Analysis
- max time kernel
147s - max time network
135s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:18
Static task
static1
Behavioral task
behavioral1
Sample
Scan_02_06_20_pdf.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target Scan_02_06_20_pdf.exe
- Size 318KB
- Sample201109-xht22lmn82
- SHA256 5da7735fc8be010eaed89e5776cabe530402d4c6d0c6e5c5de515f12e05081f8
- MD5 740019072c172c397faf1d9cf47343a9
- SHA1 0476f4cb003be46d3627fa4b475a71302269682d
- SHA512 a3f46158b3dab3c30f7b8cdb8f25340d54cc92b4a6ea42075b28f7e26ce9f5cc05d1da70e3cc5f76d654d96b8e21b82c3730664fd2a5efa614b839d0004821a1
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.masionlex.info/0nhx/
Decoy
-
responsibilitiesproblema.com
-
myessentialsp.com
-
hcobt.info
-
4kf30otas.biz
-
guideyourtrips.com
-
socoolgift.com
-
intetoken.com
-
mitchellhealthandwellness.com
-
mdd-007.com
-
jeehyung.com
-
moretrhantech.com
-
cebraenergy.com
-
blastgammon.com
-
reparox.com
-
eieieiei00.com
-
formafato.com
-
frontedgethinktank.group
-
allblingbelts.com
-
mangasyuri.net
-
wanghinghoi.net
-
t-q.ink
-
evidentradio.com
-
cocktailwifi.com
-
risperidonesideeffects.com
-
your-dsign.com
-
lapetconcierge.com
-
lightrealmtherapy.net
-
cravoury.com
-
xincaicaipiao.biz
-
lamartrace.com
-
hipcute.com
-
ferienwohnung-monstay.com
-
businessimpactformula.com
-
plzcompletewellsfargoasap.com
-
chongthamnghean.net
-
dkurtovic.com
-
6970pe.com
-
rouzhi.net
-
plus-pln.com
-
ehmi.ltd
-
southitaly.biz
-
lightningnetworksweets.com
-
sunflowerenergy.net
-
sbnyacht.com
-
voice2letter.net
-
valmet-group.com
-
eventsmena.com
-
servemining.com
-
xn--ob0bv49d.com
-
indiaflash.com
-
tablyrics.com
-
man347.com
-
rodeoplastic.com
-
cellulitelos.biz
-
play-site.com
-
schoenezeit-reisen.com
-
haydendawes.net
-
number6enterprises.com
-
com-iv.com
-
xn--7br795e.com
-
flc293.com
-
specdapp.com
-
xiuxiuchat.com
-
sethmessner.net
Signatures
- Formbook Payload 1 IoCs
resource yara_rule behavioral2/memory/3960-0-0x0000000000000000-mapping.dmp formbook - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run ipconfig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EJNHSPEXOX = "C:\\Program Files (x86)\\Ncfq\\jbcd2dehzlzp.exe" ipconfig.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3408 set thread context of 3116 3408 Scan_02_06_20_pdf.exe 58 PID 3408 set thread context of 3116 3408 Scan_02_06_20_pdf.exe 58 PID 3960 set thread context of 3116 3960 ipconfig.exe 58 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Ncfq\jbcd2dehzlzp.exe ipconfig.exe - Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 3960 ipconfig.exe -
description ioc Process Key created \Registry\User\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 ipconfig.exe - Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 3408 Scan_02_06_20_pdf.exe 3408 Scan_02_06_20_pdf.exe 3408 Scan_02_06_20_pdf.exe 3408 Scan_02_06_20_pdf.exe 3408 Scan_02_06_20_pdf.exe 3408 Scan_02_06_20_pdf.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe - Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 3408 Scan_02_06_20_pdf.exe 3408 Scan_02_06_20_pdf.exe 3408 Scan_02_06_20_pdf.exe 3408 Scan_02_06_20_pdf.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe 3960 ipconfig.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 3408 Scan_02_06_20_pdf.exe Token: SeShutdownPrivilege 3116 Explorer.EXE Token: SeCreatePagefilePrivilege 3116 Explorer.EXE Token: SeDebugPrivilege 3960 ipconfig.exe Token: SeShutdownPrivilege 3116 Explorer.EXE Token: SeCreatePagefilePrivilege 3116 Explorer.EXE Token: SeShutdownPrivilege 3116 Explorer.EXE Token: SeCreatePagefilePrivilege 3116 Explorer.EXE Token: SeShutdownPrivilege 3116 Explorer.EXE Token: SeCreatePagefilePrivilege 3116 Explorer.EXE Token: SeShutdownPrivilege 3116 Explorer.EXE Token: SeCreatePagefilePrivilege 3116 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3116 Explorer.EXE - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3116 wrote to memory of 3960 3116 Explorer.EXE 79 PID 3116 wrote to memory of 3960 3116 Explorer.EXE 79 PID 3116 wrote to memory of 3960 3116 Explorer.EXE 79 PID 3960 wrote to memory of 4044 3960 ipconfig.exe 80 PID 3960 wrote to memory of 4044 3960 ipconfig.exe 80 PID 3960 wrote to memory of 4044 3960 ipconfig.exe 80 PID 3960 wrote to memory of 4072 3960 ipconfig.exe 82 PID 3960 wrote to memory of 4072 3960 ipconfig.exe 82 PID 3960 wrote to memory of 4072 3960 ipconfig.exe 82
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\Scan_02_06_20_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Scan_02_06_20_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3408
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Gathers network information
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Scan_02_06_20_pdf.exe"3⤵PID:4044
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:4072
-
-