Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-01-2022 09:31
Static task
static1
Behavioral task
behavioral1
Sample
new_order.exe
Resource
win7-en-20211208
General
-
Target
new_order.exe
-
Size
247KB
-
MD5
a0e70d1760e60d81e0f4ac2904fa8002
-
SHA1
0512dcf545274ac6512abf3fb31a6fff41614280
-
SHA256
0cd606362bbe747f3d0c0193675ce46ea2920fba28580b784f50a2969bbb0c27
-
SHA512
59c04bc30b9f279d434428011efe80d41fd5de99c92165c77dc2a097b742c60e676f65d6185c90d9e5ddfd181fd4a32c7d237ca75ed2be978c6b951be6ae8588
Malware Config
Extracted
formbook
4.1
os16
nautic-experts-hageboelling.com
fullharvestfundraising.com
xbdsm.club
duocaterers.com
prizebuddy.club
nillprive.com
firebreathingpenguin.com
buxledger.com
annual-journals.com
mydemosite0.com
noaoka.com
eblaghe-iran.xyz
globalyuncang.com
jacqueson-autocars.com
asiafinances.com
howtomakearesume.space
modernwarfaresecrets.com
dualamaquinaria.com
thrili.com
gracing-up.com
jcrealtydesigns.com
southaustinmarket.com
dp-yszxwbhc.com
cryptolux.store
yourtechyadda.com
yogamat-turban.com
fykori.xyz
bitherders.com
strelingcollectibles.com
undershieldz.com
youcarboneutral.com
meetjaykinder.com
wicked-smokes.com
wy-bride.com
dunespro.com
sallyandterry.com
theamalfiswim.com
eleynworld.com
dreamsinbloomphotography.com
anaccommodation.com
slingactivt.com
rxd-ereecd.com
immovableproperty.online
ramziflowers.com
anthropophony.com
uncle.finance
ialife.info
kennascookies.com
meta-medical.info
sexcommittee.com
royalfountainlogistics.com
thedefinitionteam.store
dragonflyessence.com
momubeauty.com
alraedest.com
alcmjd.xyz
massagecon.com
nicoletian.com
rapslearning.online
dlapi.xyz
52economics.com
neurochirurgie-eisner.com
mbbfocean.xyz
greenlightiim.com
foodgw.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/520-57-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1460-64-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 564 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
new_order.exepid process 960 new_order.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
new_order.exenew_order.execolorcpl.exedescription pid process target process PID 960 set thread context of 520 960 new_order.exe new_order.exe PID 520 set thread context of 1412 520 new_order.exe Explorer.EXE PID 1460 set thread context of 1412 1460 colorcpl.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
new_order.execolorcpl.exepid process 520 new_order.exe 520 new_order.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe 1460 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
new_order.execolorcpl.exepid process 520 new_order.exe 520 new_order.exe 520 new_order.exe 1460 colorcpl.exe 1460 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
new_order.execolorcpl.exedescription pid process Token: SeDebugPrivilege 520 new_order.exe Token: SeDebugPrivilege 1460 colorcpl.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE 1412 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE 1412 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
new_order.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 960 wrote to memory of 520 960 new_order.exe new_order.exe PID 960 wrote to memory of 520 960 new_order.exe new_order.exe PID 960 wrote to memory of 520 960 new_order.exe new_order.exe PID 960 wrote to memory of 520 960 new_order.exe new_order.exe PID 960 wrote to memory of 520 960 new_order.exe new_order.exe PID 960 wrote to memory of 520 960 new_order.exe new_order.exe PID 960 wrote to memory of 520 960 new_order.exe new_order.exe PID 1412 wrote to memory of 1460 1412 Explorer.EXE colorcpl.exe PID 1412 wrote to memory of 1460 1412 Explorer.EXE colorcpl.exe PID 1412 wrote to memory of 1460 1412 Explorer.EXE colorcpl.exe PID 1412 wrote to memory of 1460 1412 Explorer.EXE colorcpl.exe PID 1460 wrote to memory of 564 1460 colorcpl.exe cmd.exe PID 1460 wrote to memory of 564 1460 colorcpl.exe cmd.exe PID 1460 wrote to memory of 564 1460 colorcpl.exe cmd.exe PID 1460 wrote to memory of 564 1460 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\new_order.exe"C:\Users\Admin\AppData\Local\Temp\new_order.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\new_order.exe"C:\Users\Admin\AppData\Local\Temp\new_order.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\new_order.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsdEB89.tmp\yvucmw.dllMD5
86475a0dbd24b01bcd1b264fecfdf1a2
SHA1745ce764eb6c9bf86e5ae65a5f365e7faf14a394
SHA2564ce85a4d12aa0d5b072330dbc50393d2d29eba5321beb3b3bfc6c4a8e9306ad7
SHA512e14dc2f083bd976482554b62b875645815f6f6bcb9b604b366b7f854e2620222de8f038bb8ddbc2026082476246a9cc1855c6aa1b1cc2a1415feb4a75b4eaca1
-
memory/520-57-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/520-59-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/520-60-0x0000000000260000-0x0000000000274000-memory.dmpFilesize
80KB
-
memory/960-55-0x0000000076921000-0x0000000076923000-memory.dmpFilesize
8KB
-
memory/1412-61-0x0000000007200000-0x0000000007304000-memory.dmpFilesize
1.0MB
-
memory/1412-67-0x0000000007670000-0x0000000007776000-memory.dmpFilesize
1.0MB
-
memory/1460-63-0x0000000000C70000-0x0000000000C88000-memory.dmpFilesize
96KB
-
memory/1460-64-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1460-65-0x0000000002090000-0x0000000002393000-memory.dmpFilesize
3.0MB
-
memory/1460-66-0x0000000000560000-0x0000000000B01000-memory.dmpFilesize
5.6MB