Analysis
-
max time kernel
145s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-10-2022 17:29
Static task
static1
Behavioral task
behavioral1
Sample
INVOICE.exe
Resource
win7-20220812-en
General
-
Target
INVOICE.exe
-
Size
900KB
-
MD5
94fbca3f42d439bed773a04e82b29827
-
SHA1
e804a967276c25df1b48e8b5f35109a2559cc55d
-
SHA256
3903f75f7f0106aa34486f7c546b98a1eba03b1a0d901ccd09fb90294de857a4
-
SHA512
21d8802c3bca47ba6d8fcbc20a1bd6a6502d32a5dad4fc1fa6e4b79266734046efa9e4ed807b99129ecf3427b9a4b2ec644e29a2f18d249081074aa99a7a2fd1
-
SSDEEP
12288:jXNIMvqVefEu5JunXd0qe06DgKWlkmaWpJOBqm3xraOVbp1G+B/NP:7NICSapUKVmaM/AbLn
Malware Config
Extracted
formbook
4.1
p94a
wishgrove.com
parqueveiculos.com
spiderwebs.online
chulkanadham.com
cdtuan.net
zxazm.com
payment6528832.xyz
fengtaiol.com
bffsmovie.com
aliceseagerfitness.com
garisluruskonsulindo.website
analytical-gutter.net
ahcq8.com
fenyoga.com
ecleptic.cat
conjurecrafts.com
aquaway.date
apenpokkenschoonmaakbedrijf.com
zgramr.top
boweknives.site
wf825.com
tonysdiary.com
alttxt.space
digz.us
mailim.xyz
chromebarbangkok.com
toyookahana.com
jornalaquadra.net
cloudpackages.online
xfew.top
atherenergy.uk
allentownfilmcrew.com
gym323.com
ballbyball.online
youyiw.com
mehdifarzi.com
dinobro.com
bonanzapratamaabadi.com
trailer.vegas
retro241.space
ecole-universite.com
magentodesigndublin.com
ilovechutney.info
451338.com
vintagewriting.site
008420.com
sussexfoodie.co.uk
matrix-101.com
carolina3dproperties.com
clairecorrie.co.uk
asafosa.xyz
yashpestcontrol.com
keilewn.online
nirmalmirchandani.com
familyibis.sbs
anthropologybythewire.com
invidgekets.xyz
1stconstiution.com
byxre.com
andresraiter.com
1stpartynft.com
25thdayoffer.xyz
nicehaus.space
mhjys.com
muuritutkimus.info
Signatures
-
Formbook payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1996-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1996-64-0x000000000041F0F0-mapping.dmp formbook behavioral1/memory/1996-66-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1996-74-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1308-78-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/1308-82-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 832 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
INVOICE.exeINVOICE.exeraserver.exedescription pid process target process PID 1764 set thread context of 1996 1764 INVOICE.exe INVOICE.exe PID 1996 set thread context of 1204 1996 INVOICE.exe Explorer.EXE PID 1996 set thread context of 1204 1996 INVOICE.exe Explorer.EXE PID 1308 set thread context of 1204 1308 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
INVOICE.exeraserver.exepid process 1996 INVOICE.exe 1996 INVOICE.exe 1996 INVOICE.exe 1308 raserver.exe 1308 raserver.exe 1308 raserver.exe 1308 raserver.exe 1308 raserver.exe 1308 raserver.exe 1308 raserver.exe 1308 raserver.exe 1308 raserver.exe 1308 raserver.exe 1308 raserver.exe 1308 raserver.exe 1308 raserver.exe 1308 raserver.exe 1308 raserver.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
INVOICE.exeraserver.exepid process 1996 INVOICE.exe 1996 INVOICE.exe 1996 INVOICE.exe 1996 INVOICE.exe 1308 raserver.exe 1308 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
INVOICE.exeraserver.exedescription pid process Token: SeDebugPrivilege 1996 INVOICE.exe Token: SeDebugPrivilege 1308 raserver.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
INVOICE.exeINVOICE.exeraserver.exedescription pid process target process PID 1764 wrote to memory of 1996 1764 INVOICE.exe INVOICE.exe PID 1764 wrote to memory of 1996 1764 INVOICE.exe INVOICE.exe PID 1764 wrote to memory of 1996 1764 INVOICE.exe INVOICE.exe PID 1764 wrote to memory of 1996 1764 INVOICE.exe INVOICE.exe PID 1764 wrote to memory of 1996 1764 INVOICE.exe INVOICE.exe PID 1764 wrote to memory of 1996 1764 INVOICE.exe INVOICE.exe PID 1764 wrote to memory of 1996 1764 INVOICE.exe INVOICE.exe PID 1996 wrote to memory of 1308 1996 INVOICE.exe raserver.exe PID 1996 wrote to memory of 1308 1996 INVOICE.exe raserver.exe PID 1996 wrote to memory of 1308 1996 INVOICE.exe raserver.exe PID 1996 wrote to memory of 1308 1996 INVOICE.exe raserver.exe PID 1308 wrote to memory of 832 1308 raserver.exe cmd.exe PID 1308 wrote to memory of 832 1308 raserver.exe cmd.exe PID 1308 wrote to memory of 832 1308 raserver.exe cmd.exe PID 1308 wrote to memory of 832 1308 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"5⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/832-76-0x0000000000000000-mapping.dmp
-
memory/1204-83-0x0000000004AC0000-0x0000000004C09000-memory.dmpFilesize
1.3MB
-
memory/1204-72-0x0000000004E90000-0x0000000004FB7000-memory.dmpFilesize
1.2MB
-
memory/1204-69-0x0000000007200000-0x0000000007389000-memory.dmpFilesize
1.5MB
-
memory/1204-81-0x0000000004AC0000-0x0000000004C09000-memory.dmpFilesize
1.3MB
-
memory/1308-78-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1308-82-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1308-80-0x00000000009E0000-0x0000000000A73000-memory.dmpFilesize
588KB
-
memory/1308-79-0x0000000002160000-0x0000000002463000-memory.dmpFilesize
3.0MB
-
memory/1308-73-0x0000000000000000-mapping.dmp
-
memory/1308-77-0x0000000000D40000-0x0000000000D5C000-memory.dmpFilesize
112KB
-
memory/1764-54-0x00000000010F0000-0x00000000011D8000-memory.dmpFilesize
928KB
-
memory/1764-59-0x0000000001090000-0x00000000010C4000-memory.dmpFilesize
208KB
-
memory/1764-58-0x0000000005EA0000-0x0000000005F2E000-memory.dmpFilesize
568KB
-
memory/1764-57-0x0000000000440000-0x000000000044C000-memory.dmpFilesize
48KB
-
memory/1764-56-0x0000000000B90000-0x0000000000BA8000-memory.dmpFilesize
96KB
-
memory/1764-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmpFilesize
8KB
-
memory/1996-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1996-74-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1996-71-0x00000000002F0000-0x0000000000304000-memory.dmpFilesize
80KB
-
memory/1996-68-0x0000000000290000-0x00000000002A4000-memory.dmpFilesize
80KB
-
memory/1996-67-0x0000000000820000-0x0000000000B23000-memory.dmpFilesize
3.0MB
-
memory/1996-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1996-64-0x000000000041F0F0-mapping.dmp
-
memory/1996-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1996-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB