Analysis
-
max time kernel
145s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
18-07-2024 05:47
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASING ORDER.exe
Resource
win7-20240704-en
General
-
Target
PURCHASING ORDER.exe
-
Size
675KB
-
MD5
033bc3249eab9a82f4238f19acd2c2f7
-
SHA1
d0da905ae01df3db821db23eb6665ffa50bfdec1
-
SHA256
e2fb3e62884d3e10aa6340adc488e37ffb2b15cbfe4842ff4bc7c1c83b908305
-
SHA512
ad9594fb7b26b737a53c42f62f32e06a98a1093a85e0c720acf42c9d100b7d23132b7e4f0adfad136c5b65bbbc0fe419b943de87cd6ae9984370ab00a00ba083
-
SSDEEP
12288:/uTDWx2PQfQmNzLP2P4MUnR2gk85pxXK1He6DsWcDF:/EawMQmNPgwc/8NwDsWcx
Malware Config
Extracted
formbook
4.1
hy08
weazc.top
servoceimmpajhnuz.info
vqemkdhi.xyz
wergol.com
spa-mk.com
rtpsid88.life
tatetits.fun
raidsa.xyz
suojiansuode.net
jointhejunction.com
wudai.net
typeboot.shop
mksport-app.com
miocloud.ovh
taipan77pandan.com
wwwhg58a.com
khuahamiksai31.pro
carpedatumllc.net
safebinders.com
krx21.com
qyld9yp.icu
ischover.com
lineagegenetics.com
breakfreesoar.com
os9user.com
m1rmen.tech
cttlca.click
privacysift.com
gilggak.com
horxncnt.xyz
strategyguys.info
egyptflickcasino.online
5536canoga.com
ilpradio.com
shahgoldentravel.com
autismtour.com
alivioquantico.com
valo.games
manhuafeifei.xyz
bihungoreng22.click
btc158.com
500728.party
hemcksqa.net
agclcdstf460.xyz
flywatchsecurity.com
bedazzledbabe.com
btcrenaissance.net
mavincrm.com
65618.asia
axgventures.com
arelenegrace.com
cryptosmartguide.xyz
bodgion.xyz
21556934.com
cheaplaptops.biz
v2e5g.xyz
yc23w.top
24khome.com
cdncf.xyz
marabudigital.online
3sqre.lol
entgab679y.top
b10a.shop
mekanbahis104.com
avai66.xyz
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2616-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2616-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2616-20-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/700-26-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 544 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
PURCHASING ORDER.exePURCHASING ORDER.exehelp.exedescription pid process target process PID 2732 set thread context of 2616 2732 PURCHASING ORDER.exe PURCHASING ORDER.exe PID 2616 set thread context of 1200 2616 PURCHASING ORDER.exe Explorer.EXE PID 2616 set thread context of 1200 2616 PURCHASING ORDER.exe Explorer.EXE PID 700 set thread context of 1200 700 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
PURCHASING ORDER.exePURCHASING ORDER.exehelp.exepid process 2732 PURCHASING ORDER.exe 2732 PURCHASING ORDER.exe 2732 PURCHASING ORDER.exe 2732 PURCHASING ORDER.exe 2732 PURCHASING ORDER.exe 2732 PURCHASING ORDER.exe 2732 PURCHASING ORDER.exe 2732 PURCHASING ORDER.exe 2616 PURCHASING ORDER.exe 2616 PURCHASING ORDER.exe 2616 PURCHASING ORDER.exe 700 help.exe 700 help.exe 700 help.exe 700 help.exe 700 help.exe 700 help.exe 700 help.exe 700 help.exe 700 help.exe 700 help.exe 700 help.exe 700 help.exe 700 help.exe 700 help.exe 700 help.exe 700 help.exe 700 help.exe 700 help.exe 700 help.exe 700 help.exe 700 help.exe 700 help.exe 700 help.exe 700 help.exe 700 help.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
PURCHASING ORDER.exehelp.exepid process 2616 PURCHASING ORDER.exe 2616 PURCHASING ORDER.exe 2616 PURCHASING ORDER.exe 2616 PURCHASING ORDER.exe 700 help.exe 700 help.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PURCHASING ORDER.exePURCHASING ORDER.exehelp.exedescription pid process Token: SeDebugPrivilege 2732 PURCHASING ORDER.exe Token: SeDebugPrivilege 2616 PURCHASING ORDER.exe Token: SeDebugPrivilege 700 help.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
