Analysis
-
max time kernel
239s -
max time network
252s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 18:58
Static task
static1
Behavioral task
behavioral1
Sample
rOrderRequirements-Invoice.exe
Resource
win7-20230831-en
General
-
Target
rOrderRequirements-Invoice.exe
-
Size
806KB
-
MD5
aa79e4458fd7f7be6b044281984dc3cf
-
SHA1
4fa6041b430c958e4c403c3f140783cf1ad05c79
-
SHA256
716cc459f4685123823a8e5fc94768b3526c0900c98a0e51c5ce4b794b6b9f8c
-
SHA512
a9dbe8065515bf06455179cf8c965d94d0f7f7ad83c82f84807e526cea8b07798bc5543b184f609f48290b4784f114f3f8a1b416ff6a977d097f2e3d202def2a
-
SSDEEP
24576:IyFdolEMsxb+zqFPoBmjvZIKiUnmOU5uQn:IGYEMsxb+zqJemjvFmOk
Malware Config
Extracted
formbook
4.1
v93r
labourcommunitymarket.com
nba82.com
datahabitsales.site
rosstony.link
baliorganic.farm
qefhyjngrxcbjfvgft.autos
bippttcg.click
tldrschool.com
vcdaawug.click
garage2mats.com
soulrin.store
themezodermacream.com
522fairwaylookout.com
jmhoa.cyou
sygcb.link
thanhpresident.com
biy-home.com
imtmlife.online
dijitalpasaj.app
105261.com
wyldnwestern.com
risefootwear.com
bbmusic906.com
unsold-laptops-seek.today
oixkphfm9oap.xyz
steelyholdings.com
ticket2future.site
vndlsvllns.com
rupashtgai.com
lexpy.xyz
drillingkingtool.com
lkpmekarjaya.com
luoyutao.love
notfrank.tech
calawadvice.com
wpc-rotterdam.com
pttroblox.com
coffeeforsoldiers.com
csshhinm.click
bmsexpert.com
coperworks.com
fengwowuye.com
dariobisogno.com
naturalresourcetrail.com
allupinyourbizness.com
cheapjerseysfreeshipping.store
upgoavvi.click
mynintdndonews.com
zorailabs.com
akonghoki.click
lgoicube.com
rapportus.com
lxdutzuc.click
kradbfkweqd888.com
fbjbk.com
lojaravystore.online
truthistanbul.xyz
ilda.vip
holytoastknox.com
owsspa.com
oyyltyzn.click
pesawat-tempur-3.site
wyxhoo.com
jiahao668.com
myacc.info
Signatures
-
Formbook payload 2 IoCs
resource yara_rule behavioral2/memory/4408-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4408-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4820 set thread context of 4408 4820 rOrderRequirements-Invoice.exe 90 PID 4408 set thread context of 3176 4408 rOrderRequirements-Invoice.exe 69 -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 1028 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4408 rOrderRequirements-Invoice.exe 4408 rOrderRequirements-Invoice.exe 4408 rOrderRequirements-Invoice.exe 4408 rOrderRequirements-Invoice.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 4408 rOrderRequirements-Invoice.exe 4408 rOrderRequirements-Invoice.exe 4408 rOrderRequirements-Invoice.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4408 rOrderRequirements-Invoice.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4820 wrote to memory of 4408 4820 rOrderRequirements-Invoice.exe 90 PID 4820 wrote to memory of 4408 4820 rOrderRequirements-Invoice.exe 90 PID 4820 wrote to memory of 4408 4820 rOrderRequirements-Invoice.exe 90 PID 4820 wrote to memory of 4408 4820 rOrderRequirements-Invoice.exe 90 PID 4820 wrote to memory of 4408 4820 rOrderRequirements-Invoice.exe 90 PID 4820 wrote to memory of 4408 4820 rOrderRequirements-Invoice.exe 90 PID 3176 wrote to memory of 1028 3176 Explorer.EXE 92 PID 3176 wrote to memory of 1028 3176 Explorer.EXE 92 PID 3176 wrote to memory of 1028 3176 Explorer.EXE 92
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4408
-
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Gathers network information
PID:1028
-