Payment Advise.xlsx
Payment Advise.xlsx
337KB
12-10-2021 23:21
2a2774f89f6ac878975ef5227cc8a92b
bfbfd645fed06b7598bfe1f583d0ba04ad943b29
54167fce5b8273b4a21f9da96c32113ebe3e5831f51aebad3ae1e97d5165f263
Extracted
| Family | formbook |
| Version | 4.1 |
| Campaign | kzk9 |
| C2 |
http://www.yourmajordomo.com/kzk9/ |
| Decoy |
tianconghuo.club 1996-page.com ourtownmax.net conservativetreehose.com synth.repair donnachicacreperia.com tentfull.com weapp.download surfersink.com gattlebusinessservices.com sebastian249.com anhphuc.company betternatureproducts.net defroplate.com seattlesquidsquad.com polarjob.com lendingadvantage.com angelsondope.com goportjitney.com tiendagrupojagr.com self-care360.com foreignexchage.com loan-stalemate.info hrsimrnsingh.com laserobsession.com primetimesmagazine.com teminyulon.xyz kanoondarab.com alpinefall.com tbmautosales.com 4g2020.com libertyquartermaster.com flavorfalafel.com generlitravel.com solvedfp.icu jamnvibez.com zmx258.com doudiangroup.com dancecenterwest.com ryantheeconomist.com beeofthehive.com bluelearn.world vivalasplantas.com yumiacraftlab.com shophere247365.com enjoybespokenwords.com windajol.com ctgbazar.xyz afcerd.com dateprotect.com |
Filter: none
-
Formbook
Description
Formbook is a data stealing malware which is capable of stealing data.
Tags
-
Formbook Payload
Tags
Reported IOCs
resource yara_rule behavioral1/memory/1804-77-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1804-78-0x000000000041EB80-mapping.dmp formbook behavioral1/memory/1804-84-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1664-91-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Blocklisted process makes network requestEQNEDT32.EXE
Reported IOCs
flow pid process 5 1528 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXEvbc.exevbc.exe
Reported IOCs
pid process 1560 vbc.exe 1804 vbc.exe -
Loads dropped DLLEQNEDT32.EXE
Reported IOCs
pid process 1528 EQNEDT32.EXE 1528 EQNEDT32.EXE 1528 EQNEDT32.EXE 1528 EQNEDT32.EXE -
Uses the VBS compiler for execution
TTPs
-
Suspicious use of SetThreadContextvbc.exevbc.exeraserver.exe
Reported IOCs
description pid process target process PID 1560 set thread context of 1804 1560 vbc.exe vbc.exe PID 1804 set thread context of 1196 1804 vbc.exe Explorer.EXE PID 1804 set thread context of 1196 1804 vbc.exe Explorer.EXE PID 1664 set thread context of 1196 1664 raserver.exe Explorer.EXE -
Enumerates system info in registryEXCEL.EXE
TTPs
Reported IOCs
description ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation EditorEQNEDT32.EXE
Description
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
Tags
TTPs
Reported IOCs
pid process 1528 EQNEDT32.EXE -
Modifies Internet Explorer settingsEXCEL.EXE
Tags
TTPs
Reported IOCs
description ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListenerEXCEL.EXE
Reported IOCs
pid process 1984 EXCEL.EXE -
Suspicious behavior: EnumeratesProcessesvbc.exevbc.exeraserver.exe
Reported IOCs
pid process 1560 vbc.exe 1560 vbc.exe 1560 vbc.exe 1560 vbc.exe 1560 vbc.exe 1560 vbc.exe 1560 vbc.exe 1804 vbc.exe 1804 vbc.exe 1804 vbc.exe 1664 raserver.exe 1664 raserver.exe 1664 raserver.exe 1664 raserver.exe 1664 raserver.exe 1664 raserver.exe 1664 raserver.exe 1664 raserver.exe 1664 raserver.exe 1664 raserver.exe 1664 raserver.exe 1664 raserver.exe 1664 raserver.exe -
Suspicious behavior: GetForegroundWindowSpamExplorer.EXE
Reported IOCs
pid process 1196 Explorer.EXE -
Suspicious behavior: MapViewOfSectionvbc.exeraserver.exe
Reported IOCs
pid process 1804 vbc.exe 1804 vbc.exe 1804 vbc.exe 1804 vbc.exe 1664 raserver.exe 1664 raserver.exe -
Suspicious use of AdjustPrivilegeTokenvbc.exevbc.exeraserver.exeExplorer.EXE
Reported IOCs
