Analysis
- max time kernel
150s - max time network
131s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:54
Static task
static1
Behavioral task
behavioral1
Sample
435543455434554_pdf.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 435543455434554_pdf.exe
- Size 296KB
- Sample201109-ms7t6c7pmx
- SHA256 c3eee37f03d307023521890718302eb2f9ba7d4ec465a1f10c7e9d408ceddc3b
- MD5 3c0c0ba52da81b9087b5e053f7ffb68b
- SHA1 652bfed4cef60a257812883130a9ecaeb52f7c4b
- SHA512 de8e4483013d2349bcf465f7aea138901c688acfd69992768f4daf036e4c102ad199deed4313b1fc2b746315d4495ddcc837f71e45321ad71444eb336202b43c
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.spatren.com/sr2/
Decoy
-
uav-zenlink.com
-
taishixxx.com
-
happynews247.com
-
growlushlocks.com
-
infreegames.com
-
elisabethfogarty.net
-
mainhattancarclub.com
-
mihama-csw.com
-
bladeandsouls.com
-
kyoto-town.com
-
tidalroyaltycorp.com
-
euromailz.com
-
storeintelligynce.com
-
mericalgun.com
-
hemisphere-app.net
-
smartshoppers.store
-
vladskaletsky.photos
-
techvetjunior.com
-
typicalmaneuver.com
-
homenall.com
-
coantemugle.com
-
documentupdate.com
-
stayfreevegas.com
-
hartlandpoloclassic.net
-
prophait.com
-
cookingwithmalin.com
-
juvamidin.com
-
koodakplaza.com
-
osmacau.com
-
thegioicamera2.com
-
ynnkyy.com
-
nataliegarces.com
-
esportsweekly.review
-
wwwxpj222333.com
-
2-sweet.com
-
xingdonggan.com
-
creationmuseumforkids.com
-
wild-coin.com
-
taipan.cool
-
suamaytinhtannoihcm.info
-
qahbkj.com
-
smart-factorys.net
-
languimage.net
-
yameimojiegou.com
-
mrwinston.net
-
rohankhandelwal.com
-
116156.com
-
thecoachhousedouglas.com
-
theatpgroupinc.net
-
epicconcreteflooring.com
-
a5678.net
-
916am8.com
-
aegwo.info
-
pythoninfosec.com
-
jinbeiyouxiw.com
-
greenalabama.win
-
finddianji.com
-
tongtiejiche.com
-
minersgroup.com
-
hmdanewventures.com
-
startupworldcup.biz
-
cottoncandystudios.com
-
gqproup.download
-
chbl-machinery.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/1932-0-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/1932-1-0x000000000041E300-mapping.dmp formbook behavioral2/memory/2708-2-0x0000000000000000-mapping.dmp formbook - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run colorcpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\U2RHZFEP = "C:\\Program Files (x86)\\K9rlpw\\t8otoodd0hbhx.exe" colorcpl.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 796 set thread context of 1932 796 435543455434554_pdf.exe 79 PID 1932 set thread context of 2756 1932 435543455434554_pdf.exe 57 PID 2708 set thread context of 2756 2708 colorcpl.exe 57 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\K9rlpw\t8otoodd0hbhx.exe colorcpl.exe -
description ioc Process Key created \Registry\User\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 colorcpl.exe - Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 796 435543455434554_pdf.exe 796 435543455434554_pdf.exe 796 435543455434554_pdf.exe 796 435543455434554_pdf.exe 796 435543455434554_pdf.exe 1932 435543455434554_pdf.exe 1932 435543455434554_pdf.exe 1932 435543455434554_pdf.exe 1932 435543455434554_pdf.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1932 435543455434554_pdf.exe 1932 435543455434554_pdf.exe 1932 435543455434554_pdf.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe 2708 colorcpl.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 796 435543455434554_pdf.exe Token: SeDebugPrivilege 1932 435543455434554_pdf.exe Token: SeDebugPrivilege 2708 colorcpl.exe Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2756 Explorer.EXE - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 796 wrote to memory of 2208 796 435543455434554_pdf.exe 78 PID 796 wrote to memory of 2208 796 435543455434554_pdf.exe 78 PID 796 wrote to memory of 2208 796 435543455434554_pdf.exe 78 PID 796 wrote to memory of 1932 796 435543455434554_pdf.exe 79 PID 796 wrote to memory of 1932 796 435543455434554_pdf.exe 79 PID 796 wrote to memory of 1932 796 435543455434554_pdf.exe 79 PID 796 wrote to memory of 1932 796 435543455434554_pdf.exe 79 PID 796 wrote to memory of 1932 796 435543455434554_pdf.exe 79 PID 796 wrote to memory of 1932 796 435543455434554_pdf.exe 79 PID 2756 wrote to memory of 2708 2756 Explorer.EXE 80 PID 2756 wrote to memory of 2708 2756 Explorer.EXE 80 PID 2756 wrote to memory of 2708 2756 Explorer.EXE 80 PID 2708 wrote to memory of 1540 2708 colorcpl.exe 81 PID 2708 wrote to memory of 1540 2708 colorcpl.exe 81 PID 2708 wrote to memory of 1540 2708 colorcpl.exe 81 PID 2708 wrote to memory of 2060 2708 colorcpl.exe 83 PID 2708 wrote to memory of 2060 2708 colorcpl.exe 83 PID 2708 wrote to memory of 2060 2708 colorcpl.exe 83
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\435543455434554_pdf.exe"C:\Users\Admin\AppData\Local\Temp\435543455434554_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\435543455434554_pdf.exe"{path}"3⤵PID:2208
-
-
C:\Users\Admin\AppData\Local\Temp\435543455434554_pdf.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1932
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\435543455434554_pdf.exe"3⤵PID:1540
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:2060
-
-