Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2023 09:16
Static task
static1
Behavioral task
behavioral1
Sample
RFQOREDER.exe
Resource
win7-20230220-en
General
-
Target
RFQOREDER.exe
-
Size
643KB
-
MD5
9312a2fd83dd825003de2272781b7e4a
-
SHA1
f247b5a524abd633db60f6d1e332af855518ad29
-
SHA256
7f0a83fb59c743687b2076967768f0cea1a7772390d25bcd25ebee31caeaaa8f
-
SHA512
df53b0c0a75fa6c1c2435b93f5d1ebfd70ea720611d2f2555068df3d4b958c81b07c3e69085d4d1cb85f6ff9b57a74c339f6bdd5ef39ff96695990aca7250e08
-
SSDEEP
6144:6ydfWo0aIYW6VQgcitOZ8ywg+8Xmf8igxXAN+BJKJmTqikXmi00FdyfrpruJMRse:NFWFFyOZ8yE7fKAN+U+g0fTprGiMTQ7
Malware Config
Extracted
formbook
4.1
gtt8
thesuccessbot.com
rittercivil.com
jt1.fun
d365extension.com
quqoxeq.top
visittworiverswi.com
bfprotienda.com
greenhabitsph.com
ladmere.com
clockboutiques.com
minwart.xyz
xinyuejiancai.online
eggsl.com
fetchingcandles.com
skywatiniya.com
hinkley.news
realityonlineenterprises.com
teamcroissant.com
esfera-pv.ch
herdadedosmontesbastos.com
buddhistprayers.app
talytic-one.com
capital-top.com
pawmultiverse.com
gdrop.biz
africanswers.online
amgconstruct1on.com
review.builders
findinstinct.online
leseditionsdupangolin.site
vector-sale.com
hutesmarke.shop
spacevisualmedia.com
jeweledcrown.shop
divinedivas.store
redirr.online
callifam.com
nickelinfo.com
ginghamstudio.com
launchthepodcast.com
arlisia.com
kerryshields.com
xn--o39aj5xqvflut.com
ramsgatecarwash.com
semrushfreetrails.com
rmpaclub.ru
wtpoexpo.one
amlar.xyz
downlis.top
phrasecheck.com
uk885.top
gdtrn.com
99522v.com
liftdetox2023.online
evo-omega.cloud
iccu3v.link
amd-soft1.site
containermurah.xyz
vineagency.uk
leeprintanddesign.com
bnjyjy.com
bookra-ck.com
ilyinsurance.com
texasmicroneedling.com
osmosstore.com
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/2748-139-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2748-143-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2748-150-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4616-152-0x00000000003A0000-0x00000000003CF000-memory.dmp formbook behavioral2/memory/4616-154-0x00000000003A0000-0x00000000003CF000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
RFQOREDER.exeRFQOREDER.execolorcpl.exedescription pid process target process PID 744 set thread context of 2748 744 RFQOREDER.exe RFQOREDER.exe PID 2748 set thread context of 2552 2748 RFQOREDER.exe Explorer.EXE PID 2748 set thread context of 2552 2748 RFQOREDER.exe Explorer.EXE PID 4616 set thread context of 2552 4616 colorcpl.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
RFQOREDER.exeRFQOREDER.execolorcpl.exepid process 744 RFQOREDER.exe 744 RFQOREDER.exe 2748 RFQOREDER.exe 2748 RFQOREDER.exe 2748 RFQOREDER.exe 2748 RFQOREDER.exe 2748 RFQOREDER.exe 2748 RFQOREDER.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe 4616 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2552 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RFQOREDER.execolorcpl.exepid process 2748 RFQOREDER.exe 2748 RFQOREDER.exe 2748 RFQOREDER.exe 2748 RFQOREDER.exe 4616 colorcpl.exe 4616 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RFQOREDER.exeRFQOREDER.execolorcpl.exedescription pid process Token: SeDebugPrivilege 744 RFQOREDER.exe Token: SeDebugPrivilege 2748 RFQOREDER.exe Token: SeDebugPrivilege 4616 colorcpl.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
