Analysis
-
max time kernel
147s -
max time network
13s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 13:00
Static task
static1
Behavioral task
behavioral1
Sample
RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe
Resource
win7v20201028
General
-
Target
RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe
-
Size
1.4MB
-
MD5
d4318c1bca3df9f7cf9dd429da7fe4c6
-
SHA1
bdfcb11a49b358d3c95a3ba8dfdb7757512234fb
-
SHA256
458bd08f0c32719adc9d2858721b609b136ff0e21c2f3ac3f4be4f97e4084b7a
-
SHA512
afec2d60fcdece43e7b1ef33c6278d06916f5a8163756babb8c5c89350c98cd0aed2d6456f037697240436c4a7417d7199abd364fad6f575102b4ef5fc82590f
Malware Config
Extracted
formbook
http://www.thedilleyo.com/kb8/
goodsforbuilders.com
dafuhe.com
parapharmacity.com
montclairymcamotionvibe.com
jamesmccloudart.com
reignfallentertainment.com
couplesforequality.com
pitchbop.com
minipresspaperco.com
venoam.com
so-paradise.com
surgeryprovider.com
donaldscareers.com
disney-funlife.com
biosolo.net
themodsmith.net
grandhawaiian.com
11mountains.com
immatesearch.com
stochastichq.com
buroyellow.com
blackpopsatl.com
trivietdesign.com
freedomauthor.com
barinvestmentgroup.com
atlantisbeautym.com
compresedairsystems.com
negociobrilhante.com
glenviewpulse.com
charterforengagement.com
athelon.academy
1000-help19.club
startebgine.com
kestega.com
bowieliving.com
ecotechprime.com
thenewwayofliving.com
celerindustrial.com
uniqueama.com
gedankenspiel-coaching.com
informed-citizenry.com
xn--fiqvr53rcnhev5b7vo.com
ericnewburyparkhomes.com
cmdp0o7mi0-e.info
weavrfish.com
freisaq.com
assuredoutcomesllc.com
findingmytao.com
br9898.com
tinyschoolstyle.com
bavarian-luxury.com
over50legalplan.com
bartimeu.com
land-fair.com
archeologique.com
wedesignonline.net
anna-mueller.design
spielkorb.com
nwflworkcomp.com
abyafashion.com
allrenovationcompany.com
hayalspel.com
2664senter264.com
jgmerino.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/780-9-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/780-10-0x000000000041EB70-mapping.dmp formbook behavioral1/memory/308-19-0x0000000000120000-0x000000000014E000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1012 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exeRE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exemsiexec.exedescription pid process target process PID 1636 set thread context of 780 1636 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe PID 780 set thread context of 1192 780 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe Explorer.EXE PID 308 set thread context of 1192 308 msiexec.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exeRE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exemsiexec.exepid process 1636 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe 1636 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe 1636 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe 1636 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe 1636 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe 1636 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe 780 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe 780 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe 308 msiexec.exe 308 msiexec.exe 308 msiexec.exe 308 msiexec.exe 308 msiexec.exe 308 msiexec.exe 308 msiexec.exe 308 msiexec.exe 308 msiexec.exe 308 msiexec.exe 308 msiexec.exe 308 msiexec.exe 308 msiexec.exe 308 msiexec.exe 308 msiexec.exe 308 msiexec.exe 308 msiexec.exe 308 msiexec.exe 308 msiexec.exe 308 msiexec.exe 308 msiexec.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exemsiexec.exepid process 780 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe 780 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe 780 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe 308 msiexec.exe 308 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exeRE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1636 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe Token: SeDebugPrivilege 780 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe Token: SeDebugPrivilege 308 msiexec.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1636 wrote to memory of 1652 1636 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe PID 1636 wrote to memory of 1652 1636 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe PID 1636 wrote to memory of 1652 1636 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe PID 1636 wrote to memory of 1652 1636 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe PID 1636 wrote to memory of 780 1636 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe PID 1636 wrote to memory of 780 1636 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe PID 1636 wrote to memory of 780 1636 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe PID 1636 wrote to memory of 780 1636 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe PID 1636 wrote to memory of 780 1636 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe PID 1636 wrote to memory of 780 1636 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe PID 1636 wrote to memory of 780 1636 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe PID 1192 wrote to memory of 308 1192 Explorer.EXE msiexec.exe PID 1192 wrote to memory of 308 1192 Explorer.EXE msiexec.exe PID 1192 wrote to memory of 308 1192 Explorer.EXE msiexec.exe PID 1192 wrote to memory of 308 1192 Explorer.EXE msiexec.exe PID 1192 wrote to memory of 308 1192 Explorer.EXE msiexec.exe PID 1192 wrote to memory of 308 1192 Explorer.EXE msiexec.exe PID 1192 wrote to memory of 308 1192 Explorer.EXE msiexec.exe PID 308 wrote to memory of 1012 308 msiexec.exe cmd.exe PID 308 wrote to memory of 1012 308 msiexec.exe cmd.exe PID 308 wrote to memory of 1012 308 msiexec.exe cmd.exe PID 308 wrote to memory of 1012 308 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe"C:\Users\Admin\AppData\Local\Temp\RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/308-15-0x0000000000000000-mapping.dmp
-
memory/308-21-0x0000000000B10000-0x0000000000BA3000-memory.dmpFilesize
588KB
-
memory/308-18-0x00000000000B0000-0x00000000000C4000-memory.dmpFilesize
80KB
-
memory/308-20-0x0000000002150000-0x0000000002453000-memory.dmpFilesize
3.0MB
-
memory/308-19-0x0000000000120000-0x000000000014E000-memory.dmpFilesize
184KB
-
memory/308-16-0x00000000761E1000-0x00000000761E3000-memory.dmpFilesize
8KB
-
memory/780-12-0x0000000000930000-0x0000000000C33000-memory.dmpFilesize
3.0MB
-
memory/780-10-0x000000000041EB70-mapping.dmp
-
memory/780-13-0x00000000001C0000-0x00000000001D4000-memory.dmpFilesize
80KB
-
memory/780-9-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1012-17-0x0000000000000000-mapping.dmp
-
memory/1192-14-0x0000000004470000-0x000000000454A000-memory.dmpFilesize
872KB
-
memory/1636-2-0x00000000746F0000-0x0000000074DDE000-memory.dmpFilesize
6.9MB
-
memory/1636-8-0x0000000005FD0000-0x000000000602A000-memory.dmpFilesize
360KB
-
memory/1636-7-0x0000000000380000-0x000000000038E000-memory.dmpFilesize
56KB
-
memory/1636-6-0x0000000005E50000-0x0000000005E51000-memory.dmpFilesize
4KB
-
memory/1636-5-0x00000000010D0000-0x000000000114A000-memory.dmpFilesize
488KB
-
memory/1636-3-0x0000000001210000-0x0000000001211000-memory.dmpFilesize
4KB