Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 07:00
Static task
static1
Behavioral task
behavioral1
Sample
Purchase_Order.exe
Resource
win7-20220812-en
General
-
Target
Purchase_Order.exe
-
Size
298KB
-
MD5
bbb57513bb805fcb3ef1ae2391471599
-
SHA1
66c7d14b225a33b350e6f67a38d083ae019b4169
-
SHA256
f3d069895a8e65723f90f6ea33a53b6b30cdb20a613ae18292780f610eccd03e
-
SHA512
26e427a38cff46ba25d5b71c82c4ead15cb7f50c1f2ed4ba4f86ae7c42d8af6b91de3c16521d25c56033735ae1ef64d1d80a5c66c2cafcef20552a1576c1531e
-
SSDEEP
6144:Ze7CeGzLGQ6pFxwXP1Rtg6il224AAUr2A1wdkKhaTMiM:euzLGQ6eXP1Rtv24AhLG1
Malware Config
Extracted
formbook
i65a
r00zzvD9uoqMkFT8XDSqPg==
iSMQDJ3Tyuj8KXflBw==
Gq+tYoFrGU/5B4gGNnzHNg==
wEwcynSwpynZKUFhqyIK
bw3PbrjowhAVJA==
TggEt9LuwhAVJA==
r0UqC6sxgcWN7vc=
0m+fwBgf0oyehByUtx51BsBkuj8=
dhtdWWyIhRatp2dpv8tPcJoQ
jTAw4/4TCwcXjpECXDSqPg==
aglx4nPPkGp/raeivGVOfzdbFIu4
+qXr4cAGtQJm7Mf6
sU2Dc4ySSKZJc2/L32pFRrq+NgA0Yi8=
E6ohOo2zadVgzLIfaWALaik=
wXwu0yo/KbNm7Mf6
EcoyojCJYKg1laCuBK+exkNbFIu4
bhZgFvj6yP+R4F+0/5S/oFMpAA==
rzlylCB1NIMabG2dzGQd
+5ngCKjwwhAVJA==
AMUtZrYh+0LPL/QyfSo=
hzqw1O4JApAae41vjXUOeC8=
C7guqfg0PD5dvVf4DQ==
BsM1AaksgMWN7vc=
5pcGLkVbBUPPL/QyfSo=
TvMO/UKDdcWN7vc=
fCNJYrrKfTprvVf4DQ==
5rfNvNbPhEFrvVf4DQ==
9717JcIR+w4iNgKcr91It5f448HcIA==
Wfo2UPQmr3SeAgqCx+ihjjsY
Svg8XfRAHZ5DvXj4EA==
TuXg5TNpdh6yCOmt0pkeNaKCuzc=
fjn46QYnKM4w0+g=
WRV/AkxH/M7NzFzkCw91Zpz048HcIA==
Bo6ILlHigRGpGJRgtPd6WQFsGA==
ZCdTYvhSBMTjO0mpy+ihjjsY
Vg104XmxSn8DTRA2YCA=
fBmNxO/pwkHXAKalv3UOeC8=
2YL6LEtrcsyquo2wz3ahjjsY
iC2cyuTQsS3KHymco5LiuXXRdYc9KA==
JvGrI2XdqxWjoPQyfSo=
NMuVRIiBW1Nhjn9zgw3PwEJbFIu4
7KsjVqn0meiO7MVyjXUOeC8=
XvgsVPgmHCtBPPXC7IhcycBkuj8=
HsE0cZF7K+0KXVC4yexV8KqiJAA0Yi8=
ZA9olK7JxkTg6q7/TenoBXFnljPD7XGx
PvN6Nk9THuEFRZYCFA==
cx/LcM3luPqVmxJ+jhMI
smWwq8nUo09jvVf4DQ==
aBnnX3Z7RIQqQsRdhz0=
8o1CKXiwmgZm7Mf6
s2NR7g0vRFBRp3VhqyIK
DLYGcptChcWN7vc=
0GEVmuU0F1jkMfQyfSo=
s1Kiy26yq6+H9spyinUOeC8=
CZxV2PHhkdRu/ewuGg==
y8Xu3/EguTvj
ulTCKLYf9ULaNPQyfSo=
1Yl0JHHbnlR3eAp4uepO8u5YFRkKjVNu8Q==
V+zu64nHc059gzjoEtXhkxEB
dQkau9PuwhAVJA==
NMYypu3zqoGsllajzOShjjsY
Wxkhx+n/zcWN7vc=
74dZAaju4XcRfFR3kzM=
u3R6gBVPPDpcvVf4DQ==
partnermdg.com
Extracted
xloader
3.8
i65a
r00zzvD9uoqMkFT8XDSqPg==
iSMQDJ3Tyuj8KXflBw==
Gq+tYoFrGU/5B4gGNnzHNg==
wEwcynSwpynZKUFhqyIK
bw3PbrjowhAVJA==
TggEt9LuwhAVJA==
r0UqC6sxgcWN7vc=
0m+fwBgf0oyehByUtx51BsBkuj8=
dhtdWWyIhRatp2dpv8tPcJoQ
jTAw4/4TCwcXjpECXDSqPg==
aglx4nPPkGp/raeivGVOfzdbFIu4
+qXr4cAGtQJm7Mf6
sU2Dc4ySSKZJc2/L32pFRrq+NgA0Yi8=
E6ohOo2zadVgzLIfaWALaik=
wXwu0yo/KbNm7Mf6
EcoyojCJYKg1laCuBK+exkNbFIu4
bhZgFvj6yP+R4F+0/5S/oFMpAA==
rzlylCB1NIMabG2dzGQd
+5ngCKjwwhAVJA==
AMUtZrYh+0LPL/QyfSo=
hzqw1O4JApAae41vjXUOeC8=
C7guqfg0PD5dvVf4DQ==
BsM1AaksgMWN7vc=
5pcGLkVbBUPPL/QyfSo=
TvMO/UKDdcWN7vc=
fCNJYrrKfTprvVf4DQ==
5rfNvNbPhEFrvVf4DQ==
9717JcIR+w4iNgKcr91It5f448HcIA==
Wfo2UPQmr3SeAgqCx+ihjjsY
Svg8XfRAHZ5DvXj4EA==
TuXg5TNpdh6yCOmt0pkeNaKCuzc=
fjn46QYnKM4w0+g=
WRV/AkxH/M7NzFzkCw91Zpz048HcIA==
Bo6ILlHigRGpGJRgtPd6WQFsGA==
ZCdTYvhSBMTjO0mpy+ihjjsY
Vg104XmxSn8DTRA2YCA=
fBmNxO/pwkHXAKalv3UOeC8=
2YL6LEtrcsyquo2wz3ahjjsY
iC2cyuTQsS3KHymco5LiuXXRdYc9KA==
JvGrI2XdqxWjoPQyfSo=
NMuVRIiBW1Nhjn9zgw3PwEJbFIu4
7KsjVqn0meiO7MVyjXUOeC8=
XvgsVPgmHCtBPPXC7IhcycBkuj8=
HsE0cZF7K+0KXVC4yexV8KqiJAA0Yi8=
ZA9olK7JxkTg6q7/TenoBXFnljPD7XGx
PvN6Nk9THuEFRZYCFA==
cx/LcM3luPqVmxJ+jhMI
smWwq8nUo09jvVf4DQ==
aBnnX3Z7RIQqQsRdhz0=
8o1CKXiwmgZm7Mf6
s2NR7g0vRFBRp3VhqyIK
DLYGcptChcWN7vc=
0GEVmuU0F1jkMfQyfSo=
s1Kiy26yq6+H9spyinUOeC8=
CZxV2PHhkdRu/ewuGg==
y8Xu3/EguTvj
ulTCKLYf9ULaNPQyfSo=
1Yl0JHHbnlR3eAp4uepO8u5YFRkKjVNu8Q==
V+zu64nHc059gzjoEtXhkxEB
dQkau9PuwhAVJA==
NMYypu3zqoGsllajzOShjjsY
Wxkhx+n/zcWN7vc=
74dZAaju4XcRfFR3kzM=
u3R6gBVPPDpcvVf4DQ==
partnermdg.com
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
Purchase_Order.exeaspnet_compiler.exewscript.exedescription pid process target process PID 3884 set thread context of 2412 3884 Purchase_Order.exe aspnet_compiler.exe PID 2412 set thread context of 2056 2412 aspnet_compiler.exe Explorer.EXE PID 1180 set thread context of 2056 1180 wscript.exe Explorer.EXE -
