Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2024 12:56
Static task
static1
Behavioral task
behavioral1
Sample
SALES ORDER875.exe
Resource
win7-20240903-en
windows7-x64
General
-
Target
SALES ORDER875.exe
-
Size
1.3MB
-
MD5
6ac24df0d8b58005679910e42981dbe8
-
SHA1
e421e5241a965e8714d3506dfb0aabc06ee52603
-
SHA256
eb00047a6b0c3483760d36fc53b69398768f28532003f44d0b402052f65bbd24
-
SHA512
6181b4ef3b6850c3fb60bfab6637e0fe80fd13fd14e2c56c8fd4cb25f633950d5c38262566ec3a77563a0aa17c4e5ffee78fe6962992175a5938a275c5488259
-
SSDEEP
24576:MqDEvCTbMWu7rQYlBQcBiT6rprG8a8tqTr5mBln/sKG4K5nwqsPGAAJBl7:MTvC/MTQYxsWR7a8tqhmDn64K5sAV
Malware Config
Extracted
formbook
4.1
ge07
amyard.shop
eloshost.xyz
g18q11a.top
orensic-vendor-735524320.click
ithin-ksvodn.xyz
xhyx.top
elonix-traceglow.pro
cillascrewedsedroth.cfd
wner-nyquh.xyz
reyhazeusa.shop
esmellretaperetotal.cfd
hqm-during.xyz
pipagtxcorrelo.xyz
lray-civil.xyz
apybarameme.xyz
rbuds.shop
hild-fcudh.xyz
rkgexg.top
estwestcottwines.shop
giyztm.xyz
epehr.pics
lways-vhyrp.xyz
acifictechnologycctv.net
iscinddocenaemlynne.cfd
ridesmaidgiftsboutiqueki.shop
ubtleclothingco.fashion
hemicans.xyz
ebaoge318.top
zoc-marriage.xyz
ngeribe2.homes
oal-ahzgwo.xyz
eries-htii.xyz
ool-covers76.xyz
ecurityemployment.today
croom.net
f7y2i9fgm.xyz
earch-lawyer-consultation.today
066iwx2t.shop
ound-omagf.xyz
ivglass.xyz
fdyh-investment.xyz
yegle.net
eader-aaexvn.xyz
dvle-father.xyz
onsfskfsmpfssfpewqdsawqe.xyz
ffect-xedzl.xyz
ood-packaging-jobs-brasil.today
lasterdeals.shop
ehkd.top
pm-22-ns-2.click
ocockbowerlybrawer.cfd
ostcanadantpl.top
vrkof-point.xyz
lsader.app
nce-ystyx.xyz
azl.pro
ea-yogkkb.xyz
isit-txax.xyz
rowadservepros.net
6282.xyz
roduct-xgky.xyz
wner-nyquh.xyz
sfmoreservicesllc.lat
rasko.net
9net88.net
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1416-3-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1416-6-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2588-12-0x0000000000D90000-0x0000000000DBF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
SALES ORDER875.exesvchost.exemstsc.exedescription pid Process procid_target PID 2620 set thread context of 1416 2620 SALES ORDER875.exe 95 PID 1416 set thread context of 3624 1416 svchost.exe 56 PID 2588 set thread context of 3624 2588 mstsc.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
SALES ORDER875.exemstsc.execmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SALES ORDER875.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
svchost.exemstsc.exepid Process 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe 2588 mstsc.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
SALES ORDER875.exesvchost.exemstsc.exepid Process 2620 SALES ORDER875.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 2588 mstsc.exe 2588 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes:
svchost.exemstsc.exeExplorer.EXEdescription pid Process Token: SeDebugPrivilege 1416 svchost.exe Token: SeDebugPrivilege 2588 mstsc.exe Token: SeShutdownPrivilege 3624 Explorer.EXE Token: SeCreatePagefilePrivilege 3624 Explorer.EXE Token: SeShutdownPrivilege 3624 Explorer.EXE Token: SeCreatePagefilePrivilege 3624 Explorer.EXE Token: SeShutdownPrivilege 3624 Explorer.EXE Token: SeCreatePagefilePrivilege 3624 Explorer.EXE Token: SeShutdownPrivilege 3624 Explorer.EXE Token: SeCreatePagefilePrivilege 3624 Explorer.EXE Token: SeShutdownPrivilege 3624 Explorer.EXE Token: SeCreatePagefilePrivilege 3624 Explorer.EXE Token: SeShutdownPrivilege 3624 Explorer.EXE Token: SeCreatePagefilePrivilege 3624 Explorer.EXE Token: SeShutdownPrivilege 3624 Explorer.EXE Token: SeCreatePagefilePrivilege 3624 Explorer.EXE Token: SeShutdownPrivilege 3624 Explorer.EXE Token: SeCreatePagefilePrivilege 3624 Explorer.EXE Token: SeShutdownPrivilege 3624 Explorer.EXE Token: SeCreatePagefilePrivilege 3624 Explorer.EXE Token: SeShutdownPrivilege 3624 Explorer.EXE Token: SeCreatePagefilePrivilege 3624 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid Process 3624 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
SALES ORDER875.exeExplorer.EXEmstsc.exedescription pid Process procid_target PID 2620 wrote to memory of 1416 2620 SALES ORDER875.exe 95 PID 2620 wrote to memory of 1416 2620 SALES ORDER875.exe 95 PID 2620 wrote to memory of 1416 2620 SALES ORDER875.exe 95 PID 2620 wrote to memory of 1416 2620 SALES ORDER875.exe 95 PID 3624 wrote to memory of 2588 3624 Explorer.EXE 96 PID 3624 wrote to memory of 2588 3624 Explorer.EXE 96 PID 3624 wrote to memory of 2588 3624 Explorer.EXE 96 PID 2588 wrote to memory of 4188 2588 mstsc.exe 101 PID 2588 wrote to memory of 4188 2588 mstsc.exe 101 PID 2588 wrote to memory of 4188 2588 mstsc.exe 101
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\SALES ORDER875.exe"C:\Users\Admin\AppData\Local\Temp\SALES ORDER875.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\SALES ORDER875.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1416
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4188
-
-