description pid process Token: SeDebugPrivilege 1560 vbc.exe Token: SeDebugPrivilege 1804 vbc.exe Token: SeDebugPrivilege 1664 raserver.exe Token: SeShutdownPrivilege 1196 Explorer.EXE Token: SeShutdownPrivilege 1196 Explorer.EXE Token: SeShutdownPrivilege 1196 Explorer.EXE Token: SeShutdownPrivilege 1196 Explorer.EXE Token: SeShutdownPrivilege 1196 Explorer.EXE -
Suspicious use of SetWindowsHookExEXCEL.EXE
Reported IOCs
pid process 1984 EXCEL.EXE 1984 EXCEL.EXE 1984 EXCEL.EXE -
Suspicious use of WriteProcessMemoryEQNEDT32.EXEvbc.exevbc.exeraserver.exe
Reported IOCs
description pid process target process PID 1528 wrote to memory of 1560 1528 EQNEDT32.EXE vbc.exe PID 1528 wrote to memory of 1560 1528 EQNEDT32.EXE vbc.exe PID 1528 wrote to memory of 1560 1528 EQNEDT32.EXE vbc.exe PID 1528 wrote to memory of 1560 1528 EQNEDT32.EXE vbc.exe PID 1560 wrote to memory of 1804 1560 vbc.exe vbc.exe PID 1560 wrote to memory of 1804 1560 vbc.exe vbc.exe PID 1560 wrote to memory of 1804 1560 vbc.exe vbc.exe PID 1560 wrote to memory of 1804 1560 vbc.exe vbc.exe PID 1560 wrote to memory of 1804 1560 vbc.exe vbc.exe PID 1560 wrote to memory of 1804 1560 vbc.exe vbc.exe PID 1560 wrote to memory of 1804 1560 vbc.exe vbc.exe PID 1804 wrote to memory of 1664 1804 vbc.exe raserver.exe PID 1804 wrote to memory of 1664 1804 vbc.exe raserver.exe PID 1804 wrote to memory of 1664 1804 vbc.exe raserver.exe PID 1804 wrote to memory of 1664 1804 vbc.exe raserver.exe PID 1664 wrote to memory of 324 1664 raserver.exe cmd.exe PID 1664 wrote to memory of 324 1664 raserver.exe cmd.exe PID 1664 wrote to memory of 324 1664 raserver.exe cmd.exe PID 1664 wrote to memory of 324 1664 raserver.exe cmd.exe
-
C:\Windows\Explorer.EXEPID:1196C:\Windows\Explorer.EXESuspicious behavior: GetForegroundWindowSpamSuspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXEPID:1984"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Payment Advise.xlsx"Enumerates system info in registryModifies Internet Explorer settingsSuspicious behavior: AddClipboardFormatListenerSuspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\autoconv.exePID:980"C:\Windows\SysWOW64\autoconv.exe"
-
C:\Windows\SysWOW64\autofmt.exePID:1736"C:\Windows\SysWOW64\autofmt.exe"
-
C:\Windows\SysWOW64\autofmt.exePID:1372"C:\Windows\SysWOW64\autofmt.exe"
-
C:\Windows\SysWOW64\autofmt.exePID:348"C:\Windows\SysWOW64\autofmt.exe"
-
C:\Windows\SysWOW64\autofmt.exePID:1964"C:\Windows\SysWOW64\autofmt.exe"
-
C:\Windows\SysWOW64\autofmt.exePID:1684"C:\Windows\SysWOW64\autofmt.exe"
-
C:\Windows\SysWOW64\autofmt.exePID:908"C:\Windows\SysWOW64\autofmt.exe"
-
C:\Windows\SysWOW64\autofmt.exePID:1508"C:\Windows\SysWOW64\autofmt.exe"
-
C:\Windows\SysWOW64\autofmt.exePID:1836"C:\Windows\SysWOW64\autofmt.exe"
-
C:\Windows\SysWOW64\autofmt.exePID:1812"C:\Windows\SysWOW64\autofmt.exe"
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEPID:1528"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingBlocklisted process makes network requestLoads dropped DLLLaunches Equation EditorSuspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exePID:1560"C:\Users\Public\vbc.exe"Executes dropped EXESuspicious use of SetThreadContextSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exePID:1804"C:\Users\Public\vbc.exe"Executes dropped EXESuspicious use of SetThreadContextSuspicious behavior: EnumeratesProcessesSuspicious behavior: MapViewOfSectionSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\raserver.exePID:1664"C:\Windows\SysWOW64\raserver.exe"Suspicious use of SetThreadContextSuspicious behavior: EnumeratesProcessesSuspicious behavior: MapViewOfSectionSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exePID:324/c del "C:\Users\Public\vbc.exe"
-
C:\Users\Public\vbc.exe
MD51fe73fe4d37cae6a02262b5164f3def0
SHA180b03eb27651723bded1fd1425f489225b3bba3b
