Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
11-07-2022 08:57
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.exe
Resource
win7-20220414-en
General
-
Target
Purchase Order.exe
-
Size
918KB
-
MD5
dfb77ce7f7b49f520241aa2a747d9203
-
SHA1
304dd96dad67b02214ebd10198baacfb7428a08a
-
SHA256
3b2aed15298aa9110cc90c069742839fdc9ddb24f91a8269284a504a5ba1fb9c
-
SHA512
57fd6052c133843cc4e4d7878eed74a8eeb466da8923e62995aceb84788573c9088d48303d79cf36839751c5307ef2d00a8ec99d40ea9e5108f047be32d6563a
Malware Config
Extracted
formbook
4.1
ja38
check-info-asked.com
d1g1tal-loops.com
jouw-server.online
xn--9l4b93h4ub.com
jju21.com
johndivine.com
boardinghouses.net
evergreeneq.com
lovemya.xyz
szovegmuhely.com
worldwidedatazehn.net
hollandmulchus.com
mhcbrokers.com
brainwellnesssolutions.com
creatioconsultants.com
troyleedesign.store
hayebenefits.com
atom-ontherox.com
pacificoakllc.com
nailonika.online
tixdyweb.com
boostmedia.agency
cutiemind.com
fbcpear.land
nbaonlineus.com
libretypumps.com
americangaslighter.com
blountfirm.online
titansfitnessapparel.net
ofertascapital.com
baikhati777.xyz
yeslom.xyz
classicscase.com
canineconquest.com
nationallrentacar.com
shiyoushuzhi.com
app-youhodler.site
parkwhiteplainss.com
moldshirt.net
roadsideassistanceillinois.info
turkiyedenalmanyayanakliyat.com
kingoflogisticsgh.info
ywwpjqd.com
printthisstudios.com
appackle.com
dharvest24.biz
terrariaserverhosting.com
778189.com
securitycamera-at-2022.life
dx-ss.com
edtechcreativity.com
eleganse-home.online
theknightstemplar.global
abna.international
1ggn.com
abeylele.com
acoinmintexpert.com
prerising.com
dozivljajskigozdpohorje.com
tongkhodentrangtri.com
fromvalleytosummit.com
kasirselasarbrbd.com
englishzones.com
trading-cracks.com
couches-sofas-98268.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3680-137-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3680-139-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3436-146-0x00000000004D0000-0x00000000004FF000-memory.dmp formbook behavioral2/memory/3436-148-0x00000000004D0000-0x00000000004FF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Purchase Order.exePurchase Order.exeWWAHost.exedescription pid process target process PID 4100 set thread context of 3680 4100 Purchase Order.exe Purchase Order.exe PID 3680 set thread context of 1060 3680 Purchase Order.exe Explorer.EXE PID 3436 set thread context of 1060 3436 WWAHost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
Purchase Order.exeWWAHost.exepid process 3680 Purchase Order.exe 3680 Purchase Order.exe 3680 Purchase Order.exe 3680 Purchase Order.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe 3436 WWAHost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1060 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Purchase Order.exeWWAHost.exepid process 3680 Purchase Order.exe 3680 Purchase Order.exe 3680 Purchase Order.exe 3436 WWAHost.exe 3436 WWAHost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Purchase Order.exeWWAHost.exedescription pid process Token: SeDebugPrivilege 3680 Purchase Order.exe Token: SeDebugPrivilege 3436 WWAHost.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Purchase Order.exeExplorer.EXEWWAHost.exedescription pid process target process PID 4100 wrote to memory of 3680 4100 Purchase Order.exe Purchase Order.exe PID 4100 wrote to memory of 3680 4100 Purchase Order.exe Purchase Order.exe PID 4100 wrote to memory of 3680 4100 Purchase Order.exe Purchase Order.exe PID 4100 wrote to memory of 3680 4100 Purchase Order.exe Purchase Order.exe PID 4100 wrote to memory of 3680 4100 Purchase Order.exe Purchase Order.exe PID 4100 wrote to memory of 3680 4100 Purchase Order.exe Purchase Order.exe PID 1060 wrote to memory of 3436 1060 Explorer.EXE WWAHost.exe PID 1060 wrote to memory of 3436 1060 Explorer.EXE WWAHost.exe PID 1060 wrote to memory of 3436 1060 Explorer.EXE WWAHost.exe PID 3436 wrote to memory of 3456 3436 WWAHost.exe cmd.exe PID 3436 wrote to memory of 3456 3436 WWAHost.exe cmd.exe PID 3436 wrote to memory of 3456 3436 WWAHost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1060-142-0x0000000002C50000-0x0000000002D9C000-memory.dmpFilesize
1.3MB
-
memory/1060-151-0x00000000082E0000-0x0000000008457000-memory.dmpFilesize
1.5MB
-
memory/1060-150-0x00000000082E0000-0x0000000008457000-memory.dmpFilesize
1.5MB
-
memory/3436-149-0x0000000001400000-0x0000000001494000-memory.dmpFilesize
592KB
-
memory/3436-148-0x00000000004D0000-0x00000000004FF000-memory.dmpFilesize
188KB
-
memory/3436-146-0x00000000004D0000-0x00000000004FF000-memory.dmpFilesize
188KB
-
memory/3436-147-0x00000000015D0000-0x000000000191A000-memory.dmpFilesize
3.3MB
-
memory/3436-145-0x0000000000530000-0x000000000060C000-memory.dmpFilesize
880KB
-
memory/3436-143-0x0000000000000000-mapping.dmp
-
memory/3456-144-0x0000000000000000-mapping.dmp
-
memory/3680-141-0x00000000012D0000-0x00000000012E5000-memory.dmpFilesize
84KB
-
memory/3680-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3680-140-0x00000000017F0000-0x0000000001B3A000-memory.dmpFilesize
3.3MB
-
memory/3680-137-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3680-136-0x0000000000000000-mapping.dmp
-
memory/4100-130-0x00000000006B0000-0x000000000079A000-memory.dmpFilesize
936KB
-
memory/4100-135-0x0000000007BD0000-0x0000000007C36000-memory.dmpFilesize
408KB
-
memory/4100-134-0x00000000071E0000-0x000000000727C000-memory.dmpFilesize
624KB
-
memory/4100-133-0x0000000005150000-0x000000000515A000-memory.dmpFilesize
40KB
-
memory/4100-132-0x0000000005180000-0x0000000005212000-memory.dmpFilesize
584KB
-
memory/4100-131-0x0000000005690000-0x0000000005C34000-memory.dmpFilesize
5.6MB