Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
31/10/2024, 10:04
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
PURCHASE ORDER085.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
- Target PURCHASE ORDER085.exe
- Size 1.1MB
- Sample241031-l3ydcsvkav
- SHA256 7536fe232219ea4914869d8fa0342284615bd434eaa028239deb355b16067e69
- MD5 a9f1ed7bb8e8ce70f8598689ee961ff0
- SHA1 904ff7477dc325b9344b3d3146462fc198d015f2
- SHA512 5eaecd64d6a3b11a397fabaee6d6bd728f6db9962f0746f32f79211a7be662efb1c1750e82b6124cc25614c408067b51c27a46cda9b617631d2f09354c6e4596
- SSDEEP 24576:ffmMv6Ckr7Mny5QLaX/c6dJYkcRpiBaLfQnRUNwq:f3v+7/5QLaXE6dmZDmS
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
ge07
Decoy
-
amyard.shop
-
eloshost.xyz
-
g18q11a.top
-
orensic-vendor-735524320.click
-
ithin-ksvodn.xyz
-
xhyx.top
-
elonix-traceglow.pro
-
cillascrewedsedroth.cfd
-
wner-nyquh.xyz
-
reyhazeusa.shop
-
esmellretaperetotal.cfd
-
hqm-during.xyz
-
pipagtxcorrelo.xyz
-
lray-civil.xyz
-
apybarameme.xyz
-
rbuds.shop
-
hild-fcudh.xyz
-
rkgexg.top
-
estwestcottwines.shop
-
giyztm.xyz
-
epehr.pics
-
lways-vhyrp.xyz
-
acifictechnologycctv.net
-
iscinddocenaemlynne.cfd
-
ridesmaidgiftsboutiqueki.shop
-
ubtleclothingco.fashion
-
hemicans.xyz
-
ebaoge318.top
-
zoc-marriage.xyz
-
ngeribe2.homes
-
oal-ahzgwo.xyz
-
eries-htii.xyz
-
ool-covers76.xyz
-
ecurityemployment.today
-
croom.net
-
f7y2i9fgm.xyz
-
earch-lawyer-consultation.today
-
066iwx2t.shop
-
ound-omagf.xyz
-
ivglass.xyz
-
fdyh-investment.xyz
-
yegle.net
-
eader-aaexvn.xyz
-
dvle-father.xyz
-
onsfskfsmpfssfpewqdsawqe.xyz
-
ffect-xedzl.xyz
-
ood-packaging-jobs-brasil.today
-
lasterdeals.shop
-
ehkd.top
-
pm-22-ns-2.click
-
ocockbowerlybrawer.cfd
-
ostcanadantpl.top
-
vrkof-point.xyz
-
lsader.app
-
nce-ystyx.xyz
-
azl.pro
-
ea-yogkkb.xyz
-
isit-txax.xyz
-
rowadservepros.net
-
6282.xyz
-
roduct-xgky.xyz
-
wner-nyquh.xyz
-
sfmoreservicesllc.lat
-
rasko.net
-
9net88.net
Signatures
- Formbook family
- Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/2376-3-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2376-6-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1824-12-0x0000000000800000-0x000000000082F000-memory.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 5036 set thread context of 2376 5036 PURCHASE ORDER085.exe 94 PID 2376 set thread context of 3356 2376 svchost.exe 55 PID 1824 set thread context of 3356 1824 wlanext.exe 55 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PURCHASE ORDER085.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wlanext.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 2376 svchost.exe 2376 svchost.exe 2376 svchost.exe 2376 svchost.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe 1824 wlanext.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 5036 PURCHASE ORDER085.exe 2376 svchost.exe 2376 svchost.exe 2376 svchost.exe 1824 wlanext.exe 1824 wlanext.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2376 svchost.exe Token: SeDebugPrivilege 1824 wlanext.exe - Suspicious use of FindShellTrayWindow 31 IoCs
pid Process 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe - Suspicious use of SendNotifyMessage 31 IoCs
pid Process 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe 5036 PURCHASE ORDER085.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3356 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 5036 wrote to memory of 2376 5036 PURCHASE ORDER085.exe 94 PID 5036 wrote to memory of 2376 5036 PURCHASE ORDER085.exe 94 PID 5036 wrote to memory of 2376 5036 PURCHASE ORDER085.exe 94 PID 5036 wrote to memory of 2376 5036 PURCHASE ORDER085.exe 94 PID 3356 wrote to memory of 1824 3356 Explorer.EXE 95 PID 3356 wrote to memory of 1824 3356 Explorer.EXE 95 PID 3356 wrote to memory of 1824 3356 Explorer.EXE 95 PID 1824 wrote to memory of 1868 1824 wlanext.exe 96 PID 1824 wrote to memory of 1868 1824 wlanext.exe 96 PID 1824 wrote to memory of 1868 1824 wlanext.exe 96
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER085.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER085.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER085.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2376
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1868
-
-