Analysis
- max time kernel
154s - max time network
148s - platform
windows10_x64 - resource
win10v20210408 - submitted
28/09/2021, 09:26
Static task
static1
Behavioral task
behavioral1
Sample
nuovo ordine. 908272762.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
- Target nuovo ordine. 908272762.exe
- Size 985KB
- Sample210928-ld769sbdd4
- SHA256 0e18df1488198f73ac693eac37584967930540fcaaeca8403f4d8fa2c1126bcd
- MD5 aee56b80fa32afbf4d5cb839645c43cf
- SHA1 8e78698d39b18cb9bfbd85a314b224d32210351c
- SHA512 a049c9e76f456f5002f10c3c2d7d90ee4a7b1ed97d4b04e65609960262fa0cd6a5a73e8f9c2d1a7d4f74036e26542fa5b7979abe0d3a9a9b7196e88159d38dce
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
bc3s
C2
-
http://www.topei-products.com/bc3s/
Decoy
-
anna-ng.com
-
mariangelamata.com
-
szqnbl.com
-
nesherguitars.com
-
mysekrit.com
-
againbeautyviensui.xyz
-
appf.life
-
bilalsolution.com
-
technoratii.com
-
11restoran.com
-
birthingly.com
-
crystalcarrillo.com
-
cohenasset.info
-
bunchofdesign.com
-
highstreetmag.com
-
talentkerning.com
-
outdoor-glassesadvice.com
-
aliceeety.com
-
habbuhot.info
-
pao91.com
-
resgatarpontosparavoce.com
-
tuancai.net
-
cnynckcrw.com
-
visaza.com
-
paulettecallen.com
-
kandmfinancialgroup.com
-
malibuclassix.com
-
thespoonteller.com
-
vidyaxyp.com
-
xn--gmsepetim-q9ab20j.com
-
saudesexualdoshomens.com
-
safehandmarketing.com
-
yebimhieu.site
-
alimitchellmedia.com
-
andrewpatrickpiette.com
-
astro-paradise.com
-
domainechoquet.com
-
navihealthpartners.com
-
detroitveganseafood.com
-
spankingandpunishment.com
-
magalu-queromais.com
-
mallsinup.com
-
rmsnidlogini.cloud
-
lifeisveryessential.com
-
stolzfus.com
-
iniciala.com
-
designslayers.com
-
clinivahq.com
-
ubersms.com
-
welenb.com
-
skyegroupllc.com
-
happyburger.net
-
moredate-s.com
-
alon-mail.com
-
voceprofessor.com
-
dokadveri.com
-
lafabricadisseny.com
-
westwooddesign.net
-
blossoms-boutique.com
-
jumtix.xyz
-
dietgulfport.com
-
soccerstreamer.com
-
lapurtcedd.com
-
secret-mall.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/1364-116-0x0000000000000000-mapping.dmp formbook behavioral2/memory/1364-118-0x0000000010410000-0x000000001043E000-memory.dmp formbook behavioral2/memory/2348-124-0x0000000002910000-0x000000000293E000-memory.dmp formbook - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1364 set thread context of 3024 1364 mobsync.exe 23 PID 2348 set thread context of 3024 2348 ipconfig.exe 23 - Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2348 ipconfig.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Explorer.EXE - Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 1364 mobsync.exe 1364 mobsync.exe 1364 mobsync.exe 1364 mobsync.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe 2348 ipconfig.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3024 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1364 mobsync.exe 1364 mobsync.exe 1364 mobsync.exe 2348 ipconfig.exe 2348 ipconfig.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1364 mobsync.exe Token: SeDebugPrivilege 2348 ipconfig.exe Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3024 Explorer.EXE 3024 Explorer.EXE 3024 Explorer.EXE 3024 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3024 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 664 wrote to memory of 1364 664 nuovo ordine. 908272762.exe 69 PID 664 wrote to memory of 1364 664 nuovo ordine. 908272762.exe 69 PID 664 wrote to memory of 1364 664 nuovo ordine. 908272762.exe 69 PID 664 wrote to memory of 1364 664 nuovo ordine. 908272762.exe 69 PID 664 wrote to memory of 1364 664 nuovo ordine. 908272762.exe 69 PID 664 wrote to memory of 1364 664 nuovo ordine. 908272762.exe 69 PID 3024 wrote to memory of 2348 3024 Explorer.EXE 71 PID 3024 wrote to memory of 2348 3024 Explorer.EXE 71 PID 3024 wrote to memory of 2348 3024 Explorer.EXE 71 PID 2348 wrote to memory of 2716 2348 ipconfig.exe 72 PID 2348 wrote to memory of 2716 2348 ipconfig.exe 72 PID 2348 wrote to memory of 2716 2348 ipconfig.exe 72
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\nuovo ordine. 908272762.exe"C:\Users\Admin\AppData\Local\Temp\nuovo ordine. 908272762.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\SysWOW64\mobsync.exeC:\Windows\System32\mobsync.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1364
-
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\mobsync.exe"3⤵PID:2716
-
-