Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 07:00
Behavioral task
behavioral1
Sample
Order Specification-887762.exe
Resource
win7-20220812-en
General
-
Target
Order Specification-887762.exe
-
Size
742KB
-
MD5
03c2f941af8cede493cd177fbe9cea96
-
SHA1
f811f24a5bb048e5aaec2e7456bb6597c2408359
-
SHA256
10df8c533f48189e56d16dd5d04d838f592cfe8d6c1690fe29454ec308c6e12b
-
SHA512
2a71ef2dd5bfdad6a167a9b1c735e256cd6775614fe672e3e18a858fad87542b6c136383d5aff0d95739a496fb94d9b0ccf70cfa4903d8b5e81550628fe53b0c
-
SSDEEP
12288:1Ov5jKhsfoPA+yeVKUCUxP4C902bdRtJJPi+FqA/vJ1saEauZDa+:1q5TfcdHj4fmbv9VEzNr
Malware Config
Extracted
formbook
qghw
xChQ23PgpSUcmpWLjuMuslhaM2JdOQ==
CW+fAqYA5jJmTUxKVCQtWo1M
2u+t6sYq3/El6wWQxrs=
X3CmNeyJR1gJ5UMD3zpr5ohLoprqKQ==
ig3FIEYxGixd
MLrqHMXkW6KgchF/zKw=
bFYIVkZg4yrqh1hU
W7nhL9Qzxgt3I14NUA==
RKzPUex3O7zImhsRl7sCLNE=
88SwOgQ5uheBI14NUA==
WTPEFO8WoVpu1hF/zKw=
l+D4dxIxsP9svRvT3XJ6rg==
ChLG86LRTZ8FuJpTi+TvYUs8ag==
TiG7RPiVV19GVEhJ
tReJEdUq4Oycdve2e1i6qw==
NJTJ54zHSaCiq8HXRw==
+H696YbukBW/km8p8coWYUs8ag==
rcDAPOhzanyGY753Op/aSnDvRuDL
GgbAVAacXGBGVEhJ
BtZzBcIBhp7mujAcm7sCLNE=
CXaw0WjQVphpWqhbLrsCLNE=
8aaAqcvoJxlXKJI=
sKBRoWh9AEwTI14NUA==
kULZTDIxGixd
hO9f4q9USZTOS7rBTpKu7REN+zgxIQ==
yiaeFawqF1hGVEhJ
02SW5qkn+IYQy7BzQQ/aS3nvRuDL
9VLRIUYxGixd
6fAgrTKJHmU/ppJYqvw6
hpiYwj9WxyS+lIh7is5UBPyyKm4=
3VlvvX4A+UKNc11PUyYtWo1M
/+JXlEvGvnmdsdSNS6Q=
SqSj76ipMqq7dzLhXwI8
7VbOUA8/sgwOcWYYZT7J7FhWD2Q=
sIJ3FtpJ+g7PnwDuitnSAipxCjKVHJ35eg==
ieT8kVSXIGPLQ6ZqIoHORG3vRuDL
Wazl3HSmFxUkII8=
7NSBnCiXVN3lnxcTlLsCLNE=
zGFEdx9kNIkNbNOOiiPhHXRGfQ==
IQe32nf96zyg8E1O3jsD6BAG+zgxIQ==
RPuViotPJRlXKJI=
3ECNeBZsPVK5IA==
6lJzlkl+Allwknt6iF0y
1KpKoE+YO1QTI14NUA==
qiZOiD7FiKN91BF/zKw=
LJaS36gl3fQ0Bv+scchPDDD1Mv/kHJ35eg==
IH55wIAC+TlnRh3V3XJ6rg==
FSrlFtol3GTYJo1EIvbqYUs8ag==
bNgIkTpY1Cb6zycaXYWsuQ==
t6ROkE+7bIpOLItFmbsCLNE=
RchAbAxnIpz11rt+xBxZVnZ+B2Y=
8tCK9pXtzBXPsyomaYADLdM=
W0A3vIjESKV8QqGN3XJ6rg==
rEFrqHluIrJR
N6PUVxRCwRY6805e
dWkRVRWgaOLnpSSYFQYt
ppI/ahKspeCba8y3OR9yrJnA+zgxIQ==
YOimDq8IrrRYKZxhGYHORG3vRuDL
rBKJEMxeUZxzwZJYqvw6
l+4Gcfh2SMAU3NKJT7MtWo1M
Q1d5A9ACe8qGXLl7QZzbSH7oeOyUMw8h
AIYFR/RNECNBLJZLnbsCLNE=
L6sfaClAuwQs1EsEUg==
rwj/SQkxGixd
heartofoslo.com
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1648-132-0x0000000000440000-0x00000000005E4000-memory.dmp upx behavioral2/memory/1648-134-0x0000000000440000-0x00000000005E4000-memory.dmp upx behavioral2/memory/3480-135-0x0000000000440000-0x00000000005E4000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Order Specification-887762.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation Order Specification-887762.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/1648-132-0x0000000000440000-0x00000000005E4000-memory.dmp autoit_exe behavioral2/memory/1648-134-0x0000000000440000-0x00000000005E4000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Order Specification-887762.exeOrder Specification-887762.exerundll32.exedescription pid process target process PID 1648 set thread context of 3480 1648 Order Specification-887762.exe Order Specification-887762.exe PID 3480 set thread context of 2616 3480 Order Specification-887762.exe Explorer.EXE PID 4828 set thread context of 2616 4828 rundll32.exe Explorer.EXE -
Processes:
rundll32.exedescription ioc process Key created \Registry\User\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
Processes:
