Analysis
-
max time kernel
145s -
max time network
187s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
29-09-2021 13:13
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE ORDER 29kva.exe
Resource
win7v20210408
General
-
Target
PURCHASE ORDER 29kva.exe
-
Size
713KB
-
MD5
cf92b80bd587ac1498dd3e37fee96af7
-
SHA1
ecaef1532016cc58333ddff64ace07d2a51bde72
-
SHA256
727d99fbf5a7d58b50ea62f289cf59b251ffe3e6f5d9487f7716127654e6e32a
-
SHA512
cd07ba0d3b511144afd2246778103ac1ce9db31f9df6ac7dd86c3a08600682242cf1069a54e36da7e96041d084aed950e5d899510f08a676434848fe8f350fb3
Malware Config
Extracted
formbook
4.1
ergs
http://www.iselotech.com/ergs/
oceanprimesanfrancisco.com
dk-tnc.com
sodangwang.com
abrat-ed.com
dusubiqiqijem.xyz
getsup.online
homeneto.com
shose8.com
tronlane.com
nidowicosasod.xyz
independienteatleticclub.com
pca-winschool.com
realbadnastystories.site
bluevioletfloral.com
simplifiedpeacepodcast.com
abcfreediving.com
theyardbunny.com
holoique.com
ibkr1325.com
tjnfioou.xyz
bumbleapi.com
universityofnorthdakota.com
kisoriyan.com
scienceiva.com
permislbzd.store
mysoiree-lyon.com
philippinenow.com
officialjoyslots.com
casualdatingsites.online
delia-flores.com
eroerofuck.com
myesu.net
tryhard-production.com
3beadsbytj.com
congtycoessentials.net
3doutfits.com
spencersigmon.xyz
mewydyrqd.xyz
manigua.store
teescuchooffee.com
websitetudong.com
shiere.com
rummypepper.com
universeinteriors.com
royaledutyfree.com
evolutionarycurandera.com
seulookexpress.com
seajetguard.com
monikamosur.com
columbiaathleticboosters.com
sem4seo.com
businesstechblueprint.com
kreativemarketingconcepts.com
maisons-france-confort-mp.com
lixinjishaiwang.com
mybrabdmall.com
mrdreamhouse.com
graysrbm.online
theboathub.com
50039219.com
rincondelvinologo.com
coreatechnologyonline.com
artuta.com
teaneckvegan.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1832-66-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1832-67-0x000000000041F1C0-mapping.dmp formbook behavioral1/memory/1652-74-0x00000000000E0000-0x000000000010F000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1712 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PURCHASE ORDER 29kva.exePURCHASE ORDER 29kva.exemstsc.exedescription pid process target process PID 1988 set thread context of 1832 1988 PURCHASE ORDER 29kva.exe PURCHASE ORDER 29kva.exe PID 1832 set thread context of 1224 1832 PURCHASE ORDER 29kva.exe Explorer.EXE PID 1652 set thread context of 1224 1652 mstsc.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
PURCHASE ORDER 29kva.exemstsc.exepid process 1832 PURCHASE ORDER 29kva.exe 1832 PURCHASE ORDER 29kva.exe 1652 mstsc.exe 1652 mstsc.exe 1652 mstsc.exe 1652 mstsc.exe 1652 mstsc.exe 1652 mstsc.exe 1652 mstsc.exe 1652 mstsc.exe 1652 mstsc.exe 1652 mstsc.exe 1652 mstsc.exe 1652 mstsc.exe 1652 mstsc.exe 1652 mstsc.exe 1652 mstsc.exe 1652 mstsc.exe 1652 mstsc.exe 1652 mstsc.exe 1652 mstsc.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PURCHASE ORDER 29kva.exemstsc.exepid process 1832 PURCHASE ORDER 29kva.exe 1832 PURCHASE ORDER 29kva.exe 1832 PURCHASE ORDER 29kva.exe 1652 mstsc.exe 1652 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PURCHASE ORDER 29kva.exemstsc.exedescription pid process Token: SeDebugPrivilege 1832 PURCHASE ORDER 29kva.exe Token: SeDebugPrivilege 1652 mstsc.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1224 Explorer.EXE 1224 Explorer.EXE 1224 Explorer.EXE 1224 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1224 Explorer.EXE 1224 Explorer.EXE 1224 Explorer.EXE 1224 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