Processes:
wscript.exedescription ioc process Key created \Registry\User\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wscript.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
aspnet_compiler.exewscript.exepid process 2412 aspnet_compiler.exe 2412 aspnet_compiler.exe 2412 aspnet_compiler.exe 2412 aspnet_compiler.exe 2412 aspnet_compiler.exe 2412 aspnet_compiler.exe 2412 aspnet_compiler.exe 2412 aspnet_compiler.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2056 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
aspnet_compiler.exewscript.exepid process 2412 aspnet_compiler.exe 2412 aspnet_compiler.exe 2412 aspnet_compiler.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
aspnet_compiler.exewscript.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 2412 aspnet_compiler.exe Token: SeDebugPrivilege 1180 wscript.exe Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Purchase_Order.exeExplorer.EXEwscript.exedescription pid process target process PID 3884 wrote to memory of 2412 3884 Purchase_Order.exe aspnet_compiler.exe PID 3884 wrote to memory of 2412 3884 Purchase_Order.exe aspnet_compiler.exe PID 3884 wrote to memory of 2412 3884 Purchase_Order.exe aspnet_compiler.exe PID 3884 wrote to memory of 2412 3884 Purchase_Order.exe aspnet_compiler.exe PID 3884 wrote to memory of 2412 3884 Purchase_Order.exe aspnet_compiler.exe PID 3884 wrote to memory of 2412 3884 Purchase_Order.exe aspnet_compiler.exe PID 2056 wrote to memory of 1180 2056 Explorer.EXE wscript.exe PID 2056 wrote to memory of 1180 2056 Explorer.EXE wscript.exe PID 2056 wrote to memory of 1180 2056 Explorer.EXE wscript.exe PID 1180 wrote to memory of 4716 1180 wscript.exe Firefox.exe PID 1180 wrote to memory of 4716 1180 wscript.exe Firefox.exe PID 1180 wrote to memory of 4716 1180 wscript.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase_Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase_Order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1180-147-0x00000000028B0000-0x0000000002BFA000-memory.dmpFilesize
3.3MB
-
memory/1180-145-0x0000000000600000-0x0000000000627000-memory.dmpFilesize
156KB
-
memory/1180-146-0x0000000000540000-0x000000000056D000-memory.dmpFilesize
180KB
-
memory/1180-142-0x0000000000000000-mapping.dmp
-
memory/1180-150-0x0000000000540000-0x000000000056D000-memory.dmpFilesize
180KB
-
memory/1180-148-0x00000000026E0000-0x000000000276F000-memory.dmpFilesize
572KB
-
memory/2056-181-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-219-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-221-0x00000000029E0000-0x00000000029F0000-memory.dmpFilesize
64KB
-
memory/2056-220-0x00000000029E0000-0x00000000029F0000-memory.dmpFilesize
64KB
-
memory/2056-183-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-185-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-149-0x00000000029F0000-0x0000000002AE1000-memory.dmpFilesize
964KB
-
memory/2056-218-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-151-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-152-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-153-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-154-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-155-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-156-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-157-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-158-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-159-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-160-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-161-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-162-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-163-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-164-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-165-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-166-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-167-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-168-0x0000000007F10000-0x0000000007F20000-memory.dmpFilesize
