Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-08-2022 07:52
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order 30 August 2022-02414291423394140374553.exe
Resource
win7-20220812-en
General
-
Target
Purchase Order 30 August 2022-02414291423394140374553.exe
-
Size
89KB
-
MD5
0c3e17513995f23e55698258b1182ff8
-
SHA1
102f3d910b9b5718d32cb53c742321fdbe1f3cf8
-
SHA256
54fae569dce7e163b82278e3353f28978511f3af6ef2f444ee5b2034a88af61e
-
SHA512
e17a9fbb516248fc44ba6dd3175130151764f6c41b9333037485ed1ddc6941d0a7d86d67efe5a2f7d4c399833ba985e8af49f0a5a8c9cc9fb4446cd9ae47562e
-
SSDEEP
768:M5Q7BWvdus8AS2ymNBqPrDhKD+sHmIBPu/5FXa7IkZsdmR/9UfaJAMnHSiU/2C7B:cxBMPtr/d0zRpSZ5adaht
Malware Config
Extracted
formbook
4.1
ba17
zoltaron.tech
exopets.online
trippingtravel.com
banded.top
shinebrightdesigns.co.uk
djlbb.com
abcsofmindfulness.com
linkaktifasialive88.club
185068.sbs
tjhongguo.com
portaldigi.store
theshoe.club
r-ceive.app
kmwww.top
search-publishing.com
banksmanlights.net
flyonthewallmovie.com
congrulations.website
trnt.store
udajabojka.xyz
bet365p6.com
purecleannyc.com
tripod.app
chesmol.xyz
gestuethollerbusch.com
longhuipet.com
noktasutesisati.com
voucherkita.xyz
paca-uk.co.uk
denizonlinekontrol.com
suresthuerta.xyz
trendingproduct.co.uk
mvkstore.com
taoseav33.top
estudiooteroyasociados.store
gandlautosalesinc.com
32ee62dd0110.info
hmrazk.website
qzbpckdo.com
solman.store
slavlavka.site
elemansepetim.xyz
btr.ltd
bjyfzssj.com
yildizanpresskomuru.com
careebroutique.com
artsirchen.com
286412.com
tradingpostatprieslake.com
aisccenter.net
tensenfarms.site
troublecolor.online
paring-deification.net
rhy6.com
zgjys888web.xyz
allhallowsluxe.com
stefanierinza.com
needy-me.online
0755aite.net
cbfashion.uk
sunrisequilts.com
rswll.com
khanaphongmamam123.xyz
nsdclub.com
pricehistory.website
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2508-140-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2508-142-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/5104-148-0x0000000000840000-0x000000000086F000-memory.dmp formbook behavioral2/memory/5104-153-0x0000000000840000-0x000000000086F000-memory.dmp formbook -
Drops startup file 2 IoCs
Processes:
Purchase Order 30 August 2022-02414291423394140374553.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order 30 August 2022-02414291423394140374553.exe Purchase Order 30 August 2022-02414291423394140374553.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order 30 August 2022-02414291423394140374553.exe Purchase Order 30 August 2022-02414291423394140374553.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Purchase Order 30 August 2022-02414291423394140374553.exePurchase Order 30 August 2022-02414291423394140374553.exeraserver.exedescription pid process target process PID 3172 set thread context of 2508 3172 Purchase Order 30 August 2022-02414291423394140374553.exe Purchase Order 30 August 2022-02414291423394140374553.exe PID 2508 set thread context of 3000 2508 Purchase Order 30 August 2022-02414291423394140374553.exe Explorer.EXE PID 5104 set thread context of 3000 5104 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Purchase Order 30 August 2022-02414291423394140374553.exePurchase Order 30 August 2022-02414291423394140374553.exeraserver.exepid process 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 3172 Purchase Order 30 August 2022-02414291423394140374553.exe 2508 Purchase Order 30 August 2022-02414291423394140374553.exe 2508 Purchase Order 30 August 2022-02414291423394140374553.exe 2508 Purchase Order 30 August 2022-02414291423394140374553.exe 2508 Purchase Order 30 August 2022-02414291423394140374553.exe 5104 raserver.exe 5104 raserver.exe 5104 raserver.exe 5104 raserver.exe 5104 raserver.exe 5104 raserver.exe 5104 raserver.exe 5104 raserver.exe 5104 raserver.exe 5104 raserver.exe 5104 raserver.exe 5104 raserver.exe 5104 raserver.exe 5104 raserver.exe 5104 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3000 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Purchase Order 30 August 2022-02414291423394140374553.exeraserver.exepid process 2508 Purchase Order 30 August 2022-02414291423394140374553.exe 2508 Purchase Order 30 August 2022-02414291423394140374553.exe 2508 Purchase Order 30 August 2022-02414291423394140374553.exe 5104 raserver.exe 5104 raserver.