Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
11-05-2023 13:31
Static task
static1
Behavioral task
behavioral1
Sample
NEW PURCHASE ORDER MAY 00957585.exe
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
NEW PURCHASE ORDER MAY 00957585.exe
Resource
win7-20230220-en
General
-
Target
NEW PURCHASE ORDER MAY 00957585.exe
-
Size
704KB
-
MD5
811027b8823ce068fa572fd1e782b126
-
SHA1
0ea06503dd9e0bb2946b2b600746a22a9c489bfc
-
SHA256
90315c352a9820703d29e4dcd9360660dd23bbfac585030993404076b998e45c
-
SHA512
6cae36f495db62bc8b337797e00a2288f3bab8bd1ae5a71c48f972a653090e641eb015ef891c03325013d19af8ccbc50ef47aea1923d1afc0207cb17c9f86d01
-
SSDEEP
12288:fvmbfOJWMnslt0uWDGRQjKyZnutU3UODbOJ0xHSTm/K4dHmNhdm:XmbfOnsltPWyRQjhZutGnGywTmS4s
Malware Config
Extracted
formbook
4.1
gtt8
thesuccessbot.com
rittercivil.com
jt1.fun
d365extension.com
quqoxeq.top
visittworiverswi.com
bfprotienda.com
greenhabitsph.com
ladmere.com
clockboutiques.com
minwart.xyz
xinyuejiancai.online
eggsl.com
fetchingcandles.com
skywatiniya.com
hinkley.news
realityonlineenterprises.com
teamcroissant.com
esfera-pv.ch
herdadedosmontesbastos.com
buddhistprayers.app
talytic-one.com
capital-top.com
pawmultiverse.com
gdrop.biz
africanswers.online
amgconstruct1on.com
review.builders
findinstinct.online
leseditionsdupangolin.site
vector-sale.com
hutesmarke.shop
spacevisualmedia.com
jeweledcrown.shop
divinedivas.store
redirr.online
callifam.com
nickelinfo.com
ginghamstudio.com
launchthepodcast.com
arlisia.com
kerryshields.com
xn--o39aj5xqvflut.com
ramsgatecarwash.com
semrushfreetrails.com
rmpaclub.ru
wtpoexpo.one
amlar.xyz
downlis.top
phrasecheck.com
uk885.top
gdtrn.com
99522v.com
liftdetox2023.online
evo-omega.cloud
iccu3v.link
amd-soft1.site
containermurah.xyz
vineagency.uk
leeprintanddesign.com
bnjyjy.com
bookra-ck.com
ilyinsurance.com
texasmicroneedling.com
osmosstore.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1628-64-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1628-68-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/860-73-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook behavioral2/memory/860-75-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1536 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
NEW PURCHASE ORDER MAY 00957585.exeNEW PURCHASE ORDER MAY 00957585.exewlanext.exedescription pid process target process PID 284 set thread context of 1628 284 NEW PURCHASE ORDER MAY 00957585.exe NEW PURCHASE ORDER MAY 00957585.exe PID 1628 set thread context of 1336 1628 NEW PURCHASE ORDER MAY 00957585.exe Explorer.EXE PID 860 set thread context of 1336 860 wlanext.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
NEW PURCHASE ORDER MAY 00957585.exeNEW PURCHASE ORDER MAY 00957585.exewlanext.exepid process 284 NEW PURCHASE ORDER MAY 00957585.exe 1628 NEW PURCHASE ORDER MAY 00957585.exe 1628 NEW PURCHASE ORDER MAY 00957585.exe 860 wlanext.exe 860 wlanext.exe 860 wlanext.exe 860 wlanext.exe 860 wlanext.exe 860 wlanext.exe 860 wlanext.exe 860 wlanext.exe 860 wlanext.exe 860 wlanext.exe 860 wlanext.exe 860 wlanext.exe 860 wlanext.exe 860 wlanext.exe 860 wlanext.exe 860 wlanext.exe 860 wlanext.exe 860 wlanext.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1336 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
NEW PURCHASE ORDER MAY 00957585.exewlanext.exepid process 1628 NEW PURCHASE ORDER MAY 00957585.exe 1628 NEW PURCHASE ORDER MAY 00957585.exe 1628 NEW PURCHASE ORDER MAY 00957585.exe 860 wlanext.exe 860 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
NEW PURCHASE ORDER MAY 00957585.exeNEW PURCHASE ORDER MAY 00957585.exewlanext.exedescription pid process Token: SeDebugPrivilege 284 NEW PURCHASE ORDER MAY 00957585.exe Token: SeDebugPrivilege 1628 NEW PURCHASE ORDER MAY 00957585.exe Token: SeDebugPrivilege 860 wlanext.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1336 Explorer.EXE 1336 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1336 Explorer.EXE 1336 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
