Analysis
-
max time kernel
162s -
max time network
181s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
14-10-2021 14:20
Static task
static1
Behavioral task
behavioral1
Sample
CNEW ORDER17.exe
Resource
win7-en-20210920
General
-
Target
CNEW ORDER17.exe
-
Size
960KB
-
MD5
c54edc9ef9d72fe0fe048e8ac884626b
-
SHA1
11dce70f33e490eb9b89726776915a374bb59a59
-
SHA256
43fcb442b80665d42271689310ebd569e84f74287063a62e14beba808178e098
-
SHA512
c65d37de77ad4598ee0b665145c988681d38fc26aa2eb2f5b5d1b73646eaa843cb18c4172d0ed7dcee4bd25bdf692e7b1aacc410a56b6959158f9e3bab1f0c81
Malware Config
Extracted
formbook
4.1
h0c4
http://www.cursoukulelegospel.com/h0c4/
looknewly.com
icha2016.com
datnenhoalachn.xyz
fark.ltd
zjlj.site
carpinteriacansino.com
atozmp33.com
oficialacesso.com
tuningfrance.com
rmm-mx96r.net
outsidestyleshop.com
eufundas.com
a91furniture.com
sfme.net
englisch.coach
wallacechen.info
nyayeo.com
jintongstore.com
vanwerknaarwerk.info
thekimlab.net
morvirtualassistant.com
ichatbengal.com
doctors-technology.com
mississippisms.com
koopa.codes
sproutheads.com
gardenkitchenspa.com
hoom.life
wiselogistic.com
appadaptor.com
jumtix.xyz
academiavirtualjjb.com
pcmrmf.com
hlsx069.com
sunielkapoor.com
truetaster.com
rylautosales.com
cgmobile.net
www-inloggen-nl.info
businesswebstrategy.net
fetch-a-sg-hair-transplant.fyi
paintingservicespune.com
cakeeyes.net
tandebrokers.com
navigantcapitalpartners.com
hubska.com
foillaws.com
battletraining.com
bitcoin-recovery.com
yourbuildvideos.com
naturalsumaq.com
prasikapsychotherapy.com
jphousecleaningservices.com
fetch-hepatitis-c.zone
easypay-agent.com
ronaldcraig.com
highonloveshop.com
bayharborislandhouse2.com
aventuramaker.com
han-chill.com
wrapmeupbkk.com
videomarketing.tips
ishouldntbthareasonugohard.com
psychotherapie-wermuth.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2556-120-0x000000000041EDB0-mapping.dmp formbook behavioral2/memory/2556-119-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2556-126-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/896-131-0x00000000001D0000-0x00000000001FE000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
CNEW ORDER17.exeCNEW ORDER17.exewscript.exedescription pid process target process PID 2112 set thread context of 2556 2112 CNEW ORDER17.exe CNEW ORDER17.exe PID 2556 set thread context of 3036 2556 CNEW ORDER17.exe Explorer.EXE PID 2556 set thread context of 3036 2556 CNEW ORDER17.exe Explorer.EXE PID 896 set thread context of 3036 896 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 47 IoCs
Processes:
CNEW ORDER17.exeCNEW ORDER17.exewscript.exepid process 2112 CNEW ORDER17.exe 2112 CNEW ORDER17.exe 2112 CNEW ORDER17.exe 2112 CNEW ORDER17.exe 2112 CNEW ORDER17.exe 2112 CNEW ORDER17.exe 2112 CNEW ORDER17.exe 2112 CNEW ORDER17.exe 2112 CNEW ORDER17.exe 2112 CNEW ORDER17.exe 2112 CNEW ORDER17.exe 2556 CNEW ORDER17.exe 2556 CNEW ORDER17.exe 2556 CNEW ORDER17.exe 2556 CNEW ORDER17.exe 2556 CNEW ORDER17.exe 2556 CNEW ORDER17.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe 896 wscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3036 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
CNEW ORDER17.exewscript.exepid process 2556 CNEW ORDER17.exe 2556 CNEW ORDER17.exe 2556 CNEW ORDER17.exe 2556 CNEW ORDER17.exe 896 wscript.exe 896 wscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