64KB
-
memory/2056-169-0x0000000007F10000-0x0000000007F20000-memory.dmpFilesize
64KB
-
memory/2056-170-0x0000000007F10000-0x0000000007F20000-memory.dmpFilesize
64KB
-
memory/2056-171-0x00000000029F0000-0x0000000002AE1000-memory.dmpFilesize
964KB
-
memory/2056-172-0x0000000007F10000-0x0000000007F20000-memory.dmpFilesize
64KB
-
memory/2056-173-0x0000000007F10000-0x0000000007F20000-memory.dmpFilesize
64KB
-
memory/2056-184-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-175-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-176-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-177-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-178-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-179-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-180-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-141-0x00000000081B0000-0x0000000008340000-memory.dmpFilesize
1.6MB
-
memory/2056-182-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-217-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-174-0x0000000007F10000-0x0000000007F20000-memory.dmpFilesize
64KB
-
memory/2056-216-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-186-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-187-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-188-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-189-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-190-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-191-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-192-0x0000000002340000-0x0000000002350000-memory.dmpFilesize
64KB
-
memory/2056-193-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/2056-194-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/2056-195-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/2056-196-0x0000000002340000-0x0000000002350000-memory.dmpFilesize
64KB
-
memory/2056-197-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/2056-198-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/2056-199-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/2056-200-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-201-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-202-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-203-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-204-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-205-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-206-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-207-0x00000000029D0000-0x00000000029E0000-memory.dmpFilesize
64KB
-
memory/2056-208-0x00000000029E0000-0x00000000029F0000-memory.dmpFilesize
64KB
-
memory/2056-209-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-210-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-211-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-212-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-213-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-214-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-215-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2412-137-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2412-138-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/2412-133-0x0000000000000000-mapping.dmp
-
memory/2412-134-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2412-140-0x0000000000F70000-0x0000000000F80000-memory.dmpFilesize
64KB
-
memory/2412-139-0x0000000001450000-0x000000000179A000-memory.dmpFilesize
3.3MB
-
memory/2412-143-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2412-144-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/3884-132-0x0000000000850000-0x000000000089C000-memory.dmpFilesize
304KB