Analysis
- max time kernel
148s - max time network
151s - platform
windows10_x64 - resource
win10v20201028 - submitted
08/01/2021, 19:04
Static task
static1
Behavioral task
behavioral1
Sample
Pending PURCHASE ORDER - 47001516.pdf.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target Pending PURCHASE ORDER - 47001516.pdf.exe
- Size 284KB
- Sample210108-p1tljdqv8a
- SHA256 c1a564800071499d39ba2f7e92c403c9ec87ca7837bafd76d00dbe37589c9eb3
- MD5 4f2c79a26364c0f2ed3396b67e815cc1
- SHA1 b106739b5d92d57f10ae1d9346e4b7daa27e4f62
- SHA512 bd8dcb1fc542ee6296239400f4adc98eaaff8b79ba844043b6096a7e00ea2a86750d4b4da0eaaf83c50256fd7b2df1192aeb33af650d38c284b47f41214fc78e
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.evana-rohanihijab.com/iic6/
Decoy
-
capableandresilient.com
-
listaprzygod.com
-
cashhomeprogram.com
-
aboutwheelchair.com
-
clk4milli.club
-
asakitreks.com
-
liquiddreamworld.com
-
uqur88.com
-
bestifystore.com
-
arancionehq.xyz
-
mmoimperium.com
-
houxinjian.com
-
satmonitoring.com
-
tidalhaven.com
-
blcdevelopers.com
-
piratesofthefun.com
-
kadopulsa.com
-
xn--o39au6k0nm4rghsaq0c.net
-
wxxxtw.com
-
kyrtjf.com
-
rapid-rewards.club
-
powerschoolnocca.com
-
naturalorganizing.com
-
auzura.net
-
royalcopystar.com
-
crowdcork.com
-
xtrememasksanitizer.com
-
sia-38.com
-
forthathletics.com
-
nissy-fore.com
-
ofertaze.com
-
gammachi1925.xyz
-
escortslove.com
-
naiyou-navi.com
-
visiontoinvest.com
-
thatlifeclothingco.com
-
eucmia.info
-
alamaula.sucks
-
tidalgin.com
-
netleyholdings.space
-
mascofarms.com
-
xn--teakdck-9wa.net
-
powerlotusengineering.com
-
wearsd.com
-
postdatabits.com
-
bossabars.net
-
myivynest.com
-
newcovburgawnc.com
-
goldyslotvip.com
-
jxappc.com
-
gabrielrasskin.com
-
nakshatrabeachresort.com
-
reigninglegacy.net
-
ghelyoun.net
-
obgynpatientnews.com
-
cafebabe.net
-
enuyu.net
-
best4ufoods.com
-
institutodederechoygobierno.com
-
areralind.com
-
open-osrs.net
-
mixtaks.life
-
qtmeters.com
-
haxb33.xyz
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/2696-2-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2696-3-0x000000000041ED60-mapping.dmp formbook behavioral2/memory/3676-5-0x0000000000000000-mapping.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 496 set thread context of 2696 496 Pending PURCHASE ORDER - 47001516.pdf.exe 75 PID 2696 set thread context of 3016 2696 Pending PURCHASE ORDER - 47001516.pdf.exe 40 PID 3676 set thread context of 3016 3676 ipconfig.exe 40 - Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 3676 ipconfig.exe - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 2696 Pending PURCHASE ORDER - 47001516.pdf.exe 2696 Pending PURCHASE ORDER - 47001516.pdf.exe 2696 Pending PURCHASE ORDER - 47001516.pdf.exe 2696 Pending PURCHASE ORDER - 47001516.pdf.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe 3676 ipconfig.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 496 Pending PURCHASE ORDER - 47001516.pdf.exe 2696 Pending PURCHASE ORDER - 47001516.pdf.exe 2696 Pending PURCHASE ORDER - 47001516.pdf.exe 2696 Pending PURCHASE ORDER - 47001516.pdf.exe 3676 ipconfig.exe 3676 ipconfig.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2696 Pending PURCHASE ORDER - 47001516.pdf.exe Token: SeDebugPrivilege 3676 ipconfig.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3016 Explorer.EXE 3016 Explorer.EXE - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3016 Explorer.EXE 3016 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3016 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 496 wrote to memory of 2696 496 Pending PURCHASE ORDER - 47001516.pdf.exe 75 PID 496 wrote to memory of 2696 496 Pending PURCHASE ORDER - 47001516.pdf.exe 75 PID 496 wrote to memory of 2696 496 Pending PURCHASE ORDER - 47001516.pdf.exe 75 PID 496 wrote to memory of 2696 496 Pending PURCHASE ORDER - 47001516.pdf.exe 75 PID 3016 wrote to memory of 3676 3016 Explorer.EXE 76 PID 3016 wrote to memory of 3676 3016 Explorer.EXE 76 PID 3016 wrote to memory of 3676 3016 Explorer.EXE 76 PID 3676 wrote to memory of 4076 3676 ipconfig.exe 79 PID 3676 wrote to memory of 4076 3676 ipconfig.exe 79 PID 3676 wrote to memory of 4076 3676 ipconfig.exe 79
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\Pending PURCHASE ORDER - 47001516.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Pending PURCHASE ORDER - 47001516.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:496 -
C:\Users\Admin\AppData\Local\Temp\Pending PURCHASE ORDER - 47001516.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Pending PURCHASE ORDER - 47001516.pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2696
-
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Pending PURCHASE ORDER - 47001516.pdf.exe"3⤵PID:4076
-
-