Analysis
-
max time kernel
154s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 18:58
Static task
static1
Behavioral task
behavioral1
Sample
rOrderRequirements-Invoice.exe
Resource
win7-20230831-en
General
-
Target
rOrderRequirements-Invoice.exe
-
Size
806KB
-
MD5
aa79e4458fd7f7be6b044281984dc3cf
-
SHA1
4fa6041b430c958e4c403c3f140783cf1ad05c79
-
SHA256
716cc459f4685123823a8e5fc94768b3526c0900c98a0e51c5ce4b794b6b9f8c
-
SHA512
a9dbe8065515bf06455179cf8c965d94d0f7f7ad83c82f84807e526cea8b07798bc5543b184f609f48290b4784f114f3f8a1b416ff6a977d097f2e3d202def2a
-
SSDEEP
24576:IyFdolEMsxb+zqFPoBmjvZIKiUnmOU5uQn:IGYEMsxb+zqJemjvFmOk
Malware Config
Extracted
formbook
4.1
v93r
labourcommunitymarket.com
nba82.com
datahabitsales.site
rosstony.link
baliorganic.farm
qefhyjngrxcbjfvgft.autos
bippttcg.click
tldrschool.com
vcdaawug.click
garage2mats.com
soulrin.store
themezodermacream.com
522fairwaylookout.com
jmhoa.cyou
sygcb.link
thanhpresident.com
biy-home.com
imtmlife.online
dijitalpasaj.app
105261.com
wyldnwestern.com
risefootwear.com
bbmusic906.com
unsold-laptops-seek.today
oixkphfm9oap.xyz
steelyholdings.com
ticket2future.site
vndlsvllns.com
rupashtgai.com
lexpy.xyz
drillingkingtool.com
lkpmekarjaya.com
luoyutao.love
notfrank.tech
calawadvice.com
wpc-rotterdam.com
pttroblox.com
coffeeforsoldiers.com
csshhinm.click
bmsexpert.com
coperworks.com
fengwowuye.com
dariobisogno.com
naturalresourcetrail.com
allupinyourbizness.com
cheapjerseysfreeshipping.store
upgoavvi.click
mynintdndonews.com
zorailabs.com
akonghoki.click
lgoicube.com
rapportus.com
lxdutzuc.click
kradbfkweqd888.com
fbjbk.com
lojaravystore.online
truthistanbul.xyz
ilda.vip
holytoastknox.com
owsspa.com
oyyltyzn.click
pesawat-tempur-3.site
wyxhoo.com
jiahao668.com
myacc.info
Signatures
-
Formbook payload 4 IoCs
resource yara_rule behavioral2/memory/4000-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4000-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/116-57-0x0000000000B10000-0x0000000000B3F000-memory.dmp formbook behavioral2/memory/116-60-0x0000000000B10000-0x0000000000B3F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1316 set thread context of 4000 1316 rOrderRequirements-Invoice.exe 99 PID 4000 set thread context of 3288 4000 rOrderRequirements-Invoice.exe 39 PID 116 set thread context of 3288 116 cmmon32.exe 39 -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 4000 rOrderRequirements-Invoice.exe 4000 rOrderRequirements-Invoice.exe 4000 rOrderRequirements-Invoice.exe 4000 rOrderRequirements-Invoice.exe 116 cmmon32.exe 116 cmmon32.exe 116 cmmon32.exe 116 cmmon32.exe 116 cmmon32.exe 116 cmmon32.exe 116 cmmon32.exe 116 cmmon32.exe 116 cmmon32.exe 116 cmmon32.exe 116 cmmon32.exe 116 cmmon32.exe 116 cmmon32.exe 116 cmmon32.exe 116 cmmon32.exe 116 cmmon32.exe 116 cmmon32.exe 116 cmmon32.exe 116 cmmon32.exe 116 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3288 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 4000 rOrderRequirements-Invoice.exe 4000 rOrderRequirements-Invoice.exe 4000 rOrderRequirements-Invoice.exe 116 cmmon32.exe 116 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4000 rOrderRequirements-Invoice.exe Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeShutdownPrivilege 3288 Explorer.EXE Token: SeCreatePagefilePrivilege 3288 Explorer.EXE Token: SeDebugPrivilege 116 cmmon32.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3288 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1316 wrote to memory of 4000 1316 rOrderRequirements-Invoice.exe 99 PID 1316 wrote to memory of 4000 1316 rOrderRequirements-Invoice.exe 99 PID 1316 wrote to memory of 4000 1316 rOrderRequirements-Invoice.exe 99 PID 1316 wrote to memory of 4000 1316 rOrderRequirements-Invoice.exe 99 PID 1316 wrote to memory of 4000 1316 rOrderRequirements-Invoice.exe 99 PID 1316 wrote to memory of 4000 1316 rOrderRequirements-Invoice.exe 99 PID 3288 wrote to memory of 116 3288 Explorer.EXE 100 PID 3288 wrote to memory of 116 3288 Explorer.EXE 100 PID 3288 wrote to memory of 116 3288 Explorer.EXE 100 PID 116 wrote to memory of 2200 116 cmmon32.exe 101 PID 116 wrote to memory of 2200 116 cmmon32.exe 101 PID 116 wrote to memory of 2200 116 cmmon32.exe 101
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4000
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"3⤵PID:2200
-
-