Analysis
-
max time kernel
146s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-10-2024 13:49
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE ORDER_xl.exe
Resource
win7-20240903-en
windows7-x64
General
-
Target
PURCHASE ORDER_xl.exe
-
Size
1.3MB
-
MD5
dc43665b900f0f30bee8aca7505a4c08
-
SHA1
3e45224d1f0e65c09f741a83591633011b3c0ee0
-
SHA256
a6f25510b6ad94bc18be6ea38eca643236fc194050516df66cafc93859079f63
-
SHA512
76045c4d51dfe7d8755eec14e96dbabf97575e4bcff57747b82abb9a740662c1bfb35a59a96a9e55483d89c61f537c6590b6f23c03de5ff162812ff8a6e19115
-
SSDEEP
24576:cqDEvCTbMWu7rQYlBQcBiT6rprG8awE4lEyDH3gVyeqaGXtVVo:cTvC/MTQYxsWR7awoyDH3gselGXt/
Malware Config
Extracted
formbook
4.1
ge07
amyard.shop
eloshost.xyz
g18q11a.top
orensic-vendor-735524320.click
ithin-ksvodn.xyz
xhyx.top
elonix-traceglow.pro
cillascrewedsedroth.cfd
wner-nyquh.xyz
reyhazeusa.shop
esmellretaperetotal.cfd
hqm-during.xyz
pipagtxcorrelo.xyz
lray-civil.xyz
apybarameme.xyz
rbuds.shop
hild-fcudh.xyz
rkgexg.top
estwestcottwines.shop
giyztm.xyz
epehr.pics
lways-vhyrp.xyz
acifictechnologycctv.net
iscinddocenaemlynne.cfd
ridesmaidgiftsboutiqueki.shop
ubtleclothingco.fashion
hemicans.xyz
ebaoge318.top
zoc-marriage.xyz
ngeribe2.homes
oal-ahzgwo.xyz
eries-htii.xyz
ool-covers76.xyz
ecurityemployment.today
croom.net
f7y2i9fgm.xyz
earch-lawyer-consultation.today
066iwx2t.shop
ound-omagf.xyz
ivglass.xyz
fdyh-investment.xyz
yegle.net
eader-aaexvn.xyz
dvle-father.xyz
onsfskfsmpfssfpewqdsawqe.xyz
ffect-xedzl.xyz
ood-packaging-jobs-brasil.today
lasterdeals.shop
ehkd.top
pm-22-ns-2.click
ocockbowerlybrawer.cfd
ostcanadantpl.top
vrkof-point.xyz
lsader.app
nce-ystyx.xyz
azl.pro
ea-yogkkb.xyz
isit-txax.xyz
rowadservepros.net
6282.xyz
roduct-xgky.xyz
wner-nyquh.xyz
sfmoreservicesllc.lat
rasko.net
9net88.net
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/872-3-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/872-6-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1232-11-0x0000000000940000-0x000000000096F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PURCHASE ORDER_xl.exesvchost.execontrol.exedescription pid Process procid_target PID 224 set thread context of 872 224 PURCHASE ORDER_xl.exe 92 PID 872 set thread context of 3428 872 svchost.exe 55 PID 1232 set thread context of 3428 1232 control.exe 55 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exePURCHASE ORDER_xl.execontrol.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PURCHASE ORDER_xl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language control.exe -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
svchost.execontrol.exepid Process 872 svchost.exe 872 svchost.exe 872 svchost.exe 872 svchost.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
PURCHASE ORDER_xl.exesvchost.execontrol.exepid Process 224 PURCHASE ORDER_xl.exe 872 svchost.exe 872 svchost.exe 872 svchost.exe 1232 control.exe 1232 control.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.execontrol.exeExplorer.EXEdescription pid Process Token: SeDebugPrivilege 872 svchost.exe Token: SeDebugPrivilege 1232 control.exe Token: SeShutdownPrivilege 3428 Explorer.EXE Token: SeCreatePagefilePrivilege 3428 Explorer.EXE Token: SeShutdownPrivilege 3428 Explorer.EXE Token: SeCreatePagefilePrivilege 3428 Explorer.EXE -
Suspicious use of FindShellTrayWindow 13 IoCs
Processes:
PURCHASE ORDER_xl.exepid Process 224 PURCHASE ORDER_xl.exe 224 PURCHASE ORDER_xl.exe 224 PURCHASE ORDER_xl.exe 224 PURCHASE ORDER_xl.exe 224 PURCHASE ORDER_xl.exe 224 PURCHASE ORDER_xl.exe 224 PURCHASE ORDER_xl.exe 224 PURCHASE ORDER_xl.exe 224 PURCHASE ORDER_xl.exe 224 PURCHASE ORDER_xl.exe 224 PURCHASE ORDER_xl.exe 224 PURCHASE ORDER_xl.exe 224 PURCHASE ORDER_xl.exe -
Suspicious use of SendNotifyMessage 13 IoCs
Processes:
PURCHASE ORDER_xl.exepid Process 224 PURCHASE ORDER_xl.exe 224 PURCHASE ORDER_xl.exe 224 PURCHASE ORDER_xl.exe 224 PURCHASE ORDER_xl.exe 224 PURCHASE ORDER_xl.exe 224 PURCHASE ORDER_xl.exe 224 PURCHASE ORDER_xl.exe 224 PURCHASE ORDER_xl.exe 224 PURCHASE ORDER_xl.exe 224 PURCHASE ORDER_xl.exe 224 PURCHASE ORDER_xl.exe 224 PURCHASE ORDER_xl.exe 224 PURCHASE ORDER_xl.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid Process 3428 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
PURCHASE ORDER_xl.exeExplorer.EXEcontrol.exedescription pid Process procid_target PID 224 wrote to memory of 872 224 PURCHASE ORDER_xl.exe 92 PID 224 wrote to memory of 872 224 PURCHASE ORDER_xl.exe 92 PID 224 wrote to memory of 872 224 PURCHASE ORDER_xl.exe 92 PID 224 wrote to memory of 872 224 PURCHASE ORDER_xl.exe 92 PID 3428 wrote to memory of 1232 3428 Explorer.EXE 93 PID 3428 wrote to memory of 1232 3428 Explorer.EXE 93 PID 3428 wrote to memory of 1232 3428 Explorer.EXE 93 PID 1232 wrote to memory of 3344 1232 control.exe 96 PID 1232 wrote to memory of 3344 1232 control.exe 96 PID 1232 wrote to memory of 3344 1232 control.exe 96
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER_xl.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER_xl.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER_xl.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:872
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3344
-
-