Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 18:57
Static task
static1
Behavioral task
behavioral1
Sample
rOrderRequirements-Invoice.exe
Resource
win7-20230831-en
General
-
Target
rOrderRequirements-Invoice.exe
-
Size
806KB
-
MD5
aa79e4458fd7f7be6b044281984dc3cf
-
SHA1
4fa6041b430c958e4c403c3f140783cf1ad05c79
-
SHA256
716cc459f4685123823a8e5fc94768b3526c0900c98a0e51c5ce4b794b6b9f8c
-
SHA512
a9dbe8065515bf06455179cf8c965d94d0f7f7ad83c82f84807e526cea8b07798bc5543b184f609f48290b4784f114f3f8a1b416ff6a977d097f2e3d202def2a
-
SSDEEP
24576:IyFdolEMsxb+zqFPoBmjvZIKiUnmOU5uQn:IGYEMsxb+zqJemjvFmOk
Malware Config
Extracted
formbook
4.1
v93r
labourcommunitymarket.com
nba82.com
datahabitsales.site
rosstony.link
baliorganic.farm
qefhyjngrxcbjfvgft.autos
bippttcg.click
tldrschool.com
vcdaawug.click
garage2mats.com
soulrin.store
themezodermacream.com
522fairwaylookout.com
jmhoa.cyou
sygcb.link
thanhpresident.com
biy-home.com
imtmlife.online
dijitalpasaj.app
105261.com
wyldnwestern.com
risefootwear.com
bbmusic906.com
unsold-laptops-seek.today
oixkphfm9oap.xyz
steelyholdings.com
ticket2future.site
vndlsvllns.com
rupashtgai.com
lexpy.xyz
drillingkingtool.com
lkpmekarjaya.com
luoyutao.love
notfrank.tech
calawadvice.com
wpc-rotterdam.com
pttroblox.com
coffeeforsoldiers.com
csshhinm.click
bmsexpert.com
coperworks.com
fengwowuye.com
dariobisogno.com
naturalresourcetrail.com
allupinyourbizness.com
cheapjerseysfreeshipping.store
upgoavvi.click
mynintdndonews.com
zorailabs.com
akonghoki.click
lgoicube.com
rapportus.com
lxdutzuc.click
kradbfkweqd888.com
fbjbk.com
lojaravystore.online
truthistanbul.xyz
ilda.vip
holytoastknox.com
owsspa.com
oyyltyzn.click
pesawat-tempur-3.site
wyxhoo.com
jiahao668.com
myacc.info
Signatures
-
Formbook payload 4 IoCs
resource yara_rule behavioral2/memory/2456-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2456-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3248-59-0x0000000000AA0000-0x0000000000ACF000-memory.dmp formbook behavioral2/memory/3248-61-0x0000000000AA0000-0x0000000000ACF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2796 set thread context of 2456 2796 rOrderRequirements-Invoice.exe 100 PID 2456 set thread context of 3124 2456 rOrderRequirements-Invoice.exe 40 PID 3248 set thread context of 3124 3248 colorcpl.exe 40 -
Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 2796 rOrderRequirements-Invoice.exe 2796 rOrderRequirements-Invoice.exe 2456 rOrderRequirements-Invoice.exe 2456 rOrderRequirements-Invoice.exe 2456 rOrderRequirements-Invoice.exe 2456 rOrderRequirements-Invoice.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe 3248 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3124 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2456 rOrderRequirements-Invoice.exe 2456 rOrderRequirements-Invoice.exe 2456 rOrderRequirements-Invoice.exe 3248 colorcpl.exe 3248 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2796 rOrderRequirements-Invoice.exe Token: SeDebugPrivilege 2456 rOrderRequirements-Invoice.exe Token: SeShutdownPrivilege 3124 Explorer.EXE Token: SeCreatePagefilePrivilege 3124 Explorer.EXE Token: SeShutdownPrivilege 3124 Explorer.EXE Token: SeCreatePagefilePrivilege 3124 Explorer.EXE Token: SeDebugPrivilege 3248 colorcpl.exe Token: SeShutdownPrivilege 3124 Explorer.EXE Token: SeCreatePagefilePrivilege 3124 Explorer.EXE Token: SeShutdownPrivilege 3124 Explorer.EXE Token: SeCreatePagefilePrivilege 3124 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3124 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2796 wrote to memory of 2288 2796 rOrderRequirements-Invoice.exe 99 PID 2796 wrote to memory of 2288 2796 rOrderRequirements-Invoice.exe 99 PID 2796 wrote to memory of 2288 2796 rOrderRequirements-Invoice.exe 99 PID 2796 wrote to memory of 2456 2796 rOrderRequirements-Invoice.exe 100 PID 2796 wrote to memory of 2456 2796 rOrderRequirements-Invoice.exe 100 PID 2796 wrote to memory of 2456 2796 rOrderRequirements-Invoice.exe 100 PID 2796 wrote to memory of 2456 2796 rOrderRequirements-Invoice.exe 100 PID 2796 wrote to memory of 2456 2796 rOrderRequirements-Invoice.exe 100 PID 2796 wrote to memory of 2456 2796 rOrderRequirements-Invoice.exe 100 PID 3124 wrote to memory of 3248 3124 Explorer.EXE 101 PID 3124 wrote to memory of 3248 3124 Explorer.EXE 101 PID 3124 wrote to memory of 3248 3124 Explorer.EXE 101 PID 3248 wrote to memory of 4824 3248 colorcpl.exe 103 PID 3248 wrote to memory of 4824 3248 colorcpl.exe 103 PID 3248 wrote to memory of 4824 3248 colorcpl.exe 103
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"3⤵PID:2288
-
-
C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2456
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"3⤵PID:4824
-
-