CNEW ORDER17.exeCNEW ORDER17.exewscript.exedescription pid process Token: SeDebugPrivilege 2112 CNEW ORDER17.exe Token: SeDebugPrivilege 2556 CNEW ORDER17.exe Token: SeDebugPrivilege 896 wscript.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
CNEW ORDER17.exeExplorer.EXEwscript.exedescription pid process target process PID 2112 wrote to memory of 1536 2112 CNEW ORDER17.exe CNEW ORDER17.exe PID 2112 wrote to memory of 1536 2112 CNEW ORDER17.exe CNEW ORDER17.exe PID 2112 wrote to memory of 1536 2112 CNEW ORDER17.exe CNEW ORDER17.exe PID 2112 wrote to memory of 3572 2112 CNEW ORDER17.exe CNEW ORDER17.exe PID 2112 wrote to memory of 3572 2112 CNEW ORDER17.exe CNEW ORDER17.exe PID 2112 wrote to memory of 3572 2112 CNEW ORDER17.exe CNEW ORDER17.exe PID 2112 wrote to memory of 2556 2112 CNEW ORDER17.exe CNEW ORDER17.exe PID 2112 wrote to memory of 2556 2112 CNEW ORDER17.exe CNEW ORDER17.exe PID 2112 wrote to memory of 2556 2112 CNEW ORDER17.exe CNEW ORDER17.exe PID 2112 wrote to memory of 2556 2112 CNEW ORDER17.exe CNEW ORDER17.exe PID 2112 wrote to memory of 2556 2112 CNEW ORDER17.exe CNEW ORDER17.exe PID 2112 wrote to memory of 2556 2112 CNEW ORDER17.exe CNEW ORDER17.exe PID 3036 wrote to memory of 896 3036 Explorer.EXE wscript.exe PID 3036 wrote to memory of 896 3036 Explorer.EXE wscript.exe PID 3036 wrote to memory of 896 3036 Explorer.EXE wscript.exe PID 896 wrote to memory of 1432 896 wscript.exe cmd.exe PID 896 wrote to memory of 1432 896 wscript.exe cmd.exe PID 896 wrote to memory of 1432 896 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CNEW ORDER17.exe"C:\Users\Admin\AppData\Local\Temp\CNEW ORDER17.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CNEW ORDER17.exe"C:\Users\Admin\AppData\Local\Temp\CNEW ORDER17.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\CNEW ORDER17.exe"C:\Users\Admin\AppData\Local\Temp\CNEW ORDER17.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\CNEW ORDER17.exe"C:\Users\Admin\AppData\Local\Temp\CNEW ORDER17.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\CNEW ORDER17.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/896-129-0x0000000000000000-mapping.dmp
-
memory/896-134-0x00000000043D0000-0x0000000004463000-memory.dmpFilesize
588KB
-
memory/896-132-0x0000000004510000-0x0000000004830000-memory.dmpFilesize
3.1MB
-
memory/896-131-0x00000000001D0000-0x00000000001FE000-memory.dmpFilesize
184KB
-
memory/896-130-0x0000000000C10000-0x0000000000C37000-memory.dmpFilesize
156KB
-
memory/1432-133-0x0000000000000000-mapping.dmp
-
memory/2112-117-0x00000000058E0000-0x00000000059A6000-memory.dmpFilesize
792KB
-
memory/2112-118-0x00000000011C0000-0x00000000011EE000-memory.dmpFilesize
184KB
-
memory/2112-115-0x0000000000FF0000-0x0000000000FF1000-memory.dmpFilesize
4KB
-
memory/2112-121-0x0000000005C60000-0x0000000005C61000-memory.dmpFilesize
4KB
-
memory/2556-119-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2556-127-0x00000000011F0000-0x0000000001204000-memory.dmpFilesize
80KB
-
memory/2556-126-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2556-123-0x0000000001240000-0x0000000001560000-memory.dmpFilesize
3.1MB
-
memory/2556-124-0x0000000001180000-0x0000000001194000-memory.dmpFilesize
80KB
-
memory/2556-120-0x000000000041EDB0-mapping.dmp
-
memory/3036-128-0x0000000006630000-0x00000000067DA000-memory.dmpFilesize
1.7MB
-
memory/3036-125-0x0000000006220000-0x00000000062DD000-memory.dmpFilesize
756KB
-
memory/3036-135-0x00000000067E0000-0x000000000692B000-memory.dmpFilesize
1.3MB