PURCHASING ORDER.exePURCHASING ORDER.exehelp.exedescription pid process target process PID 2732 wrote to memory of 2708 2732 PURCHASING ORDER.exe PURCHASING ORDER.exe PID 2732 wrote to memory of 2708 2732 PURCHASING ORDER.exe PURCHASING ORDER.exe PID 2732 wrote to memory of 2708 2732 PURCHASING ORDER.exe PURCHASING ORDER.exe PID 2732 wrote to memory of 2708 2732 PURCHASING ORDER.exe PURCHASING ORDER.exe PID 2732 wrote to memory of 2752 2732 PURCHASING ORDER.exe PURCHASING ORDER.exe PID 2732 wrote to memory of 2752 2732 PURCHASING ORDER.exe PURCHASING ORDER.exe PID 2732 wrote to memory of 2752 2732 PURCHASING ORDER.exe PURCHASING ORDER.exe PID 2732 wrote to memory of 2752 2732 PURCHASING ORDER.exe PURCHASING ORDER.exe PID 2732 wrote to memory of 2624 2732 PURCHASING ORDER.exe PURCHASING ORDER.exe PID 2732 wrote to memory of 2624 2732 PURCHASING ORDER.exe PURCHASING ORDER.exe PID 2732 wrote to memory of 2624 2732 PURCHASING ORDER.exe PURCHASING ORDER.exe PID 2732 wrote to memory of 2624 2732 PURCHASING ORDER.exe PURCHASING ORDER.exe PID 2732 wrote to memory of 2868 2732 PURCHASING ORDER.exe PURCHASING ORDER.exe PID 2732 wrote to memory of 2868 2732 PURCHASING ORDER.exe PURCHASING ORDER.exe PID 2732 wrote to memory of 2868 2732 PURCHASING ORDER.exe PURCHASING ORDER.exe PID 2732 wrote to memory of 2868 2732 PURCHASING ORDER.exe PURCHASING ORDER.exe PID 2732 wrote to memory of 2616 2732 PURCHASING ORDER.exe PURCHASING ORDER.exe PID 2732 wrote to memory of 2616 2732 PURCHASING ORDER.exe PURCHASING ORDER.exe PID 2732 wrote to memory of 2616 2732 PURCHASING ORDER.exe PURCHASING ORDER.exe PID 2732 wrote to memory of 2616 2732 PURCHASING ORDER.exe PURCHASING ORDER.exe PID 2732 wrote to memory of 2616 2732 PURCHASING ORDER.exe PURCHASING ORDER.exe PID 2732 wrote to memory of 2616 2732 PURCHASING ORDER.exe PURCHASING ORDER.exe PID 2732 wrote to memory of 2616 2732 PURCHASING ORDER.exe PURCHASING ORDER.exe PID 2616 wrote to memory of 700 2616 PURCHASING ORDER.exe help.exe PID 2616 wrote to memory of 700 2616 PURCHASING ORDER.exe help.exe PID 2616 wrote to memory of 700 2616 PURCHASING ORDER.exe help.exe PID 2616 wrote to memory of 700 2616 PURCHASING ORDER.exe help.exe PID 700 wrote to memory of 544 700 help.exe cmd.exe PID 700 wrote to memory of 544 700 help.exe cmd.exe PID 700 wrote to memory of 544 700 help.exe cmd.exe PID 700 wrote to memory of 544 700 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\PURCHASING ORDER.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASING ORDER.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\PURCHASING ORDER.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASING ORDER.exe"3⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\PURCHASING ORDER.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASING ORDER.exe"3⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\PURCHASING ORDER.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASING ORDER.exe"3⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\PURCHASING ORDER.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASING ORDER.exe"3⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\PURCHASING ORDER.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASING ORDER.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PURCHASING ORDER.exe"5⤵
- Deletes itself
PID:544