Analysis
-
max time kernel
152s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 18:57
Static task
static1
Behavioral task
behavioral1
Sample
rOrderRequirements-Invoice.exe
Resource
win7-20230831-en
General
-
Target
rOrderRequirements-Invoice.exe
-
Size
806KB
-
MD5
aa79e4458fd7f7be6b044281984dc3cf
-
SHA1
4fa6041b430c958e4c403c3f140783cf1ad05c79
-
SHA256
716cc459f4685123823a8e5fc94768b3526c0900c98a0e51c5ce4b794b6b9f8c
-
SHA512
a9dbe8065515bf06455179cf8c965d94d0f7f7ad83c82f84807e526cea8b07798bc5543b184f609f48290b4784f114f3f8a1b416ff6a977d097f2e3d202def2a
-
SSDEEP
24576:IyFdolEMsxb+zqFPoBmjvZIKiUnmOU5uQn:IGYEMsxb+zqJemjvFmOk
Malware Config
Extracted
formbook
4.1
v93r
labourcommunitymarket.com
nba82.com
datahabitsales.site
rosstony.link
baliorganic.farm
qefhyjngrxcbjfvgft.autos
bippttcg.click
tldrschool.com
vcdaawug.click
garage2mats.com
soulrin.store
themezodermacream.com
522fairwaylookout.com
jmhoa.cyou
sygcb.link
thanhpresident.com
biy-home.com
imtmlife.online
dijitalpasaj.app
105261.com
wyldnwestern.com
risefootwear.com
bbmusic906.com
unsold-laptops-seek.today
oixkphfm9oap.xyz
steelyholdings.com
ticket2future.site
vndlsvllns.com
rupashtgai.com
lexpy.xyz
drillingkingtool.com
lkpmekarjaya.com
luoyutao.love
notfrank.tech
calawadvice.com
wpc-rotterdam.com
pttroblox.com
coffeeforsoldiers.com
csshhinm.click
bmsexpert.com
coperworks.com
fengwowuye.com
dariobisogno.com
naturalresourcetrail.com
allupinyourbizness.com
cheapjerseysfreeshipping.store
upgoavvi.click
mynintdndonews.com
zorailabs.com
akonghoki.click
lgoicube.com
rapportus.com
lxdutzuc.click
kradbfkweqd888.com
fbjbk.com
lojaravystore.online
truthistanbul.xyz
ilda.vip
holytoastknox.com
owsspa.com
oyyltyzn.click
pesawat-tempur-3.site
wyxhoo.com
jiahao668.com
myacc.info
Signatures
-
Formbook payload 4 IoCs
resource yara_rule behavioral1/memory/2624-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2624-18-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2620-23-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook behavioral1/memory/2620-25-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Deletes itself 1 IoCs
pid Process 2580 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2144 set thread context of 2624 2144 rOrderRequirements-Invoice.exe 30 PID 2624 set thread context of 1268 2624 rOrderRequirements-Invoice.exe 6 PID 2620 set thread context of 1268 2620 chkdsk.exe 6 -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 2624 rOrderRequirements-Invoice.exe 2624 rOrderRequirements-Invoice.exe 2620 chkdsk.exe 2620 chkdsk.exe 2620 chkdsk.exe 2620 chkdsk.exe 2620 chkdsk.exe 2620 chkdsk.exe 2620 chkdsk.exe 2620 chkdsk.exe 2620 chkdsk.exe 2620 chkdsk.exe 2620 chkdsk.exe 2620 chkdsk.exe 2620 chkdsk.exe 2620 chkdsk.exe 2620 chkdsk.exe 2620 chkdsk.exe 2620 chkdsk.exe 2620 chkdsk.exe 2620 chkdsk.exe 2620 chkdsk.exe 2620 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1268 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2624 rOrderRequirements-Invoice.exe 2624 rOrderRequirements-Invoice.exe 2624 rOrderRequirements-Invoice.exe 2620 chkdsk.exe 2620 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2624 rOrderRequirements-Invoice.exe Token: SeDebugPrivilege 2620 chkdsk.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2144 wrote to memory of 2624 2144 rOrderRequirements-Invoice.exe 30 PID 2144 wrote to memory of 2624 2144 rOrderRequirements-Invoice.exe 30 PID 2144 wrote to memory of 2624 2144 rOrderRequirements-Invoice.exe 30 PID 2144 wrote to memory of 2624 2144 rOrderRequirements-Invoice.exe 30 PID 2144 wrote to memory of 2624 2144 rOrderRequirements-Invoice.exe 30 PID 2144 wrote to memory of 2624 2144 rOrderRequirements-Invoice.exe 30 PID 2144 wrote to memory of 2624 2144 rOrderRequirements-Invoice.exe 30 PID 1268 wrote to memory of 2620 1268 Explorer.EXE 31 PID 1268 wrote to memory of 2620 1268 Explorer.EXE 31 PID 1268 wrote to memory of 2620 1268 Explorer.EXE 31 PID 1268 wrote to memory of 2620 1268 Explorer.EXE 31 PID 2620 wrote to memory of 2580 2620 chkdsk.exe 32 PID 2620 wrote to memory of 2580 2620 chkdsk.exe 32 PID 2620 wrote to memory of 2580 2620 chkdsk.exe 32 PID 2620 wrote to memory of 2580 2620 chkdsk.exe 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"3⤵
- Deletes itself
PID:2580
-
-