Order Specification-887762.exerundll32.exepid process 3480 Order Specification-887762.exe 3480 Order Specification-887762.exe 3480 Order Specification-887762.exe 3480 Order Specification-887762.exe 3480 Order Specification-887762.exe 3480 Order Specification-887762.exe 3480 Order Specification-887762.exe 3480 Order Specification-887762.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2616 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Order Specification-887762.exerundll32.exepid process 3480 Order Specification-887762.exe 3480 Order Specification-887762.exe 3480 Order Specification-887762.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe 4828 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Order Specification-887762.exerundll32.exedescription pid process Token: SeDebugPrivilege 3480 Order Specification-887762.exe Token: SeDebugPrivilege 4828 rundll32.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Order Specification-887762.exeExplorer.EXErundll32.exedescription pid process target process PID 1648 wrote to memory of 3480 1648 Order Specification-887762.exe Order Specification-887762.exe PID 1648 wrote to memory of 3480 1648 Order Specification-887762.exe Order Specification-887762.exe PID 1648 wrote to memory of 3480 1648 Order Specification-887762.exe Order Specification-887762.exe PID 1648 wrote to memory of 3480 1648 Order Specification-887762.exe Order Specification-887762.exe PID 2616 wrote to memory of 4828 2616 Explorer.EXE rundll32.exe PID 2616 wrote to memory of 4828 2616 Explorer.EXE rundll32.exe PID 2616 wrote to memory of 4828 2616 Explorer.EXE rundll32.exe PID 4828 wrote to memory of 4188 4828 rundll32.exe Firefox.exe PID 4828 wrote to memory of 4188 4828 rundll32.exe Firefox.exe PID 4828 wrote to memory of 4188 4828 rundll32.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order Specification-887762.exe"C:\Users\Admin\AppData\Local\Temp\Order Specification-887762.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order Specification-887762.exe"C:\Users\Admin\AppData\Local\Temp\Order Specification-887762.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1648-134-0x0000000000440000-0x00000000005E4000-memory.dmpFilesize
1.6MB
-
memory/1648-132-0x0000000000440000-0x00000000005E4000-memory.dmpFilesize
1.6MB
-
memory/2616-140-0x0000000008CA0000-0x0000000008E44000-memory.dmpFilesize
1.6MB
-
memory/2616-149-0x0000000007C00000-0x0000000007D0A000-memory.dmpFilesize
1.0MB
-
memory/2616-148-0x0000000007C00000-0x0000000007D0A000-memory.dmpFilesize
1.0MB
-
memory/3480-136-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3480-138-0x0000000001820000-0x0000000001B6A000-memory.dmpFilesize
3.3MB
-
memory/3480-139-0x0000000001330000-0x0000000001340000-memory.dmpFilesize
64KB
-
memory/3480-137-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/3480-142-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3480-135-0x0000000000440000-0x00000000005E4000-memory.dmpFilesize
1.6MB
-
memory/3480-133-0x0000000000000000-mapping.dmp
-
memory/4828-141-0x0000000000000000-mapping.dmp
-
memory/4828-143-0x0000000000AC0000-0x0000000000AD4000-memory.dmpFilesize
80KB
-
memory/4828-144-0x0000000000EE0000-0x0000000000F0D000-memory.dmpFilesize
180KB
-
memory/4828-145-0x0000000002D90000-0x00000000030DA000-memory.dmpFilesize
3.3MB
-
memory/4828-146-0x0000000002CE0000-0x0000000002D6F000-memory.dmpFilesize
572KB
-
memory/4828-147-0x0000000000EE0000-0x0000000000F0D000-memory.dmpFilesize
180KB