Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-01-2021 08:02
Static task
static1
Behavioral task
behavioral1
Sample
PO_JAN907#092941_BARYSLpdf.exe
Resource
win7v20201028
General
-
Target
PO_JAN907#092941_BARYSLpdf.exe
-
Size
928KB
-
MD5
e24296acfd8c4ec1fb1e5b4b9379be14
-
SHA1
cdfcde4ab8907b98d3266eb1f80afa43821fb764
-
SHA256
7139fbd600738d2f456c7f11ae105e45ab0bb6e14a473ae0e68391b8125da393
-
SHA512
8123f2ab10402f61238d4468c472d23d7cd9788e2f01f3ea8eaf08130a576dad534ebc38329009f54f60ac23b92a26bc792a79426a35c7ac8f964148fa5dd2ac
Malware Config
Extracted
formbook
http://www.thedilleyo.com/kb8/
goodsforbuilders.com
dafuhe.com
parapharmacity.com
montclairymcamotionvibe.com
jamesmccloudart.com
reignfallentertainment.com
couplesforequality.com
pitchbop.com
minipresspaperco.com
venoam.com
so-paradise.com
surgeryprovider.com
donaldscareers.com
disney-funlife.com
biosolo.net
themodsmith.net
grandhawaiian.com
11mountains.com
immatesearch.com
stochastichq.com
buroyellow.com
blackpopsatl.com
trivietdesign.com
freedomauthor.com
barinvestmentgroup.com
atlantisbeautym.com
compresedairsystems.com
negociobrilhante.com
glenviewpulse.com
charterforengagement.com
athelon.academy
1000-help19.club
startebgine.com
kestega.com
bowieliving.com
ecotechprime.com
thenewwayofliving.com
celerindustrial.com
uniqueama.com
gedankenspiel-coaching.com
informed-citizenry.com
xn--fiqvr53rcnhev5b7vo.com
ericnewburyparkhomes.com
cmdp0o7mi0-e.info
weavrfish.com
freisaq.com
assuredoutcomesllc.com
findingmytao.com
br9898.com
tinyschoolstyle.com
bavarian-luxury.com
over50legalplan.com
bartimeu.com
land-fair.com
archeologique.com
wedesignonline.net
anna-mueller.design
spielkorb.com
nwflworkcomp.com
abyafashion.com
allrenovationcompany.com
hayalspel.com
2664senter264.com
jgmerino.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4088-12-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/4088-13-0x000000000041EB70-mapping.dmp formbook behavioral2/memory/4300-20-0x0000000000660000-0x000000000068E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO_JAN907#092941_BARYSLpdf.exePO_JAN907#092941_BARYSLpdf.exesystray.exedescription pid process target process PID 4716 set thread context of 4088 4716 PO_JAN907#092941_BARYSLpdf.exe PO_JAN907#092941_BARYSLpdf.exe PID 4088 set thread context of 2852 4088 PO_JAN907#092941_BARYSLpdf.exe Explorer.EXE PID 4300 set thread context of 2852 4300 systray.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 49 IoCs
Processes:
PO_JAN907#092941_BARYSLpdf.exePO_JAN907#092941_BARYSLpdf.exesystray.exepid process 4716 PO_JAN907#092941_BARYSLpdf.exe 4088 PO_JAN907#092941_BARYSLpdf.exe 4088 PO_JAN907#092941_BARYSLpdf.exe 4088 PO_JAN907#092941_BARYSLpdf.exe 4088 PO_JAN907#092941_BARYSLpdf.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe 4300 systray.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PO_JAN907#092941_BARYSLpdf.exesystray.exepid process 4088 PO_JAN907#092941_BARYSLpdf.exe 4088 PO_JAN907#092941_BARYSLpdf.exe 4088 PO_JAN907#092941_BARYSLpdf.exe 4300 systray.exe 4300 systray.