Analysis
-
max time kernel
155s -
max time network
155s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
14-10-2021 14:20
Static task
static1
Behavioral task
behavioral1
Sample
CNEW ORDER17.exe
Resource
win7-en-20210920
General
-
Target
CNEW ORDER17.exe
-
Size
960KB
-
MD5
c54edc9ef9d72fe0fe048e8ac884626b
-
SHA1
11dce70f33e490eb9b89726776915a374bb59a59
-
SHA256
43fcb442b80665d42271689310ebd569e84f74287063a62e14beba808178e098
-
SHA512
c65d37de77ad4598ee0b665145c988681d38fc26aa2eb2f5b5d1b73646eaa843cb18c4172d0ed7dcee4bd25bdf692e7b1aacc410a56b6959158f9e3bab1f0c81
Malware Config
Extracted
formbook
4.1
h0c4
http://www.cursoukulelegospel.com/h0c4/
looknewly.com
icha2016.com
datnenhoalachn.xyz
fark.ltd
zjlj.site
carpinteriacansino.com
atozmp33.com
oficialacesso.com
tuningfrance.com
rmm-mx96r.net
outsidestyleshop.com
eufundas.com
a91furniture.com
sfme.net
englisch.coach
wallacechen.info
nyayeo.com
jintongstore.com
vanwerknaarwerk.info
thekimlab.net
morvirtualassistant.com
ichatbengal.com
doctors-technology.com
mississippisms.com
koopa.codes
sproutheads.com
gardenkitchenspa.com
hoom.life
wiselogistic.com
appadaptor.com
jumtix.xyz
academiavirtualjjb.com
pcmrmf.com
hlsx069.com
sunielkapoor.com
truetaster.com
rylautosales.com
cgmobile.net
www-inloggen-nl.info
businesswebstrategy.net
fetch-a-sg-hair-transplant.fyi
paintingservicespune.com
cakeeyes.net
tandebrokers.com
navigantcapitalpartners.com
hubska.com
foillaws.com
battletraining.com
bitcoin-recovery.com
yourbuildvideos.com
naturalsumaq.com
prasikapsychotherapy.com
jphousecleaningservices.com
fetch-hepatitis-c.zone
easypay-agent.com
ronaldcraig.com
highonloveshop.com
bayharborislandhouse2.com
aventuramaker.com
han-chill.com
wrapmeupbkk.com
videomarketing.tips
ishouldntbthareasonugohard.com
psychotherapie-wermuth.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1880-62-0x000000000041EDB0-mapping.dmp formbook behavioral1/memory/1880-61-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/272-69-0x0000000000070000-0x000000000009E000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1644 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
CNEW ORDER17.exeCNEW ORDER17.exewscript.exedescription pid process target process PID 1340 set thread context of 1880 1340 CNEW ORDER17.exe CNEW ORDER17.exe PID 1880 set thread context of 1216 1880 CNEW ORDER17.exe Explorer.EXE PID 272 set thread context of 1216 272 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
CNEW ORDER17.exeCNEW ORDER17.exewscript.exepid process 1340 CNEW ORDER17.exe 1340 CNEW ORDER17.exe 1340 CNEW ORDER17.exe 1880 CNEW ORDER17.exe 1880 CNEW ORDER17.exe 272 wscript.exe 272 wscript.exe 272 wscript.exe 272 wscript.exe 272 wscript.exe 272 wscript.exe 272 wscript.exe 272 wscript.exe 272 wscript.exe 272 wscript.exe 272 wscript.exe 272 wscript.exe 272 wscript.exe 272 wscript.exe 272 wscript.exe 272 wscript.exe 272 wscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
CNEW ORDER17.exewscript.exepid process 1880 CNEW ORDER17.exe 1880 CNEW ORDER17.exe 1880 CNEW ORDER17.exe 272 wscript.exe 272 wscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
CNEW ORDER17.exeCNEW ORDER17.exewscript.exedescription pid process Token: SeDebugPrivilege 1340 CNEW ORDER17.exe Token: SeDebugPrivilege 1880 CNEW ORDER17.exe Token: SeDebugPrivilege 272 wscript.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1216 Explorer.EXE 1216 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1216 Explorer.EXE 1216 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
CNEW ORDER17.exeExplorer.EXEwscript.exedescription pid process target process PID 1340 wrote to memory of 1880 1340 CNEW ORDER17.exe CNEW ORDER17.exe PID 1340 wrote to memory of 1880 1340 CNEW ORDER17.exe CNEW ORDER17.exe PID 1340 wrote to memory of 1880 1340 CNEW ORDER17.exe CNEW ORDER17.exe PID 1340 wrote to memory of 1880 1340 CNEW ORDER17.exe CNEW ORDER17.exe PID 1340 wrote to memory of 1880 1340 CNEW ORDER17.exe CNEW ORDER17.exe PID 1340 wrote to memory of 1880 1340 CNEW ORDER17.exe CNEW ORDER17.exe PID 1340 wrote to memory of 1880 1340 CNEW ORDER17.exe CNEW ORDER17.exe PID 1216 wrote to memory of 272 1216 Explorer.EXE wscript.exe PID 1216 wrote to memory of 272 1216 Explorer.EXE wscript.exe PID 1216 wrote to memory of 272 1216 Explorer.EXE wscript.exe PID 1216 wrote to memory of 272 1216 Explorer.EXE wscript.exe PID 272 wrote to memory of 1644 272 wscript.exe cmd.exe PID 272 wrote to memory of 1644 272 wscript.exe cmd.exe PID 272 wrote to memory of 1644 272 wscript.exe cmd.exe PID 272 wrote to memory of 1644 272 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CNEW ORDER17.exe"C:\Users\Admin\AppData\Local\Temp\CNEW ORDER17.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CNEW ORDER17.exe"C:\Users\Admin\AppData\Local\Temp\CNEW ORDER17.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\CNEW ORDER17.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/272-68-0x0000000000730000-0x0000000000756000-memory.dmpFilesize
152KB
-
memory/272-72-0x0000000002370000-0x0000000002403000-memory.dmpFilesize
588KB
-
memory/272-71-0x0000000001FC0000-0x00000000022C3000-memory.dmpFilesize
3.0MB
-
memory/272-69-0x0000000000070000-0x000000000009E000-memory.dmpFilesize
184KB
-
memory/272-67-0x0000000000000000-mapping.dmp
-
memory/1216-73-0x0000000007F20000-0x000000000808A000-memory.dmpFilesize
1.4MB
-
memory/1216-66-0x0000000004C10000-0x0000000004D87000-memory.dmpFilesize
1.5MB
-
memory/1340-56-0x00000000049A0000-0x0000000004A66000-memory.dmpFilesize
792KB
-
memory/1340-57-0x0000000000520000-0x000000000054E000-memory.dmpFilesize
184KB
-
memory/1340-58-0x0000000004B80000-0x0000000004B81000-memory.dmpFilesize
4KB
-
memory/1340-54-0x00000000013C0000-0x00000000013C1000-memory.dmpFilesize
4KB
-
memory/1644-70-0x0000000000000000-mapping.dmp
-
memory/1880-59-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1880-65-0x0000000000110000-0x0000000000124000-memory.dmpFilesize
80KB
-
memory/1880-64-0x0000000000990000-0x0000000000C93000-memory.dmpFilesize
3.0MB
-
memory/1880-61-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1880-62-0x000000000041EDB0-mapping.dmp
-
memory/1880-60-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB