchase Order.exe PID 1988 set thread context of 2428 1988 Purchase Order.exe Explorer.EXE PID 3812 set thread context of 2428 3812 cmmon32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
Purchase Order.execmmon32.exepid process 1988 Purchase Order.exe 1988 Purchase Order.exe 1988 Purchase Order.exe 1988 Purchase Order.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe 3812 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2428 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Purchase Order.execmmon32.exepid process 1988 Purchase Order.exe 1988 Purchase Order.exe 1988 Purchase Order.exe 3812 cmmon32.exe 3812 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Purchase Order.execmmon32.exedescription pid process Token: SeDebugPrivilege 1988 Purchase Order.exe Token: SeDebugPrivilege 3812 cmmon32.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2428 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Purchase Order.exeExplorer.EXEcmmon32.exedescription pid process target process PID 632 wrote to memory of 1988 632 Purchase Order.exe Purchase Order.exe PID 632 wrote to memory of 1988 632 Purchase Order.exe Purchase Order.exe PID 632 wrote to memory of 1988 632 Purchase Order.exe Purchase Order.exe PID 632 wrote to memory of 1988 632 Purchase Order.exe Purchase Order.exe PID 632 wrote to memory of 1988 632 Purchase Order.exe Purchase Order.exe PID 632 wrote to memory of 1988 632 Purchase Order.exe Purchase Order.exe PID 2428 wrote to memory of 3812 2428 Explorer.EXE cmmon32.exe PID 2428 wrote to memory of 3812 2428 Explorer.EXE cmmon32.exe PID 2428 wrote to memory of 3812 2428 Explorer.EXE cmmon32.exe PID 3812 wrote to memory of 1340 3812 cmmon32.exe cmd.exe PID 3812 wrote to memory of 1340 3812 cmmon32.exe cmd.exe PID 3812 wrote to memory of 1340 3812 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/632-116-0x0000000002EA0000-0x0000000002EFE000-memory.dmpFilesize
376KB
-
memory/632-117-0x0000000009C70000-0x0000000009C71000-memory.dmpFilesize
4KB
-
memory/632-118-0x0000000005490000-0x0000000005491000-memory.dmpFilesize
4KB
-
memory/632-119-0x0000000002D60000-0x0000000002D61000-memory.dmpFilesize
4KB
-
memory/632-120-0x0000000002F00000-0x0000000002F01000-memory.dmpFilesize
4KB
-
memory/632-121-0x0000000005680000-0x0000000005682000-memory.dmpFilesize
8KB
-
memory/632-122-0x0000000007810000-0x0000000007811000-memory.dmpFilesize
4KB
-
memory/632-123-0x0000000005970000-0x00000000059EE000-memory.dmpFilesize
504KB
-
memory/632-124-0x00000000058F0000-0x0000000005920000-memory.dmpFilesize
192KB
-
memory/632-114-0x0000000000920000-0x0000000000921000-memory.dmpFilesize
4KB
-
memory/1340-131-0x0000000000000000-mapping.dmp
-
memory/1988-125-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1988-127-0x0000000001760000-0x0000000001A80000-memory.dmpFilesize
3.1MB
-
memory/1988-128-0x0000000001280000-0x0000000001294000-memory.dmpFilesize
80KB
-
memory/1988-126-0x000000000041ED60-mapping.dmp
-
memory/2428-129-0x00000000064E0000-0x000000000665A000-memory.dmpFilesize
1.5MB
-
memory/2428-136-0x0000000006660000-0x000000000677A000-memory.dmpFilesize
1.1MB
-
memory/3812-130-0x0000000000000000-mapping.dmp
-
memory/3812-132-0x0000000001270000-0x000000000127C000-memory.dmpFilesize
48KB
-
memory/3812-133-0x0000000000110000-0x000000000013E000-memory.dmpFilesize
184KB
-
memory/3812-134-0x0000000000D40000-0x0000000001060000-memory.dmpFilesize
3.1MB
-
memory/3812-135-0x0000000001060000-0x00000000010F3000-memory.dmpFilesize
588KB