SHA2560c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8
SHA5127416dadb6e85cc43000bba33f47797cf7e5fe5ee0c9f8639685130264a867b6048839d2b74ca3e00b00caf8a1dcf83d08f01901c56ab9343888d62501c48d2b6
-
C:\Users\Public\vbc.exe
MD51fe73fe4d37cae6a02262b5164f3def0
SHA180b03eb27651723bded1fd1425f489225b3bba3b
SHA2560c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8
SHA5127416dadb6e85cc43000bba33f47797cf7e5fe5ee0c9f8639685130264a867b6048839d2b74ca3e00b00caf8a1dcf83d08f01901c56ab9343888d62501c48d2b6
-
C:\Users\Public\vbc.exe
MD51fe73fe4d37cae6a02262b5164f3def0
SHA180b03eb27651723bded1fd1425f489225b3bba3b
SHA2560c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8
SHA5127416dadb6e85cc43000bba33f47797cf7e5fe5ee0c9f8639685130264a867b6048839d2b74ca3e00b00caf8a1dcf83d08f01901c56ab9343888d62501c48d2b6
-
\Users\Public\vbc.exe
MD51fe73fe4d37cae6a02262b5164f3def0
SHA180b03eb27651723bded1fd1425f489225b3bba3b
SHA2560c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8
SHA5127416dadb6e85cc43000bba33f47797cf7e5fe5ee0c9f8639685130264a867b6048839d2b74ca3e00b00caf8a1dcf83d08f01901c56ab9343888d62501c48d2b6
-
\Users\Public\vbc.exe
MD51fe73fe4d37cae6a02262b5164f3def0
SHA180b03eb27651723bded1fd1425f489225b3bba3b
SHA2560c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8
SHA5127416dadb6e85cc43000bba33f47797cf7e5fe5ee0c9f8639685130264a867b6048839d2b74ca3e00b00caf8a1dcf83d08f01901c56ab9343888d62501c48d2b6
-
\Users\Public\vbc.exe
MD51fe73fe4d37cae6a02262b5164f3def0
SHA180b03eb27651723bded1fd1425f489225b3bba3b
SHA2560c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8
SHA5127416dadb6e85cc43000bba33f47797cf7e5fe5ee0c9f8639685130264a867b6048839d2b74ca3e00b00caf8a1dcf83d08f01901c56ab9343888d62501c48d2b6
-
\Users\Public\vbc.exe
MD51fe73fe4d37cae6a02262b5164f3def0
SHA180b03eb27651723bded1fd1425f489225b3bba3b
SHA2560c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8
SHA5127416dadb6e85cc43000bba33f47797cf7e5fe5ee0c9f8639685130264a867b6048839d2b74ca3e00b00caf8a1dcf83d08f01901c56ab9343888d62501c48d2b6
-
memory/324-89-0x0000000000000000-mapping.dmp
-
memory/1196-86-0x0000000004A30000-0x0000000004B22000-memory.dmp
-
memory/1196-95-0x0000000006D20000-0x0000000006EA0000-memory.dmp
-
memory/1196-82-0x0000000006490000-0x00000000065AB000-memory.dmp
-
memory/1528-62-0x0000000075AD1000-0x0000000075AD3000-memory.dmp
-
memory/1560-72-0x0000000004C60000-0x0000000004C61000-memory.dmp
-
memory/1560-73-0x0000000000330000-0x0000000000335000-memory.dmp
-
memory/1560-74-0x00000000050D0000-0x0000000005120000-memory.dmp
-
memory/1560-70-0x0000000000AA0000-0x0000000000AA1000-memory.dmp
-
memory/1560-67-0x0000000000000000-mapping.dmp
-
memory/1664-91-0x0000000000080000-0x00000000000AE000-memory.dmp
-
memory/1664-90-0x0000000000C90000-0x0000000000CAC000-memory.dmp
-
memory/1664-93-0x0000000000840000-0x00000000008D3000-memory.dmp
-
memory/1664-87-0x0000000000000000-mapping.dmp
-
memory/1664-92-0x00000000020B0000-0x00000000023B3000-memory.dmp
-
memory/1804-77-0x0000000000400000-0x000000000042E000-memory.dmp
-
memory/1804-84-0x0000000000400000-0x000000000042E000-memory.dmp
-
memory/1804-83-0x0000000000180000-0x0000000000194000-memory.dmp
-
memory/1804-85-0x00000000001D0000-0x00000000001E4000-memory.dmp
-
memory/1804-81-0x0000000000B20000-0x0000000000E23000-memory.dmp
-
memory/1804-78-0x000000000041EB80-mapping.dmp
-
memory/1804-76-0x0000000000400000-0x000000000042E000-memory.dmp
-
memory/1804-75-0x0000000000400000-0x000000000042E000-memory.dmp
-
memory/1984-61-0x000000005FFF0000-0x0000000060000000-memory.dmp
-
memory/1984-60-0x0000000070FD1000-0x0000000070FD3000-memory.dmp
-
memory/1984-94-0x000000005FFF0000-0x0000000060000000-memory.dmp
-
memory/1984-59-0x000000002FFB1000-0x000000002FFB4000-memory.dmp