RFQOREDER.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 744 wrote to memory of 2856 744 RFQOREDER.exe RFQOREDER.exe PID 744 wrote to memory of 2856 744 RFQOREDER.exe RFQOREDER.exe PID 744 wrote to memory of 2856 744 RFQOREDER.exe RFQOREDER.exe PID 744 wrote to memory of 2748 744 RFQOREDER.exe RFQOREDER.exe PID 744 wrote to memory of 2748 744 RFQOREDER.exe RFQOREDER.exe PID 744 wrote to memory of 2748 744 RFQOREDER.exe RFQOREDER.exe PID 744 wrote to memory of 2748 744 RFQOREDER.exe RFQOREDER.exe PID 744 wrote to memory of 2748 744 RFQOREDER.exe RFQOREDER.exe PID 744 wrote to memory of 2748 744 RFQOREDER.exe RFQOREDER.exe PID 2552 wrote to memory of 4616 2552 Explorer.EXE colorcpl.exe PID 2552 wrote to memory of 4616 2552 Explorer.EXE colorcpl.exe PID 2552 wrote to memory of 4616 2552 Explorer.EXE colorcpl.exe PID 4616 wrote to memory of 220 4616 colorcpl.exe cmd.exe PID 4616 wrote to memory of 220 4616 colorcpl.exe cmd.exe PID 4616 wrote to memory of 220 4616 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQOREDER.exe"C:\Users\Admin\AppData\Local\Temp\RFQOREDER.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQOREDER.exe"C:\Users\Admin\AppData\Local\Temp\RFQOREDER.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\RFQOREDER.exe"C:\Users\Admin\AppData\Local\Temp\RFQOREDER.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQOREDER.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/744-133-0x0000000000E50000-0x0000000000EF8000-memory.dmpFilesize
672KB
-
memory/744-134-0x00000000057B0000-0x00000000057C0000-memory.dmpFilesize
64KB
-
memory/744-135-0x0000000005F40000-0x00000000064E4000-memory.dmpFilesize
5.6MB
-
memory/744-136-0x0000000005A80000-0x0000000005B12000-memory.dmpFilesize
584KB
-
memory/744-137-0x00000000057B0000-0x00000000057C0000-memory.dmpFilesize
64KB
-
memory/744-138-0x00000000088B0000-0x000000000894C000-memory.dmpFilesize
624KB
-
memory/2552-145-0x0000000007030000-0x000000000713B000-memory.dmpFilesize
1.0MB
-
memory/2552-157-0x0000000002970000-0x0000000002A2E000-memory.dmpFilesize
760KB
-
memory/2552-148-0x0000000008390000-0x00000000084CD000-memory.dmpFilesize
1.2MB
-
memory/2552-160-0x0000000002970000-0x0000000002A2E000-memory.dmpFilesize
760KB
-
memory/2552-158-0x0000000002970000-0x0000000002A2E000-memory.dmpFilesize
760KB
-
memory/2748-143-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2748-144-0x0000000000EF0000-0x0000000000F05000-memory.dmpFilesize
84KB
-
memory/2748-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2748-147-0x0000000000F70000-0x0000000000F85000-memory.dmpFilesize
84KB
-
memory/2748-150-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2748-142-0x0000000001030000-0x000000000137A000-memory.dmpFilesize
3.3MB
-
memory/4616-151-0x0000000000E60000-0x0000000000E79000-memory.dmpFilesize
100KB
-
memory/4616-154-0x00000000003A0000-0x00000000003CF000-memory.dmpFilesize
188KB
-
memory/4616-156-0x0000000002430000-0x00000000024C4000-memory.dmpFilesize
592KB
-
memory/4616-153-0x00000000025F0000-0x000000000293A000-memory.dmpFilesize
3.3MB
-
memory/4616-152-0x00000000003A0000-0x00000000003CF000-memory.dmpFilesize
188KB
-
memory/4616-149-0x0000000000E60000-0x0000000000E79000-memory.dmpFilesize
100KB