Analysis
- max time kernel
149s - max time network
13s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 19:30
Static task
static1
Behavioral task
behavioral1
Sample
invoices0000456_pdf.exe
Resource
win7v20201028
windows7_x64
General
- Target invoices0000456_pdf.exe
- Size 1.5MB
- Sample201109-75avv34l8a
- SHA256 a721e0a8a2daa0d5dee6ff75b846c1dbeb40f697221efb00866e450bea2b391c
- MD5 a891012b787e51aeccb9783a34bdd04c
- SHA1 c99007f4162fb4edf0bd3b45b9e23cc3bbc0e418
- SHA512 3c11f7977dcf47aaa8e880201be68c00bf2d3cdd5982256e089063a55c6fb47bf0b1e7ce2b5050128751ab82e6a51840db3809c7ee30a70050b9c60dee30bf09
- MD5 SHA1 SHA512
Malware Config
Extracted
-
formbook
-
http://www.ulxery.com/b89/
-
davidmoultonmd.com
-
eva.gmbh
-
djhayseed.info
-
lytx8.com
-
buyielectronics.com
-
mcloibc.com
-
westphaliami.net
-
21centuryworklife.com
-
siapngebant.com
-
theharmonicrelease.com
-
jingjing6668.com
-
babelnovels.com
-
robert-holden-lawyer.info
-
miitnlabs.com
-
akademiodev.com
-
mbi-clinic.center
-
bigideasmallworld.com
-
criosaunas.today
-
azusq.com
-
weixinzhenghun.com
-
yx1555.com
-
wicketkick.com
-
postschoolafrica.com
-
hotelfulhadhoo.com
-
gilleshapawa.com
-
ntgva.com
-
banditasamsterdam.com
-
dailyenough.com
-
1r1sixabout.men
-
dsproutslearning.com
-
vavlu.info
-
pusathondabekasi.com
-
swty44111.com
-
mkpcva.com
-
xoegl.info
-
yozu.ltd
-
xn--i7qu7w.net
-
stormerzmusic.com
-
xhk8.com
-
5568dd.com
-
hometownvideoproductions.com
-
assistenz.online
-
athomlife.com
-
haocaiyueli.com
-
learnenglishwithaustralians.com
-
thecoagency.com
-
centuryflight.net
-
gznzzdh.com
-
sprinterslogservices.com
-
cakepbanget.com
-
dheba.com
-
3d9nine.loan
-
innercoregolf.com
-
domotshop.com
-
dxagxyey.com
-
aliqkl.com
-
urliveparty.com
-
xn--rhqq3yvxwj9u.com
-
mirandalaree.com
-
freshgrace.today
-
la-neurotica.com
-
xn--djr002ipya.net
-
softwarenagar.com
-
cancanfun.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral1/memory/1720-0-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/1720-1-0x000000000041B640-mapping.dmp formbook behavioral1/memory/1280-3-0x0000000000000000-mapping.dmp formbook - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 740 set thread context of 1720 740 invoices0000456_pdf.exe 29 PID 1720 set thread context of 1200 1720 dllhost.exe 21 PID 1720 set thread context of 1200 1720 dllhost.exe 21 PID 1280 set thread context of 1200 1280 NAPSTAT.EXE 21 - Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 1720 dllhost.exe 1720 dllhost.exe 1720 dllhost.exe 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 740 invoices0000456_pdf.exe 1720 dllhost.exe 1720 dllhost.exe 1720 dllhost.exe 1720 dllhost.exe 1280 NAPSTAT.EXE 1280 NAPSTAT.EXE - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1720 dllhost.exe Token: SeDebugPrivilege 1280 NAPSTAT.EXE - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 740 invoices0000456_pdf.exe 740 invoices0000456_pdf.exe 740 invoices0000456_pdf.exe 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE - Suspicious use of SendNotifyMessage 7 IoCs
pid Process 740 invoices0000456_pdf.exe 740 invoices0000456_pdf.exe 740 invoices0000456_pdf.exe 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 740 wrote to memory of 1720 740 invoices0000456_pdf.exe 29 PID 740 wrote to memory of 1720 740 invoices0000456_pdf.exe 29 PID 740 wrote to memory of 1720 740 invoices0000456_pdf.exe 29 PID 740 wrote to memory of 1720 740 invoices0000456_pdf.exe 29 PID 740 wrote to memory of 1720 740 invoices0000456_pdf.exe 29 PID 1720 wrote to memory of 1280 1720 dllhost.exe 30 PID 1720 wrote to memory of 1280 1720 dllhost.exe 30 PID 1720 wrote to memory of 1280 1720 dllhost.exe 30 PID 1720 wrote to memory of 1280 1720 dllhost.exe 30 PID 1280 wrote to memory of 1552 1280 NAPSTAT.EXE 31 PID 1280 wrote to memory of 1552 1280 NAPSTAT.EXE 31 PID 1280 wrote to memory of 1552 1280 NAPSTAT.EXE 31 PID 1280 wrote to memory of 1552 1280 NAPSTAT.EXE 31
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\invoices0000456_pdf.exe"C:\Users\Admin\AppData\Local\Temp\invoices0000456_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\SysWOW64\dllhost.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\dllhost.exe"5⤵PID:1552
-
-
-
-