Analysis
- max time kernel
149s - max time network
145s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
31/10/2024, 10:04
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
PURCHASE ORDER085.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
- Target PURCHASE ORDER085.exe
- Size 1.1MB
- Sample241031-l3ydcsvkav
- SHA256 7536fe232219ea4914869d8fa0342284615bd434eaa028239deb355b16067e69
- MD5 a9f1ed7bb8e8ce70f8598689ee961ff0
- SHA1 904ff7477dc325b9344b3d3146462fc198d015f2
- SHA512 5eaecd64d6a3b11a397fabaee6d6bd728f6db9962f0746f32f79211a7be662efb1c1750e82b6124cc25614c408067b51c27a46cda9b617631d2f09354c6e4596
- SSDEEP 24576:ffmMv6Ckr7Mny5QLaX/c6dJYkcRpiBaLfQnRUNwq:f3v+7/5QLaXE6dmZDmS
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
ge07
Decoy
-
amyard.shop
-
eloshost.xyz
-
g18q11a.top
-
orensic-vendor-735524320.click
-
ithin-ksvodn.xyz
-
xhyx.top
-
elonix-traceglow.pro
-
cillascrewedsedroth.cfd
-
wner-nyquh.xyz
-
reyhazeusa.shop
-
esmellretaperetotal.cfd
-
hqm-during.xyz
-
pipagtxcorrelo.xyz
-
lray-civil.xyz
-
apybarameme.xyz
-
rbuds.shop
-
hild-fcudh.xyz
-
rkgexg.top
-
estwestcottwines.shop
-
giyztm.xyz
-
epehr.pics
-
lways-vhyrp.xyz
-
acifictechnologycctv.net
-
iscinddocenaemlynne.cfd
-
ridesmaidgiftsboutiqueki.shop
-
ubtleclothingco.fashion
-
hemicans.xyz
-
ebaoge318.top
-
zoc-marriage.xyz
-
ngeribe2.homes
-
oal-ahzgwo.xyz
-
eries-htii.xyz
-
ool-covers76.xyz
-
ecurityemployment.today
-
croom.net
-
f7y2i9fgm.xyz
-
earch-lawyer-consultation.today
-
066iwx2t.shop
-
ound-omagf.xyz
-
ivglass.xyz
-
fdyh-investment.xyz
-
yegle.net
-
eader-aaexvn.xyz
-
dvle-father.xyz
-
onsfskfsmpfssfpewqdsawqe.xyz
-
ffect-xedzl.xyz
-
ood-packaging-jobs-brasil.today
-
lasterdeals.shop
-
ehkd.top
-
pm-22-ns-2.click
-
ocockbowerlybrawer.cfd
-
ostcanadantpl.top
-
vrkof-point.xyz
-
lsader.app
-
nce-ystyx.xyz
-
azl.pro
-
ea-yogkkb.xyz
-
isit-txax.xyz
-
rowadservepros.net
-
6282.xyz
-
roduct-xgky.xyz
-
wner-nyquh.xyz
-
sfmoreservicesllc.lat
-
rasko.net
-
9net88.net
Signatures
- Formbook family
- Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/600-3-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/600-6-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2820-11-0x0000000000080000-0x00000000000AF000-memory.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1848 set thread context of 600 1848 PURCHASE ORDER085.exe 31 PID 600 set thread context of 1188 600 svchost.exe 21 PID 2820 set thread context of 1188 2820 raserver.exe 21 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PURCHASE ORDER085.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language raserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 600 svchost.exe 600 svchost.exe 2820 raserver.exe 2820 raserver.exe 2820 raserver.exe 2820 raserver.exe 2820 raserver.exe 2820 raserver.exe 2820 raserver.exe 2820 raserver.exe 2820 raserver.exe 2820 raserver.exe 2820 raserver.exe 2820 raserver.exe 2820 raserver.exe 2820 raserver.exe 2820 raserver.exe 2820 raserver.exe 2820 raserver.exe 2820 raserver.exe 2820 raserver.exe 2820 raserver.exe 2820 raserver.exe 2820 raserver.exe 2820 raserver.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1848 PURCHASE ORDER085.exe 600 svchost.exe 600 svchost.exe 600 svchost.exe 2820 raserver.exe 2820 raserver.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 600 svchost.exe Token: SeDebugPrivilege 2820 raserver.exe - Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1188 Explorer.EXE 1188 Explorer.EXE - Suspicious use of SendNotifyMessage 46 IoCs
pid Process 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe 1848 PURCHASE ORDER085.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1848 wrote to memory of 600 1848 PURCHASE ORDER085.exe 31 PID 1848 wrote to memory of 600 1848 PURCHASE ORDER085.exe 31 PID 1848 wrote to memory of 600 1848 PURCHASE ORDER085.exe 31 PID 1848 wrote to memory of 600 1848 PURCHASE ORDER085.exe 31 PID 1848 wrote to memory of 600 1848 PURCHASE ORDER085.exe 31 PID 1188 wrote to memory of 2820 1188 Explorer.EXE 32 PID 1188 wrote to memory of 2820 1188 Explorer.EXE 32 PID 1188 wrote to memory of 2820 1188 Explorer.EXE 32 PID 1188 wrote to memory of 2820 1188 Explorer.EXE 32 PID 2820 wrote to memory of 3040 2820 raserver.exe 33 PID 2820 wrote to memory of 3040 2820 raserver.exe 33 PID 2820 wrote to memory of 3040 2820 raserver.exe 33 PID 2820 wrote to memory of 3040 2820 raserver.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER085.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER085.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER085.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:600
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3040
-
-