Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:15
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order 564537737 May.exe
Resource
win7-20220414-en
General
-
Target
Purchase Order 564537737 May.exe
-
Size
411KB
-
MD5
bf15960dd7174427df765fd9f9203521
-
SHA1
cb1de1df0c3b1a1cc70a28629ac51d67901b17aa
-
SHA256
9187706072f008a27c26421791f57ec33a59b44b012500b2db3eeb48136fb2da
-
SHA512
7e8b9907233234440135f27ad813db97e20790baf8cb92949ae9185fa09cb4b7b0da35b6da2b33f3ac64a33545f32f959d90d73f7a6a4f14988c8ac3fd005074
Malware Config
Extracted
formbook
4.1
i0qi
mytakeawaybox.com
goutaihuo.com
kuzey.site
uppertenpiercings.amsterdam
honeygrandpa.com
jenniferabramslaw.com
ncarian.com
heavilymeditatedhouston.com
gsbjyzx.com
akisanblog.com
taoyuanreed.com
jasperrvservices.com
yabbanet.com
myhealthfuldiet.com
flipdigitalcoins.com
toes.photos
shoottillyoumiss.com
maserental.com
smarteacher.net
hamdimagdeco.com
wuxifanggang.com
alamediationtraining.com
vfoe.team
kms-sp.com
gfidevfight.net
anomadbackpacker.com
21oms.us
australianseniorpreneur.com
valuereceipt.com
superbetbahis.com
rsrgoup.com
hoidonghuongkimson.com
parmedpharma.com
discoveryoverload.com
livetv247.win
jepekha.com
6o5ttvst.biz
netcorrespondents.com
cscycorp.com
emonkeygraphics.com
tillyaeva-lola.news
dgx9.com
jiucai5.com
justwoodsouthern.com
dentalexpertstraining.com
amazoncarpet.com
xsxnet.net
androidaso.com
jinhucai.com
wellnessitaly.store
clashrayalefreebies.com
wxvbill.com
quantun.network
allnaturalcbdshampton.com
mobo.technology
livinglifeawakened.com
canliarkadas.net
littlealohadaycare.com
wendyoei.com
kaz.site
puremind.info
queenscrossingneurosurgery.com
theworldexams.com
taptrips.com
joomlas123.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/5012-133-0x0000000005980000-0x00000000059AD000-memory.dmp formbook behavioral2/memory/4924-140-0x0000000000350000-0x000000000037D000-memory.dmp formbook -
Adds policy Run key to start application 2 TTPs 1 IoCs
Processes:
msdt.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msdt.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Purchase Order 564537737 May.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 Purchase Order 564537737 May.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Purchase Order 564537737 May.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Purchase Order 564537737 May.exemsdt.exedescription pid process target process PID 5012 set thread context of 2832 5012 Purchase Order 564537737 May.exe Explorer.EXE PID 4924 set thread context of 2832 4924 msdt.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
msdt.exedescription ioc process File opened for modification C:\Program Files (x86)\Yttoxjlm\audiodghrqx.exe msdt.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
Purchase Order 564537737 May.exemsdt.exepid process 5012 Purchase Order 564537737 May.exe 5012 Purchase Order 564537737 May.exe 5012 Purchase Order 564537737 May.exe 5012 Purchase Order 564537737 May.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe 4924 msdt.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2832 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Purchase Order 564537737 May.exemsdt.exepid process 5012 Purchase Order 564537737 May.exe 5012 Purchase Order 564537737 May.exe 5012 Purchase Order 564537737 May.exe 4924 msdt.exe 4924 msdt.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Purchase Order 564537737 May.exemsdt.exedescription pid process Token: SeDebugPrivilege 5012 Purchase Order 564537737 May.exe Token: SeDebugPrivilege 4924 msdt.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Explorer.EXEmsdt.exedescription pid process target process PID 2832 wrote to memory of 4924 2832 Explorer.EXE msdt.exe PID 2832 wrote to memory of 4924 2832 Explorer.EXE msdt.exe PID 2832 wrote to memory of 4924 2832 Explorer.EXE msdt.exe PID 4924 wrote to memory of 5096 4924 msdt.exe cmd.exe PID 4924 wrote to memory of 5096 4924 msdt.exe cmd.exe PID 4924 wrote to memory of 5096 4924 msdt.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order 564537737 May.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order 564537737 May.exe"2⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order 564537737 May.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2832-136-0x0000000008790000-0x00000000088C6000-memory.dmpFilesize
1.2MB
-
memory/2832-143-0x0000000008A60000-0x0000000008BA5000-memory.dmpFilesize
1.3MB
-
memory/4924-139-0x0000000002710000-0x0000000002A5A000-memory.dmpFilesize
3.3MB
-
memory/4924-137-0x0000000000000000-mapping.dmp
-
memory/4924-138-0x0000000000DA0000-0x0000000000DF7000-memory.dmpFilesize
348KB
-
memory/4924-140-0x0000000000350000-0x000000000037D000-memory.dmpFilesize
180KB
-
memory/4924-142-0x0000000002450000-0x00000000024E3000-memory.dmpFilesize
588KB
-
memory/5012-133-0x0000000005980000-0x00000000059AD000-memory.dmpFilesize
180KB
-
memory/5012-134-0x00000000064A0000-0x00000000067EA000-memory.dmpFilesize
3.3MB
-
memory/5012-135-0x0000000005940000-0x0000000005EE4000-memory.dmpFilesize
5.6MB
-
memory/5012-132-0x0000000005940000-0x0000000005EE4000-memory.dmpFilesize
5.6MB
-
memory/5012-130-0x0000000000D90000-0x0000000000DFE000-memory.dmpFilesize
440KB
-
memory/5012-131-0x0000000005EF0000-0x0000000006494000-memory.dmpFilesize
5.6MB
-
memory/5096-141-0x0000000000000000-mapping.dmp