Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
23-07-2021 22:20
Static task
static1
Behavioral task
behavioral1
Sample
new order.exe
Resource
win7v20210408
General
-
Target
new order.exe
-
Size
574KB
-
MD5
383b8177e9f7c5e2d771d4bb5b4dd0fd
-
SHA1
9ccb9fdcf54623c18fe39189fdb3fe0ff53d814a
-
SHA256
d47e0508ebe3d03a2fe75479c2a17b3cee5adc099facd5da777b9d090d010907
-
SHA512
fa98bf545af68c9b0a9fbec46a9e502d34978da627468574d36496b418af35b0996a5ee23a4fdde98aa46f90a83614b32815c405b96e6e96fbbba7b058480443
Malware Config
Extracted
formbook
4.1
http://www.prospertraining.info/ymmi/
terrapotencia.com
issytosou.net
samankapan.com
zzxitang.com
iapple-uk.com
robertcollinsrealtor.com
theweehero.com
jyotisagar.net
powerbi.fitness
nuoyilm.com
modelsara.com
langvietco.com
aplusroofer.com
isabelacalaca.com
bearhawk.one
exporaoverseas.com
box-appliance.com
walkingfishvod.com
onlyqna.com
feed-parser.com
elegantloungebyjvs.com
expoviviendavirtualgto.com
forgetsticks.com
bloodandteethartwork.com
tinytrailers4bigadventures.com
anal-liza.com
nakopisebe.com
han-chun.com
battybanter.com
resctub.com
biogenesisammendments.com
rajkotpostaldivision.com
akcharconsulting.com
khanmochicaocap.com
albareeparts.com
globalhomeopharma.com
globetrotter-blog.com
vdvozknj.icu
montecitobeachtown.com
staticker.com
vehicleheroes.com
marbellelingerie.com
relocanada.com
nigiwai-bangbuathong-sainoi.com
fuvies.com
ccd-creative.com
weiziyun.net
mylocal.pro
waterbabyisr.com
carmenschmidt.com
culturedlittlehumans.com
amorimcapital.com
1800articles.com
localbaajaar.com
tt-bid.com
suttonbankdc.com
ccacademyofmusic.com
gasteless.com
kamalaharrisfanclub.com
shenyingsuwu.com
edelweissestates.com
wiserfinances.com
freeaitrainingonline.com
xn--ftft-lzabbb.net
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/620-119-0x0000000000000000-mapping.dmp formbook behavioral2/memory/620-121-0x0000000010410000-0x000000001043E000-memory.dmp formbook behavioral2/memory/1420-130-0x0000000002CB0000-0x0000000002CDE000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
dialer.execolorcpl.exedescription pid process target process PID 620 set thread context of 2492 620 dialer.exe Explorer.EXE PID 620 set thread context of 2492 620 dialer.exe Explorer.EXE PID 1420 set thread context of 2492 1420 colorcpl.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
dialer.execolorcpl.exepid process 620 dialer.exe 620 dialer.exe 620 dialer.exe 620 dialer.exe 620 dialer.exe 620 dialer.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe 1420 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2492 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
dialer.execolorcpl.exepid process 620 dialer.exe 620 dialer.exe 620 dialer.exe 620 dialer.exe 1420 colorcpl.exe 1420 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
dialer.execolorcpl.exedescription pid process Token: SeDebugPrivilege 620 dialer.exe Token: SeDebugPrivilege 1420 colorcpl.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Explorer.EXEpid process 2492 Explorer.EXE -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Explorer.EXEpid process 2492 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2492 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
new order.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 3968 wrote to memory of 620 3968 new order.exe dialer.exe PID 3968 wrote to memory of 620 3968 new order.exe dialer.exe PID 3968 wrote to memory of 620 3968 new order.exe dialer.exe PID 3968 wrote to memory of 620 3968 new order.exe dialer.exe PID 3968 wrote to memory of 620 3968 new order.exe dialer.exe PID 3968 wrote to memory of 620 3968 new order.exe dialer.exe PID 2492 wrote to memory of 1420 2492 Explorer.EXE colorcpl.exe PID 2492 wrote to memory of 1420 2492 Explorer.EXE colorcpl.exe PID 2492 wrote to memory of 1420 2492 Explorer.EXE colorcpl.exe PID 1420 wrote to memory of 212 1420 colorcpl.exe cmd.exe PID 1420 wrote to memory of 212 1420 colorcpl.exe cmd.exe PID 1420 wrote to memory of 212 1420 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\new order.exe"C:\Users\Admin\AppData\Local\Temp\new order.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dialer.exeC:\Windows\System32\dialer.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\dialer.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/212-128-0x0000000000000000-mapping.dmp
-
memory/620-122-0x0000000004240000-0x0000000004560000-memory.dmpFilesize
3.1MB
-
memory/620-119-0x0000000000000000-mapping.dmp
-
memory/620-120-0x00000000004D0000-0x00000000004D1000-memory.dmpFilesize
4KB
-
memory/620-121-0x0000000010410000-0x000000001043E000-memory.dmpFilesize
184KB
-
memory/620-123-0x0000000004100000-0x0000000004114000-memory.dmpFilesize
80KB
-
memory/620-125-0x0000000004140000-0x0000000004154000-memory.dmpFilesize
80KB
-
memory/1420-129-0x0000000000330000-0x0000000000349000-memory.dmpFilesize
100KB
-
memory/1420-127-0x0000000000000000-mapping.dmp
-
memory/1420-131-0x0000000004720000-0x0000000004A40000-memory.dmpFilesize
3.1MB
-
memory/1420-130-0x0000000002CB0000-0x0000000002CDE000-memory.dmpFilesize
184KB
-
memory/1420-132-0x0000000004490000-0x0000000004523000-memory.dmpFilesize
588KB
-
memory/2492-126-0x00000000059F0000-0x0000000005B37000-memory.dmpFilesize
1.3MB
-
memory/2492-124-0x00000000058D0000-0x00000000059AD000-memory.dmpFilesize
884KB
-
memory/2492-133-0x00000000094A0000-0x0000000009622000-memory.dmpFilesize
1.5MB
-
memory/3968-116-0x00000000020D0000-0x00000000020EA000-memory.dmpFilesize
104KB
-
memory/3968-114-0x0000000002090000-0x0000000002091000-memory.dmpFilesize
4KB