Analysis
-
max time kernel
151s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 18:58
Static task
static1
Behavioral task
behavioral1
Sample
rOrderRequirements-Invoice.exe
Resource
win7-20230831-en
General
-
Target
rOrderRequirements-Invoice.exe
-
Size
806KB
-
MD5
aa79e4458fd7f7be6b044281984dc3cf
-
SHA1
4fa6041b430c958e4c403c3f140783cf1ad05c79
-
SHA256
716cc459f4685123823a8e5fc94768b3526c0900c98a0e51c5ce4b794b6b9f8c
-
SHA512
a9dbe8065515bf06455179cf8c965d94d0f7f7ad83c82f84807e526cea8b07798bc5543b184f609f48290b4784f114f3f8a1b416ff6a977d097f2e3d202def2a
-
SSDEEP
24576:IyFdolEMsxb+zqFPoBmjvZIKiUnmOU5uQn:IGYEMsxb+zqJemjvFmOk
Malware Config
Extracted
formbook
4.1
v93r
labourcommunitymarket.com
nba82.com
datahabitsales.site
rosstony.link
baliorganic.farm
qefhyjngrxcbjfvgft.autos
bippttcg.click
tldrschool.com
vcdaawug.click
garage2mats.com
soulrin.store
themezodermacream.com
522fairwaylookout.com
jmhoa.cyou
sygcb.link
thanhpresident.com
biy-home.com
imtmlife.online
dijitalpasaj.app
105261.com
wyldnwestern.com
risefootwear.com
bbmusic906.com
unsold-laptops-seek.today
oixkphfm9oap.xyz
steelyholdings.com
ticket2future.site
vndlsvllns.com
rupashtgai.com
lexpy.xyz
drillingkingtool.com
lkpmekarjaya.com
luoyutao.love
notfrank.tech
calawadvice.com
wpc-rotterdam.com
pttroblox.com
coffeeforsoldiers.com
csshhinm.click
bmsexpert.com
coperworks.com
fengwowuye.com
dariobisogno.com
naturalresourcetrail.com
allupinyourbizness.com
cheapjerseysfreeshipping.store
upgoavvi.click
mynintdndonews.com
zorailabs.com
akonghoki.click
lgoicube.com
rapportus.com
lxdutzuc.click
kradbfkweqd888.com
fbjbk.com
lojaravystore.online
truthistanbul.xyz
ilda.vip
holytoastknox.com
owsspa.com
oyyltyzn.click
pesawat-tempur-3.site
wyxhoo.com
jiahao668.com
myacc.info
Signatures
-
Formbook payload 4 IoCs
resource yara_rule behavioral1/memory/2888-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2888-16-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2708-21-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/2708-24-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
pid Process 2608 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1976 set thread context of 2888 1976 rOrderRequirements-Invoice.exe 30 PID 2888 set thread context of 1256 2888 rOrderRequirements-Invoice.exe 13 PID 2708 set thread context of 1256 2708 msdt.exe 13 -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2888 rOrderRequirements-Invoice.exe 2888 rOrderRequirements-Invoice.exe 2708 msdt.exe 2708 msdt.exe 2708 msdt.exe 2708 msdt.exe 2708 msdt.exe 2708 msdt.exe 2708 msdt.exe 2708 msdt.exe 2708 msdt.exe 2708 msdt.exe 2708 msdt.exe 2708 msdt.exe 2708 msdt.exe 2708 msdt.exe 2708 msdt.exe 2708 msdt.exe 2708 msdt.exe 2708 msdt.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1256 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2888 rOrderRequirements-Invoice.exe 2888 rOrderRequirements-Invoice.exe 2888 rOrderRequirements-Invoice.exe 2708 msdt.exe 2708 msdt.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2888 rOrderRequirements-Invoice.exe Token: SeDebugPrivilege 2708 msdt.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2888 1976 rOrderRequirements-Invoice.exe 30 PID 1976 wrote to memory of 2888 1976 rOrderRequirements-Invoice.exe 30 PID 1976 wrote to memory of 2888 1976 rOrderRequirements-Invoice.exe 30 PID 1976 wrote to memory of 2888 1976 rOrderRequirements-Invoice.exe 30 PID 1976 wrote to memory of 2888 1976 rOrderRequirements-Invoice.exe 30 PID 1976 wrote to memory of 2888 1976 rOrderRequirements-Invoice.exe 30 PID 1976 wrote to memory of 2888 1976 rOrderRequirements-Invoice.exe 30 PID 1256 wrote to memory of 2708 1256 Explorer.EXE 31 PID 1256 wrote to memory of 2708 1256 Explorer.EXE 31 PID 1256 wrote to memory of 2708 1256 Explorer.EXE 31 PID 1256 wrote to memory of 2708 1256 Explorer.EXE 31 PID 2708 wrote to memory of 2608 2708 msdt.exe 32 PID 2708 wrote to memory of 2608 2708 msdt.exe 32 PID 2708 wrote to memory of 2608 2708 msdt.exe 32 PID 2708 wrote to memory of 2608 2708 msdt.exe 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"3⤵
- Deletes itself
PID:2608
-
-