Analysis
-
max time kernel
146s -
max time network
133s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
13-01-2021 02:02
Static task
static1
Behavioral task
behavioral1
Sample
Project Review_pdf.exe
Resource
win7v20201028
General
-
Target
Project Review_pdf.exe
-
Size
913KB
-
MD5
508b7bca5b55eba939827fa59d25195c
-
SHA1
991fae86b65d9ae32f267d53c05d3b24248bd1ac
-
SHA256
28aad79081b924ce33128b96953771392acdd3881c2b21db53d1a0f8de83ec5b
-
SHA512
afbcad2c554c15b272b1ff5b4156f9bf360556d0faab9c4e4760195a8efd86b6942b0f6259df45e14932b812227cbaa74d1adc76f2c5c3765d038cf28d891958
Malware Config
Extracted
formbook
http://www.workonlinetimallen.com/dll/
nyeconcreations.com
generar-k.com
refugiodelmate.com
elementclubhouse.com
freescorrs.xyz
tonesweettone.com
lojachicco.com
cyberxchange.net
strobelsolutions.com
tipsytravelerbar.com
shesheofnewyork.com
jdallmed.com
woefys.online
naviwatch.net
yuelvzuche.com
thehoneysuppliers.site
smokindeebflavors.com
preventvaccins.com
thepraisehouse.com
lgbtpridedirectory.com
bestconcretelifting.com
commissary.xyz
jakeleeeakin.info
partakpakhsh.com
mystyleonline.online
brunoloulopes.com
softwarexcompanies.com
stockincloud.net
volemate.com
pubjek.com
miamibotany.com
khoing.com
abdpublicidad.com
sundialandpanel.com
latitiaseymour.xyz
ameluskajewelry.net
coltivazioneelementare.info
ontoicase.com
coeurdeconscience.com
komgo.net
literatur.site
shopbrandnew.com
propertiesnaija.com
vaca2day.net
laytikes.com
cryptocustodianship.com
chicagoarthaus.com
worm-tea.com
purchase-support.com
cdamultisport.com
capecodmicrowedding.com
firsttimehomebuyerusinfo.com
thedeepdivelab.com
xn--eiswrfelform-glb.com
oceanupdate.xyz
s8agency.com
lovethybodi.com
xeonnet.com
verificationrelay.xyz
0310li.com
richardpanitch.com
jaydenmichaelgouchie.com
oiltankremovaljc.com
olenfex.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/432-7-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/432-8-0x000000000041EBD0-mapping.dmp formbook behavioral1/memory/1504-9-0x0000000000000000-mapping.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 552 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Project Review_pdf.exeProject Review_pdf.exeNETSTAT.EXEdescription pid process target process PID 1744 set thread context of 432 1744 Project Review_pdf.exe Project Review_pdf.exe PID 432 set thread context of 1268 432 Project Review_pdf.exe Explorer.EXE PID 1504 set thread context of 1268 1504 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 1504 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
Project Review_pdf.exeProject Review_pdf.exeNETSTAT.EXEpid process 1744 Project Review_pdf.exe 1744 Project Review_pdf.exe 432 Project Review_pdf.exe 432 Project Review_pdf.exe 1504 NETSTAT.EXE 1504 NETSTAT.EXE 1504 NETSTAT.EXE 1504 NETSTAT.EXE 1504 NETSTAT.EXE 1504 NETSTAT.EXE 1504 NETSTAT.EXE 1504 NETSTAT.EXE 1504 NETSTAT.EXE 1504 NETSTAT.EXE 1504 NETSTAT.EXE 1504 NETSTAT.EXE 1504 NETSTAT.EXE 1504 NETSTAT.EXE 1504 NETSTAT.EXE 1504 NETSTAT.EXE 1504 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Project Review_pdf.exeNETSTAT.EXEpid process 432 Project Review_pdf.exe 432 Project Review_pdf.exe 432 Project Review_pdf.exe 1504 NETSTAT.EXE 1504 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Project Review_pdf.exeProject Review_pdf.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 1744 Project Review_pdf.exe Token: SeDebugPrivilege 432 Project Review_pdf.exe Token: SeDebugPrivilege 1504 NETSTAT.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
Project Review_pdf.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 1744 wrote to memory of 1080 1744 Project Review_pdf.exe Project Review_pdf.exe PID 1744 wrote to memory of 1080 1744 Project Review_pdf.exe Project Review_pdf.exe PID 1744 wrote to memory of 1080 1744 Project Review_pdf.exe Project Review_pdf.exe PID 1744 wrote to memory of 1080 1744 Project Review_pdf.exe Project Review_pdf.exe PID 1744 wrote to memory of 432 1744 Project Review_pdf.exe Project Review_pdf.exe PID 1744 wrote to memory of 432 1744 Project Review_pdf.exe Project Review_pdf.exe PID 1744 wrote to memory of 432 1744 Project Review_pdf.exe Project Review_pdf.exe PID 1744 wrote to memory of 432 1744 Project Review_pdf.exe Project Review_pdf.exe PID 1744 wrote to memory of 432 1744 Project Review_pdf.exe Project Review_pdf.exe PID 1744 wrote to memory of 432 1744 Project Review_pdf.exe Project Review_pdf.exe PID 1744 wrote to memory of 432 1744 Project Review_pdf.exe Project Review_pdf.exe PID 1268 wrote to memory of 1504 1268 Explorer.EXE NETSTAT.EXE PID 1268 wrote to memory of 1504 1268 Explorer.EXE NETSTAT.EXE PID 1268 wrote to memory of 1504 1268 Explorer.EXE NETSTAT.EXE PID 1268 wrote to memory of 1504 1268 Explorer.EXE NETSTAT.EXE PID 1504 wrote to memory of 552 1504 NETSTAT.EXE cmd.exe PID 1504 wrote to memory of 552 1504 NETSTAT.EXE cmd.exe PID 1504 wrote to memory of 552 1504 NETSTAT.EXE cmd.exe PID 1504 wrote to memory of 552 1504 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Project Review_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Project Review_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Project Review_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Project Review_pdf.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Project Review_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Project Review_pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Project Review_pdf.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/432-7-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/432-8-0x000000000041EBD0-mapping.dmp
-
memory/552-11-0x0000000000000000-mapping.dmp
-
memory/1504-9-0x0000000000000000-mapping.dmp
-
memory/1504-10-0x00000000004C0000-0x00000000004C9000-memory.dmpFilesize
36KB
-
memory/1504-12-0x00000000020B0000-0x0000000002240000-memory.dmpFilesize
1.6MB
-
memory/1744-2-0x00000000741A0000-0x000000007488E000-memory.dmpFilesize
6.9MB
-
memory/1744-3-0x0000000000830000-0x0000000000831000-memory.dmpFilesize
4KB
-
memory/1744-5-0x0000000000210000-0x0000000000222000-memory.dmpFilesize
72KB
-
memory/1744-6-0x0000000005400000-0x000000000546B000-memory.dmpFilesize
428KB