Analysis
- max time kernel
149s - max time network
140s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:49
Static task
static1
Behavioral task
behavioral1
Sample
SPD-P-2995 PKG BOILERS_pdf.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target SPD-P-2995 PKG BOILERS_pdf.exe
- Size 641KB
- Sample201109-77jkd11dqs
- SHA256 be4207b3c6def716919d01b666d9a78243730825f095b30edca4dfdae1f9096f
- MD5 f602dda1b7a23b77158e6971260046cf
- SHA1 0fe9101cf032f492d3eeafe29cf2f205ac28a9a9
- SHA512 d7d82fa4c7ddce9d76e07a6dd7562776f166302af65a54c24a4ae33e0cf6b7594b2040eaa9e39cb9ef80c7d38bc8be3e0ca9a963e47ed4dac13c66fb00396e56
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.chilogae.com/k2w/
Decoy
-
brittanybeck.com
-
idapple.mobi
-
sharoncement.win
-
smerchenko.com
-
citizenssenergygroup.com
-
landhawktactical.com
-
yilingshenghuo.com
-
lifa97.com
-
8160pe.com
-
sf-purify.com
-
bloomingamaizing.com
-
thymeshares.com
-
rainwatercollectionhq.com
-
jaseba.net
-
whoistom.net
-
gn70.com
-
payperclickad.info
-
jessicagorbet.com
-
portlockproperty.com
-
mindset-beratung.com
-
heaven-nutfield.com
-
idpprograms.com
-
norvelfinancialsolutions.com
-
arlingtonyp.com
-
happilyevernordvik.com
-
radyoteleskop.com
-
iphone8adaptoru.com
-
mairie5e.com
-
chiquephotique.net
-
ndilimanitours.com
-
adamthaivn.com
-
tt727.info
-
wyzebuy.com
-
nspkfst.com
-
jasonchenproperties.com
-
cryptoeconomi.com
-
paulsaqueton.com
-
talentgrowthpartners.com
-
thebigandgoodfreeupgrade.win
-
sinfulmodels.com
-
cowrychina.com
-
dongzhengrui.com
-
nationalinvestorinsurance.com
-
kjsemx.men
-
aevenarobotics.com
-
focayasdostukoyu.com
-
1s1fivegrand.men
-
ihbhy.com
-
arenastudio.net
-
thebestregistrars.com
-
deepingcase.com
-
mercyssafechildrenhaven.net
-
www55554008.com
-
catchewtoys.com
-
alexandrievina.com
-
equifaxsecurity2p017.com
-
lg-support.center
-
myweeklyinterest.com
-
nonnysnook.online
-
streetsmartwatch.com
-
lenseapart.com
-
shcom.net
-
atlantique-machine.com
-
yebimama.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/5068-0-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/5068-1-0x000000000041B6C0-mapping.dmp formbook behavioral2/memory/3516-3-0x0000000000000000-mapping.dmp formbook - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\6LG8ATVP = "C:\\Program Files (x86)\\Iobmxmp\\chkdskpf8.exe" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4696 set thread context of 5068 4696 SPD-P-2995 PKG BOILERS_pdf.exe 73 PID 5068 set thread context of 2300 5068 SPD-P-2995 PKG BOILERS_pdf.exe 57 PID 3516 set thread context of 2300 3516 msiexec.exe 57 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Iobmxmp\chkdskpf8.exe msiexec.exe -
description ioc Process Key created \Registry\User\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msiexec.exe - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 4696 SPD-P-2995 PKG BOILERS_pdf.exe 4696 SPD-P-2995 PKG BOILERS_pdf.exe 5068 SPD-P-2995 PKG BOILERS_pdf.exe 5068 SPD-P-2995 PKG BOILERS_pdf.exe 5068 SPD-P-2995 PKG BOILERS_pdf.exe 5068 SPD-P-2995 PKG BOILERS_pdf.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe 3516 msiexec.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 4696 SPD-P-2995 PKG BOILERS_pdf.exe 5068 SPD-P-2995 PKG BOILERS_pdf.exe 5068 SPD-P-2995 PKG BOILERS_pdf.exe 5068 SPD-P-2995 PKG BOILERS_pdf.exe 3516 msiexec.exe 3516 msiexec.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 5068 SPD-P-2995 PKG BOILERS_pdf.exe Token: SeDebugPrivilege 3516 msiexec.exe Token: SeShutdownPrivilege 2300 Explorer.EXE Token: SeCreatePagefilePrivilege 2300 Explorer.EXE Token: SeShutdownPrivilege 2300 Explorer.EXE Token: SeCreatePagefilePrivilege 2300 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2300 Explorer.EXE - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4696 wrote to memory of 5068 4696 SPD-P-2995 PKG BOILERS_pdf.exe 73 PID 4696 wrote to memory of 5068 4696 SPD-P-2995 PKG BOILERS_pdf.exe 73 PID 4696 wrote to memory of 5068 4696 SPD-P-2995 PKG BOILERS_pdf.exe 73 PID 2300 wrote to memory of 3516 2300 Explorer.EXE 76 PID 2300 wrote to memory of 3516 2300 Explorer.EXE 76 PID 2300 wrote to memory of 3516 2300 Explorer.EXE 76 PID 3516 wrote to memory of 4152 3516 msiexec.exe 80 PID 3516 wrote to memory of 4152 3516 msiexec.exe 80 PID 3516 wrote to memory of 4152 3516 msiexec.exe 80
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\SPD-P-2995 PKG BOILERS_pdf.exe"C:\Users\Admin\AppData\Local\Temp\SPD-P-2995 PKG BOILERS_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\SPD-P-2995 PKG BOILERS_pdf.exe"C:\Users\Admin\AppData\Local\Temp\SPD-P-2995 PKG BOILERS_pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:5068
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SPD-P-2995 PKG BOILERS_pdf.exe"3⤵PID:4152
-
-