Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
08-08-2022 08:53
Static task
static1
Behavioral task
behavioral1
Sample
purchase order.scr
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
purchase order.scr
Resource
win10v2004-20220721-en
General
-
Target
purchase order.scr
-
Size
715KB
-
MD5
78c4f66f2cc6141bb625193b77cbb50a
-
SHA1
b9bf9128275a92cc3e7f0fddc65de08adf64149b
-
SHA256
e233d86e74d3846be66e323c4850b495c66658ca63cd28ec1a47a3b0c95f7559
-
SHA512
b4ea89531126555b6c421c6140fb9bb2f9b5d70721e2ddf172d33f8584526ef21c4960fdf20108ff445afb60fc44223c968697248a1b7cdfb9916296c8243554
Malware Config
Extracted
formbook
4.1
p94a
oootmuim.top
ricondizionato.info
eatarriveoh.top
tuo.wtf
plottaacuse.xyz
maripazcovarrubias.com
pasolaity.sbs
schoolstool.store
davincimuch.net
yh-fl.com
merielchapman.co.uk
omsecuritysolution.com
jqhuafei.com
fypa.site
isdgolf.com
aromasoils.com
dcmaxween.xyz
keilewn.online
billiger-atomstrom.com
chickens93.online
trumpvp.net
interchangecom.net
721499.com
weijiafs.com
southbridgepress.online
vreegrapher.site
jordanbrinkmann.com
timechainoracle.com
cailang.net
baiyipiaopiao.com
armannetvip.xyz
wanghaojie.top
oemgecrattels.space
tombraidercasino.xyz
wcpdpt7.com
theblackpearlrestaurant.com
animallofi.com
aednj7btmz.xyz
mvno.life
2c7m1r9t5z.xyz
lewis-stringer.co.uk
vdobo.com
100w.xyz
thebryant.site
cgaoxing.com
zlapoddech.com
hnstzkj.com
bahishub.com
htq7.top
dealerships.space
ratok.info
acecanoes.uk
sazgifts.com
crnamagijapomoc.com
hairnod.com
dealoffer4u.com
hybfj.com
artisanwelshfood.cymru
daru.pro
qrous.net
8qm.net
lphbl.com
ricotaspizza.com
lifttv.site
brightmonkeymedia.com
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2360-146-0x0000000003840000-0x000000000386F000-memory.dmp formbook -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
purchase order.scrdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lykjvfajy = "C:\\Users\\Public\\Libraries\\yjafvjkyL.url" purchase order.scr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1236 2360 WerFault.exe purchase order.scr
Processes
-
C:\Users\Admin\AppData\Local\Temp\purchase order.scr"C:\Users\Admin\AppData\Local\Temp\purchase order.scr" /S1⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 19242⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2360 -ip 23601⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2360-146-0x0000000003840000-0x000000000386F000-memory.dmpFilesize
188KB