Analysis
- max time kernel
149s - max time network
122s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 20:54
Static task
static1
Behavioral task
behavioral1
Sample
435543455434554_pdf.exe
Resource
win7v20201028
windows7_x64
General
- Target 435543455434554_pdf.exe
- Size 296KB
- Sample201109-ms7t6c7pmx
- SHA256 c3eee37f03d307023521890718302eb2f9ba7d4ec465a1f10c7e9d408ceddc3b
- MD5 3c0c0ba52da81b9087b5e053f7ffb68b
- SHA1 652bfed4cef60a257812883130a9ecaeb52f7c4b
- SHA512 de8e4483013d2349bcf465f7aea138901c688acfd69992768f4daf036e4c102ad199deed4313b1fc2b746315d4495ddcc837f71e45321ad71444eb336202b43c
- MD5 SHA1 SHA512
Malware Config
Extracted
-
formbook
-
http://www.spatren.com/sr2/
-
uav-zenlink.com
-
taishixxx.com
-
happynews247.com
-
growlushlocks.com
-
infreegames.com
-
elisabethfogarty.net
-
mainhattancarclub.com
-
mihama-csw.com
-
bladeandsouls.com
-
kyoto-town.com
-
tidalroyaltycorp.com
-
euromailz.com
-
storeintelligynce.com
-
mericalgun.com
-
hemisphere-app.net
-
smartshoppers.store
-
vladskaletsky.photos
-
techvetjunior.com
-
typicalmaneuver.com
-
homenall.com
-
coantemugle.com
-
documentupdate.com
-
stayfreevegas.com
-
hartlandpoloclassic.net
-
prophait.com
-
cookingwithmalin.com
-
juvamidin.com
-
koodakplaza.com
-
osmacau.com
-
thegioicamera2.com
-
ynnkyy.com
-
nataliegarces.com
-
esportsweekly.review
-
wwwxpj222333.com
-
2-sweet.com
-
xingdonggan.com
-
creationmuseumforkids.com
-
wild-coin.com
-
taipan.cool
-
suamaytinhtannoihcm.info
-
qahbkj.com
-
smart-factorys.net
-
languimage.net
-
yameimojiegou.com
-
mrwinston.net
-
rohankhandelwal.com
-
116156.com
-
thecoachhousedouglas.com
-
theatpgroupinc.net
-
epicconcreteflooring.com
-
a5678.net
-
916am8.com
-
aegwo.info
-
pythoninfosec.com
-
jinbeiyouxiw.com
-
greenalabama.win
-
finddianji.com
-
tongtiejiche.com
-
minersgroup.com
-
hmdanewventures.com
-
startupworldcup.biz
-
cottoncandystudios.com
-
gqproup.download
-
chbl-machinery.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral1/memory/1396-1-0x000000000041E300-mapping.dmp formbook behavioral1/memory/1396-0-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/1376-2-0x0000000000000000-mapping.dmp formbook - Deletes itself 1 IoCs
pid Process 1580 cmd.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1704 set thread context of 1396 1704 435543455434554_pdf.exe 29 PID 1396 set thread context of 1280 1396 435543455434554_pdf.exe 21 PID 1376 set thread context of 1280 1376 cmstp.exe 21 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 1704 435543455434554_pdf.exe 1704 435543455434554_pdf.exe 1396 435543455434554_pdf.exe 1396 435543455434554_pdf.exe 1376 cmstp.exe 1376 cmstp.exe 1376 cmstp.exe 1376 cmstp.exe 1376 cmstp.exe 1376 cmstp.exe 1376 cmstp.exe 1376 cmstp.exe 1376 cmstp.exe 1376 cmstp.exe 1376 cmstp.exe 1376 cmstp.exe 1376 cmstp.exe 1376 cmstp.exe 1376 cmstp.exe 1376 cmstp.exe 1376 cmstp.exe 1376 cmstp.exe 1376 cmstp.exe 1376 cmstp.exe 1376 cmstp.exe 1376 cmstp.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1396 435543455434554_pdf.exe 1396 435543455434554_pdf.exe 1396 435543455434554_pdf.exe 1376 cmstp.exe 1376 cmstp.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1704 435543455434554_pdf.exe Token: SeDebugPrivilege 1396 435543455434554_pdf.exe Token: SeDebugPrivilege 1376 cmstp.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1704 wrote to memory of 1396 1704 435543455434554_pdf.exe 29 PID 1704 wrote to memory of 1396 1704 435543455434554_pdf.exe 29 PID 1704 wrote to memory of 1396 1704 435543455434554_pdf.exe 29 PID 1704 wrote to memory of 1396 1704 435543455434554_pdf.exe 29 PID 1704 wrote to memory of 1396 1704 435543455434554_pdf.exe 29 PID 1704 wrote to memory of 1396 1704 435543455434554_pdf.exe 29 PID 1704 wrote to memory of 1396 1704 435543455434554_pdf.exe 29 PID 1280 wrote to memory of 1376 1280 Explorer.EXE 30 PID 1280 wrote to memory of 1376 1280 Explorer.EXE 30 PID 1280 wrote to memory of 1376 1280 Explorer.EXE 30 PID 1280 wrote to memory of 1376 1280 Explorer.EXE 30 PID 1280 wrote to memory of 1376 1280 Explorer.EXE 30 PID 1280 wrote to memory of 1376 1280 Explorer.EXE 30 PID 1280 wrote to memory of 1376 1280 Explorer.EXE 30 PID 1376 wrote to memory of 1580 1376 cmstp.exe 31 PID 1376 wrote to memory of 1580 1376 cmstp.exe 31 PID 1376 wrote to memory of 1580 1376 cmstp.exe 31 PID 1376 wrote to memory of 1580 1376 cmstp.exe 31
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\435543455434554_pdf.exe"C:\Users\Admin\AppData\Local\Temp\435543455434554_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\435543455434554_pdf.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1396
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\435543455434554_pdf.exe"3⤵
- Deletes itself
PID:1580
-
-