NEW PURCHASE ORDER MAY 00957585.exeExplorer.EXEwlanext.exedescription pid process target process PID 284 wrote to memory of 1440 284 NEW PURCHASE ORDER MAY 00957585.exe NEW PURCHASE ORDER MAY 00957585.exe PID 284 wrote to memory of 1440 284 NEW PURCHASE ORDER MAY 00957585.exe NEW PURCHASE ORDER MAY 00957585.exe PID 284 wrote to memory of 1440 284 NEW PURCHASE ORDER MAY 00957585.exe NEW PURCHASE ORDER MAY 00957585.exe PID 284 wrote to memory of 1440 284 NEW PURCHASE ORDER MAY 00957585.exe NEW PURCHASE ORDER MAY 00957585.exe PID 284 wrote to memory of 1628 284 NEW PURCHASE ORDER MAY 00957585.exe NEW PURCHASE ORDER MAY 00957585.exe PID 284 wrote to memory of 1628 284 NEW PURCHASE ORDER MAY 00957585.exe NEW PURCHASE ORDER MAY 00957585.exe PID 284 wrote to memory of 1628 284 NEW PURCHASE ORDER MAY 00957585.exe NEW PURCHASE ORDER MAY 00957585.exe PID 284 wrote to memory of 1628 284 NEW PURCHASE ORDER MAY 00957585.exe NEW PURCHASE ORDER MAY 00957585.exe PID 284 wrote to memory of 1628 284 NEW PURCHASE ORDER MAY 00957585.exe NEW PURCHASE ORDER MAY 00957585.exe PID 284 wrote to memory of 1628 284 NEW PURCHASE ORDER MAY 00957585.exe NEW PURCHASE ORDER MAY 00957585.exe PID 284 wrote to memory of 1628 284 NEW PURCHASE ORDER MAY 00957585.exe NEW PURCHASE ORDER MAY 00957585.exe PID 1336 wrote to memory of 860 1336 Explorer.EXE wlanext.exe PID 1336 wrote to memory of 860 1336 Explorer.EXE wlanext.exe PID 1336 wrote to memory of 860 1336 Explorer.EXE wlanext.exe PID 1336 wrote to memory of 860 1336 Explorer.EXE wlanext.exe PID 860 wrote to memory of 1536 860 wlanext.exe cmd.exe PID 860 wrote to memory of 1536 860 wlanext.exe cmd.exe PID 860 wrote to memory of 1536 860 wlanext.exe cmd.exe PID 860 wrote to memory of 1536 860 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER MAY 00957585.exe"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER MAY 00957585.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER MAY 00957585.exe"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER MAY 00957585.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER MAY 00957585.exe"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER MAY 00957585.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER MAY 00957585.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/284-54-0x0000000001370000-0x0000000001426000-memory.dmpFilesize
728KB
-
memory/284-55-0x00000000012B0000-0x00000000012F0000-memory.dmpFilesize
256KB
-
memory/284-56-0x0000000000410000-0x0000000000422000-memory.dmpFilesize
72KB
-
memory/284-57-0x00000000012B0000-0x00000000012F0000-memory.dmpFilesize
256KB
-
memory/284-58-0x0000000000560000-0x000000000056A000-memory.dmpFilesize
40KB
-
memory/284-59-0x0000000004EE0000-0x0000000004F6C000-memory.dmpFilesize
560KB
-
memory/284-60-0x0000000004C40000-0x0000000004C94000-memory.dmpFilesize
336KB
-
memory/860-74-0x00000000021A0000-0x00000000024A3000-memory.dmpFilesize
3.0MB
-
memory/860-71-0x0000000000D80000-0x0000000000D96000-memory.dmpFilesize
88KB
-
memory/860-78-0x0000000000930000-0x00000000009C4000-memory.dmpFilesize
592KB
-
memory/860-75-0x00000000000C0000-0x00000000000EF000-memory.dmpFilesize
188KB
-
memory/860-73-0x00000000000C0000-0x00000000000EF000-memory.dmpFilesize
188KB
-
memory/860-72-0x0000000000D80000-0x0000000000D96000-memory.dmpFilesize
88KB
-
memory/1336-77-0x0000000000310000-0x0000000000410000-memory.dmpFilesize
1024KB
-
memory/1336-70-0x0000000006F90000-0x00000000070FB000-memory.dmpFilesize
1.4MB
-
memory/1336-79-0x0000000004ED0000-0x0000000004FD5000-memory.dmpFilesize
1.0MB
-
memory/1336-80-0x0000000004ED0000-0x0000000004FD5000-memory.dmpFilesize
1.0MB
-
memory/1336-82-0x0000000004ED0000-0x0000000004FD5000-memory.dmpFilesize
1.0MB
-
memory/1628-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1628-69-0x0000000000220000-0x0000000000235000-memory.dmpFilesize
84KB
-
memory/1628-67-0x0000000000840000-0x0000000000B43000-memory.dmpFilesize
3.0MB
-
memory/1628-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1628-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1628-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1628-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB