Analysis
-
max time kernel
145s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:09
Static task
static1
Behavioral task
behavioral1
Sample
RFQ and Purchase Order 060920A..exe
Resource
win7-20220414-en
General
-
Target
RFQ and Purchase Order 060920A..exe
-
Size
378KB
-
MD5
7f97fe13229e97475a0454942646a562
-
SHA1
d0c150fc54a75e97a1bd54833a826b6bc294c177
-
SHA256
b84f164b86250eaee07153f4665af8826f0e934ba80e505ae37ead324f53b971
-
SHA512
870912c5988a4547720393518b3721386bc60724d70bbfc2445ca098475171f332c4b092993d6bea980bd76c2d22bae6b5501555736278469b0936e94ed442b3
Malware Config
Extracted
formbook
4.1
wrez
living-teu.com
buyemerilairfryer360.com
locagames.com
seaworldeg.com
dokushostation.com
nethange.com
lendreview.com
officerdownapparel.info
pandora.store
yuanchuang.kim
kevinimage.win
littleinkings.com
ggluav61.com
fsylkzfkm.download
skansch.reisen
yahunjuij.com
enming.top
wwwha55188.com
russischesvisazentrum.info
document7.com
websiteresources.online
glowwithtabi.com
strongbodyforce.com
viareggiofiori.com
cashmein.net
shopmemorie.com
watchmoviesforfree.click
appsecurityz.com
betwin5888.com
anacakes.net
noberascofruitcrock.com
getchefmate.com
burritobucket.com
www870234.com
thekalpatruradance.com
jypxjgpt.com
maya18.com
yinghuangsiwang.com
huarunzhifu.com
eatmygarden.com
monitoringservice.media
tokamak.systems
oldtestamentbiblestudy.com
dailypath.net
canttouchdis.com
dl0722lq.biz
napplyless.com
masa-yoga.net
entorto.com
becgetsfit.com
entrepreneurgear.net
freetrafficupdatingall.download
transdiesellubrificantes.com
progettando.net
manbet844.com
flowersfoodandfootsteps.com
swc.ink
esta-service.com
atakoymarinaparkresidence99.com
dtechexperts.com
trivialmindofamadwoman.com
iorequeste.com
bumeruwo68.win
peoplespiritcountry.com
regulars6.info
Signatures
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2004-59-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/2004-60-0x000000000041E360-mapping.dmp formbook behavioral1/memory/2004-62-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/1084-73-0x0000000000080000-0x00000000000AD000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1216 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
RFQ and Purchase Order 060920A..exeRFQ and Purchase Order 060920A..execolorcpl.exedescription pid process target process PID 388 set thread context of 2004 388 RFQ and Purchase Order 060920A..exe RFQ and Purchase Order 060920A..exe PID 2004 set thread context of 1272 2004 RFQ and Purchase Order 060920A..exe Explorer.EXE PID 2004 set thread context of 1272 2004 RFQ and Purchase Order 060920A..exe Explorer.EXE PID 1084 set thread context of 1272 1084 colorcpl.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
RFQ and Purchase Order 060920A..execolorcpl.exepid process 2004 RFQ and Purchase Order 060920A..exe 2004 RFQ and Purchase Order 060920A..exe 2004 RFQ and Purchase Order 060920A..exe 1084 colorcpl.exe 1084 colorcpl.exe 1084 colorcpl.exe 1084 colorcpl.exe 1084 colorcpl.exe 1084 colorcpl.exe 1084 colorcpl.exe 1084 colorcpl.exe 1084 colorcpl.exe 1084 colorcpl.exe 1084 colorcpl.exe 1084 colorcpl.exe 1084 colorcpl.exe 1084 colorcpl.exe 1084 colorcpl.exe 1084 colorcpl.exe 1084 colorcpl.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RFQ and Purchase Order 060920A..execolorcpl.exepid process 2004 RFQ and Purchase Order 060920A..exe 2004 RFQ and Purchase Order 060920A..exe 2004 RFQ and Purchase Order 060920A..exe 2004 RFQ and Purchase Order 060920A..exe 1084 colorcpl.exe 1084 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RFQ and Purchase Order 060920A..execolorcpl.exedescription pid process Token: SeDebugPrivilege 2004 RFQ and Purchase Order 060920A..exe Token: SeDebugPrivilege 1084 colorcpl.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