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Purchase Order 30 August 2022-02414291423394140374553.exePurchase Order 30 August 2022-02414291423394140374553.exeraserver.exedescription pid process Token: SeDebugPrivilege 3172 Purchase Order 30 August 2022-02414291423394140374553.exe Token: SeDebugPrivilege 2508 Purchase Order 30 August 2022-02414291423394140374553.exe Token: SeDebugPrivilege 5104 raserver.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Purchase Order 30 August 2022-02414291423394140374553.exeExplorer.EXEraserver.exedescription pid process target process PID 3172 wrote to memory of 2508 3172 Purchase Order 30 August 2022-02414291423394140374553.exe Purchase Order 30 August 2022-02414291423394140374553.exe PID 3172 wrote to memory of 2508 3172 Purchase Order 30 August 2022-02414291423394140374553.exe Purchase Order 30 August 2022-02414291423394140374553.exe PID 3172 wrote to memory of 2508 3172 Purchase Order 30 August 2022-02414291423394140374553.exe Purchase Order 30 August 2022-02414291423394140374553.exe PID 3172 wrote to memory of 2508 3172 Purchase Order 30 August 2022-02414291423394140374553.exe Purchase Order 30 August 2022-02414291423394140374553.exe PID 3172 wrote to memory of 2508 3172 Purchase Order 30 August 2022-02414291423394140374553.exe Purchase Order 30 August 2022-02414291423394140374553.exe PID 3172 wrote to memory of 2508 3172 Purchase Order 30 August 2022-02414291423394140374553.exe Purchase Order 30 August 2022-02414291423394140374553.exe PID 3000 wrote to memory of 5104 3000 Explorer.EXE raserver.exe PID 3000 wrote to memory of 5104 3000 Explorer.EXE raserver.exe PID 3000 wrote to memory of 5104 3000 Explorer.EXE raserver.exe PID 5104 wrote to memory of 3128 5104 raserver.exe cmd.exe PID 5104 wrote to memory of 3128 5104 raserver.exe cmd.exe PID 5104 wrote to memory of 3128 5104 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order 30 August 2022-02414291423394140374553.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order 30 August 2022-02414291423394140374553.exe"2⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order 30 August 2022-02414291423394140374553.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order 30 August 2022-02414291423394140374553.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order 30 August 2022-02414291423394140374553.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2508-142-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2508-144-0x0000000000FD0000-0x0000000000FE4000-memory.dmpFilesize
80KB
-
memory/2508-143-0x0000000001480000-0x00000000017CA000-memory.dmpFilesize
3.3MB
-
memory/2508-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2508-139-0x0000000000000000-mapping.dmp
-
memory/3000-154-0x0000000008060000-0x0000000008132000-memory.dmpFilesize
840KB
-
memory/3000-152-0x0000000008060000-0x0000000008132000-memory.dmpFilesize
840KB
-
memory/3000-145-0x0000000007B00000-0x0000000007C6A000-memory.dmpFilesize
1.4MB
-
memory/3128-149-0x0000000000000000-mapping.dmp
-
memory/3172-137-0x0000000006FE0000-0x000000000707C000-memory.dmpFilesize
624KB
-
memory/3172-138-0x0000000007080000-0x00000000070E6000-memory.dmpFilesize
408KB
-
memory/3172-132-0x0000000000EE0000-0x0000000000EFC000-memory.dmpFilesize
112KB
-
memory/3172-136-0x0000000006DC0000-0x0000000006DDE000-memory.dmpFilesize
120KB
-
memory/3172-135-0x00000000059A0000-0x0000000005A16000-memory.dmpFilesize
472KB
-
memory/3172-134-0x00000000058B0000-0x0000000005942000-memory.dmpFilesize
584KB
-
memory/3172-133-0x0000000005F50000-0x00000000064F4000-memory.dmpFilesize
5.6MB
-
memory/5104-146-0x0000000000000000-mapping.dmp
-
memory/5104-148-0x0000000000840000-0x000000000086F000-memory.dmpFilesize
188KB
-
memory/5104-147-0x0000000000030000-0x000000000004F000-memory.dmpFilesize
124KB
-
memory/5104-150-0x0000000002770000-0x0000000002ABA000-memory.dmpFilesize
3.3MB
-
memory/5104-151-0x00000000025B0000-0x0000000002643000-memory.dmpFilesize
588KB
-
memory/5104-153-0x0000000000840000-0x000000000086F000-memory.dmpFilesize
188KB