PURCHASE ORDER 29kva.exeExplorer.EXEmstsc.exedescription pid process target process PID 1988 wrote to memory of 1832 1988 PURCHASE ORDER 29kva.exe PURCHASE ORDER 29kva.exe PID 1988 wrote to memory of 1832 1988 PURCHASE ORDER 29kva.exe PURCHASE ORDER 29kva.exe PID 1988 wrote to memory of 1832 1988 PURCHASE ORDER 29kva.exe PURCHASE ORDER 29kva.exe PID 1988 wrote to memory of 1832 1988 PURCHASE ORDER 29kva.exe PURCHASE ORDER 29kva.exe PID 1988 wrote to memory of 1832 1988 PURCHASE ORDER 29kva.exe PURCHASE ORDER 29kva.exe PID 1988 wrote to memory of 1832 1988 PURCHASE ORDER 29kva.exe PURCHASE ORDER 29kva.exe PID 1988 wrote to memory of 1832 1988 PURCHASE ORDER 29kva.exe PURCHASE ORDER 29kva.exe PID 1224 wrote to memory of 1652 1224 Explorer.EXE mstsc.exe PID 1224 wrote to memory of 1652 1224 Explorer.EXE mstsc.exe PID 1224 wrote to memory of 1652 1224 Explorer.EXE mstsc.exe PID 1224 wrote to memory of 1652 1224 Explorer.EXE mstsc.exe PID 1652 wrote to memory of 1712 1652 mstsc.exe cmd.exe PID 1652 wrote to memory of 1712 1652 mstsc.exe cmd.exe PID 1652 wrote to memory of 1712 1652 mstsc.exe cmd.exe PID 1652 wrote to memory of 1712 1652 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 29kva.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 29kva.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 29kva.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 29kva.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 29kva.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1224-70-0x0000000002AB0000-0x0000000002BCF000-memory.dmpFilesize
1.1MB
-
memory/1224-78-0x0000000004250000-0x000000000433A000-memory.dmpFilesize
936KB
-
memory/1652-77-0x0000000001F30000-0x0000000001FC4000-memory.dmpFilesize
592KB
-
memory/1652-75-0x0000000002120000-0x0000000002423000-memory.dmpFilesize
3.0MB
-
memory/1652-74-0x00000000000E0000-0x000000000010F000-memory.dmpFilesize
188KB
-
memory/1652-73-0x00000000003E0000-0x00000000004E4000-memory.dmpFilesize
1.0MB
-
memory/1652-72-0x00000000767B1000-0x00000000767B3000-memory.dmpFilesize
8KB
-
memory/1652-71-0x0000000000000000-mapping.dmp
-
memory/1712-76-0x0000000000000000-mapping.dmp
-
memory/1832-68-0x0000000000B10000-0x0000000000E13000-memory.dmpFilesize
3.0MB
-
memory/1832-69-0x0000000000190000-0x00000000001A5000-memory.dmpFilesize
84KB
-
memory/1832-67-0x000000000041F1C0-mapping.dmp
-
memory/1832-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1988-59-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/1988-65-0x0000000001FB0000-0x0000000001FEF000-memory.dmpFilesize
252KB
-
memory/1988-64-0x0000000000690000-0x0000000000692000-memory.dmpFilesize
8KB
-
memory/1988-63-0x0000000005E40000-0x0000000005EAF000-memory.dmpFilesize
444KB
-
memory/1988-62-0x00000000005E0000-0x00000000005F3000-memory.dmpFilesize
76KB
-
memory/1988-61-0x0000000004CD0000-0x0000000004CD1000-memory.dmpFilesize
4KB