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PO_JAN907#092941_BARYSLpdf.exePO_JAN907#092941_BARYSLpdf.exesystray.exedescription pid process Token: SeDebugPrivilege 4716 PO_JAN907#092941_BARYSLpdf.exe Token: SeDebugPrivilege 4088 PO_JAN907#092941_BARYSLpdf.exe Token: SeDebugPrivilege 4300 systray.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2852 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PO_JAN907#092941_BARYSLpdf.exeExplorer.EXEsystray.exedescription pid process target process PID 4716 wrote to memory of 4088 4716 PO_JAN907#092941_BARYSLpdf.exe PO_JAN907#092941_BARYSLpdf.exe PID 4716 wrote to memory of 4088 4716 PO_JAN907#092941_BARYSLpdf.exe PO_JAN907#092941_BARYSLpdf.exe PID 4716 wrote to memory of 4088 4716 PO_JAN907#092941_BARYSLpdf.exe PO_JAN907#092941_BARYSLpdf.exe PID 4716 wrote to memory of 4088 4716 PO_JAN907#092941_BARYSLpdf.exe PO_JAN907#092941_BARYSLpdf.exe PID 4716 wrote to memory of 4088 4716 PO_JAN907#092941_BARYSLpdf.exe PO_JAN907#092941_BARYSLpdf.exe PID 4716 wrote to memory of 4088 4716 PO_JAN907#092941_BARYSLpdf.exe PO_JAN907#092941_BARYSLpdf.exe PID 2852 wrote to memory of 4300 2852 Explorer.EXE systray.exe PID 2852 wrote to memory of 4300 2852 Explorer.EXE systray.exe PID 2852 wrote to memory of 4300 2852 Explorer.EXE systray.exe PID 4300 wrote to memory of 4364 4300 systray.exe cmd.exe PID 4300 wrote to memory of 4364 4300 systray.exe cmd.exe PID 4300 wrote to memory of 4364 4300 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO_JAN907#092941_BARYSLpdf.exe"C:\Users\Admin\AppData\Local\Temp\PO_JAN907#092941_BARYSLpdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO_JAN907#092941_BARYSLpdf.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO_JAN907#092941_BARYSLpdf.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2852-24-0x00000000066F0000-0x0000000006804000-memory.dmpFilesize
1.1MB
-
memory/2852-17-0x00000000065A0000-0x00000000066E8000-memory.dmpFilesize
1.3MB
-
memory/4088-12-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/4088-16-0x0000000001A60000-0x0000000001D80000-memory.dmpFilesize
3.1MB
-
memory/4088-15-0x0000000001750000-0x0000000001764000-memory.dmpFilesize
80KB
-
memory/4088-13-0x000000000041EB70-mapping.dmp
-
memory/4300-19-0x00000000008C0000-0x00000000008C6000-memory.dmpFilesize
24KB
-
memory/4300-18-0x0000000000000000-mapping.dmp
-
memory/4300-23-0x00000000047F0000-0x0000000004883000-memory.dmpFilesize
588KB
-
memory/4300-22-0x00000000044D0000-0x00000000047F0000-memory.dmpFilesize
3.1MB
-
memory/4300-20-0x0000000000660000-0x000000000068E000-memory.dmpFilesize
184KB
-
memory/4364-21-0x0000000000000000-mapping.dmp
-
memory/4716-8-0x0000000005250000-0x0000000005251000-memory.dmpFilesize
4KB
-
memory/4716-5-0x0000000005600000-0x0000000005601000-memory.dmpFilesize
4KB
-
memory/4716-6-0x00000000051B0000-0x00000000051B1000-memory.dmpFilesize
4KB
-
memory/4716-2-0x0000000073530000-0x0000000073C1E000-memory.dmpFilesize
6.9MB
-
memory/4716-7-0x00000000053C0000-0x00000000053C1000-memory.dmpFilesize
4KB
-
memory/4716-10-0x0000000007640000-0x000000000769F000-memory.dmpFilesize
380KB
-
memory/4716-9-0x00000000053A0000-0x00000000053AE000-memory.dmpFilesize
56KB
-
memory/4716-11-0x0000000007740000-0x0000000007741000-memory.dmpFilesize
4KB
-
memory/4716-3-0x0000000000880000-0x0000000000881000-memory.dmpFilesize
4KB