RFQ and Purchase Order 060920A..exeRFQ and Purchase Order 060920A..execolorcpl.exedescription pid process target process PID 388 wrote to memory of 2004 388 RFQ and Purchase Order 060920A..exe RFQ and Purchase Order 060920A..exe PID 388 wrote to memory of 2004 388 RFQ and Purchase Order 060920A..exe RFQ and Purchase Order 060920A..exe PID 388 wrote to memory of 2004 388 RFQ and Purchase Order 060920A..exe RFQ and Purchase Order 060920A..exe PID 388 wrote to memory of 2004 388 RFQ and Purchase Order 060920A..exe RFQ and Purchase Order 060920A..exe PID 388 wrote to memory of 2004 388 RFQ and Purchase Order 060920A..exe RFQ and Purchase Order 060920A..exe PID 388 wrote to memory of 2004 388 RFQ and Purchase Order 060920A..exe RFQ and Purchase Order 060920A..exe PID 388 wrote to memory of 2004 388 RFQ and Purchase Order 060920A..exe RFQ and Purchase Order 060920A..exe PID 2004 wrote to memory of 1084 2004 RFQ and Purchase Order 060920A..exe colorcpl.exe PID 2004 wrote to memory of 1084 2004 RFQ and Purchase Order 060920A..exe colorcpl.exe PID 2004 wrote to memory of 1084 2004 RFQ and Purchase Order 060920A..exe colorcpl.exe PID 2004 wrote to memory of 1084 2004 RFQ and Purchase Order 060920A..exe colorcpl.exe PID 1084 wrote to memory of 1216 1084 colorcpl.exe cmd.exe PID 1084 wrote to memory of 1216 1084 colorcpl.exe cmd.exe PID 1084 wrote to memory of 1216 1084 colorcpl.exe cmd.exe PID 1084 wrote to memory of 1216 1084 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\RFQ and Purchase Order 060920A..exe"C:\Users\Admin\AppData\Local\Temp\RFQ and Purchase Order 060920A..exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ and Purchase Order 060920A..exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"4⤵
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ and Purchase Order 060920A..exe"5⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/388-55-0x0000000074F70000-0x000000007551B000-memory.dmpFilesize
5.7MB
-
memory/388-54-0x0000000076C81000-0x0000000076C83000-memory.dmpFilesize
8KB
-
memory/1084-75-0x0000000001DB0000-0x0000000001E43000-memory.dmpFilesize
588KB
-
memory/1084-74-0x0000000002030000-0x0000000002333000-memory.dmpFilesize
3.0MB
-
memory/1084-73-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1084-72-0x00000000002C0000-0x00000000002D8000-memory.dmpFilesize
96KB
-
memory/1084-69-0x0000000000000000-mapping.dmp
-
memory/1216-71-0x0000000000000000-mapping.dmp
-
memory/1272-68-0x0000000007520000-0x0000000007631000-memory.dmpFilesize
1.1MB
-
memory/1272-76-0x0000000004C50000-0x0000000004D3E000-memory.dmpFilesize
952KB
-
memory/1272-65-0x0000000007150000-0x0000000007281000-memory.dmpFilesize
1.2MB
-
memory/2004-59-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2004-67-0x00000000003C0000-0x00000000003D4000-memory.dmpFilesize
80KB
-
memory/2004-64-0x0000000000380000-0x0000000000394000-memory.dmpFilesize
80KB
-
memory/2004-63-0x0000000000810000-0x0000000000B13000-memory.dmpFilesize
3.0MB
-
memory/2004-62-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2004-60-0x000000000041E360-mapping.dmp
-
memory/2004-57-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2004-56-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB