Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
12-01-2021 07:23
Static task
static1
Behavioral task
behavioral1
Sample
M.V. CHIANG TUN_pdf.exe
Resource
win7v20201028
General
-
Target
M.V. CHIANG TUN_pdf.exe
-
Size
852KB
-
MD5
e16fc6dd80b2adb86bfdcd9f4fe6a787
-
SHA1
ccc534305f283b657c7ac9ddcbdbc321da08f95f
-
SHA256
f8a388fc032aa7fdf80ed5bad850e3429ee27614bd6152efaa090fc77ad3bc6a
-
SHA512
f913c2810853d0a76c9661f5ed51673a1c1602c8f6b1cfc4c06d9e0c4cc7a002efd6bd2c0189fe4ead15f1cc42181059bbc8cafabc08c7c6817b56e6ab26081e
Malware Config
Extracted
formbook
http://www.huynhanhdung.com/kna/
lawrencefiredepartment.com
executivehomeoffices.com
solfed.world
oshawaexchange.com
webdavlexstore.com
youpieb.com
chiller-master.com
bearstoragetn.com
daf90x16.com
gewhacaalouine.com
simplyezi.com
cstechnologyservices.com
nosyboats.com
thecocomarie.com
vetinaryeco.club
americangoselfilm.com
gdsuhejia.com
verbunden-sein.net
the-minerva.com
loctrantv.com
casualluvonline.com
groups3usa.com
ncdcnow.com
qrastenmap.online
ltjxw.net
crystalblueboating.com
51adcn.com
abrasto.com
smokegas.com
schofieldoutpost.com
sh-ruidiclub.com
zzyxgl.com
qpremodeling.com
ayzvyeco.icu
modestartgallery.com
ref478.com
astutetopshop.com
pinebarrenfarms.com
webprofiji.com
purfect-air.com
transformesuasaude.com
oz-men.com
mpjjpwp.icu
zeinabiohouse.com
shopwaterlemon.com
radiohebron.com
americanheraldnews.com
clinicadentalfika.com
throughthelorgnette.com
carte-diem.com
elderstatesmanarchive.com
nanhulove.com
melonicwater.com
streamingdads.com
indrapandhari.com
dc-prices.com
xstarconnect.com
weninse.com
atlantavirtualmeetings.com
jobhelpseekers.com
freisaq.com
viajeaatenas.com
worldparcel.net
qcc3.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2944-11-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2944-12-0x000000000041EAB0-mapping.dmp formbook behavioral2/memory/1392-13-0x0000000000000000-mapping.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
M.V. CHIANG TUN_pdf.exeM.V. CHIANG TUN_pdf.execontrol.exedescription pid process target process PID 640 set thread context of 2944 640 M.V. CHIANG TUN_pdf.exe M.V. CHIANG TUN_pdf.exe PID 2944 set thread context of 3040 2944 M.V. CHIANG TUN_pdf.exe Explorer.EXE PID 1392 set thread context of 3040 1392 control.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
M.V. CHIANG TUN_pdf.execontrol.exepid process 2944 M.V. CHIANG TUN_pdf.exe 2944 M.V. CHIANG TUN_pdf.exe 2944 M.V. CHIANG TUN_pdf.exe 2944 M.V. CHIANG TUN_pdf.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe 1392 control.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
M.V. CHIANG TUN_pdf.execontrol.exepid process 2944 M.V. CHIANG TUN_pdf.exe 2944 M.V. CHIANG TUN_pdf.exe 2944 M.V. CHIANG TUN_pdf.exe 1392 control.exe 1392 control.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
M.V. CHIANG TUN_pdf.execontrol.exedescription pid process Token: SeDebugPrivilege 2944 M.V. CHIANG TUN_pdf.exe Token: SeDebugPrivilege 1392 control.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3040 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
M.V. CHIANG TUN_pdf.exeExplorer.EXEcontrol.exedescription pid process target process PID 640 wrote to memory of 2944 640 M.V. CHIANG TUN_pdf.exe M.V. CHIANG TUN_pdf.exe PID 640 wrote to memory of 2944 640 M.V. CHIANG TUN_pdf.exe M.V. CHIANG TUN_pdf.exe PID 640 wrote to memory of 2944 640 M.V. CHIANG TUN_pdf.exe M.V. CHIANG TUN_pdf.exe PID 640 wrote to memory of 2944 640 M.V. CHIANG TUN_pdf.exe M.V. CHIANG TUN_pdf.exe PID 640 wrote to memory of 2944 640 M.V. CHIANG TUN_pdf.exe M.V. CHIANG TUN_pdf.exe PID 640 wrote to memory of 2944 640 M.V. CHIANG TUN_pdf.exe M.V. CHIANG TUN_pdf.exe PID 3040 wrote to memory of 1392 3040 Explorer.EXE control.exe PID 3040 wrote to memory of 1392 3040 Explorer.EXE control.exe PID 3040 wrote to memory of 1392 3040 Explorer.EXE control.exe PID 1392 wrote to memory of 4056 1392 control.exe cmd.exe PID 1392 wrote to memory of 4056 1392 control.exe cmd.exe PID 1392 wrote to memory of 4056 1392 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\M.V. CHIANG TUN_pdf.exe"C:\Users\Admin\AppData\Local\Temp\M.V. CHIANG TUN_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\M.V. CHIANG TUN_pdf.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\M.V. CHIANG TUN_pdf.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/640-9-0x0000000007220000-0x00000000072B8000-memory.dmpFilesize
608KB
-
memory/640-2-0x0000000073190000-0x000000007387E000-memory.dmpFilesize
6.9MB
-
memory/640-5-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/640-6-0x0000000004C50000-0x0000000004C51000-memory.dmpFilesize
4KB
-
memory/640-7-0x0000000004BD0000-0x0000000004BD1000-memory.dmpFilesize
4KB
-
memory/640-8-0x0000000004E20000-0x0000000004E2E000-memory.dmpFilesize
56KB
-
memory/640-3-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/640-10-0x0000000007360000-0x0000000007361000-memory.dmpFilesize
4KB
-
memory/1392-13-0x0000000000000000-mapping.dmp
-
memory/1392-14-0x0000000000D40000-0x0000000000D60000-memory.dmpFilesize
128KB
-
memory/1392-15-0x0000000000D40000-0x0000000000D60000-memory.dmpFilesize
128KB
-
memory/2944-12-0x000000000041EAB0-mapping.dmp
-
memory/2944-11-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/4056-16-0x0000000000000000-mapping.dmp