Analysis
-
max time kernel
146s -
max time network
131s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-01-2021 13:00
Static task
static1
Behavioral task
behavioral1
Sample
RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe
Resource
win7v20201028
General
-
Target
RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe
-
Size
1.4MB
-
MD5
d4318c1bca3df9f7cf9dd429da7fe4c6
-
SHA1
bdfcb11a49b358d3c95a3ba8dfdb7757512234fb
-
SHA256
458bd08f0c32719adc9d2858721b609b136ff0e21c2f3ac3f4be4f97e4084b7a
-
SHA512
afec2d60fcdece43e7b1ef33c6278d06916f5a8163756babb8c5c89350c98cd0aed2d6456f037697240436c4a7417d7199abd364fad6f575102b4ef5fc82590f
Malware Config
Extracted
formbook
http://www.thedilleyo.com/kb8/
goodsforbuilders.com
dafuhe.com
parapharmacity.com
montclairymcamotionvibe.com
jamesmccloudart.com
reignfallentertainment.com
couplesforequality.com
pitchbop.com
minipresspaperco.com
venoam.com
so-paradise.com
surgeryprovider.com
donaldscareers.com
disney-funlife.com
biosolo.net
themodsmith.net
grandhawaiian.com
11mountains.com
immatesearch.com
stochastichq.com
buroyellow.com
blackpopsatl.com
trivietdesign.com
freedomauthor.com
barinvestmentgroup.com
atlantisbeautym.com
compresedairsystems.com
negociobrilhante.com
glenviewpulse.com
charterforengagement.com
athelon.academy
1000-help19.club
startebgine.com
kestega.com
bowieliving.com
ecotechprime.com
thenewwayofliving.com
celerindustrial.com
uniqueama.com
gedankenspiel-coaching.com
informed-citizenry.com
xn--fiqvr53rcnhev5b7vo.com
ericnewburyparkhomes.com
cmdp0o7mi0-e.info
weavrfish.com
freisaq.com
assuredoutcomesllc.com
findingmytao.com
br9898.com
tinyschoolstyle.com
bavarian-luxury.com
over50legalplan.com
bartimeu.com
land-fair.com
archeologique.com
wedesignonline.net
anna-mueller.design
spielkorb.com
nwflworkcomp.com
abyafashion.com
allrenovationcompany.com
hayalspel.com
2664senter264.com
jgmerino.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1096-13-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/1096-14-0x000000000041EB70-mapping.dmp formbook behavioral2/memory/3244-23-0x0000000000780000-0x00000000007AE000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exeRE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exeNETSTAT.EXEdescription pid process target process PID 3108 set thread context of 1096 3108 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe PID 1096 set thread context of 2756 1096 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe Explorer.EXE PID 3244 set thread context of 2756 3244 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 3244 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exeRE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exeNETSTAT.EXEpid process 3108 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe 3108 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe 3108 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe 3108 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe 1096 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe 1096 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe 1096 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe 1096 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE 3244 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exeNETSTAT.EXEpid process 1096 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe 1096 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe 1096 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe 3244 NETSTAT.EXE 3244 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exeRE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 3108 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe Token: SeDebugPrivilege 1096 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe Token: SeDebugPrivilege 3244 NETSTAT.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2756 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 3108 wrote to memory of 1096 3108 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe PID 3108 wrote to memory of 1096 3108 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe PID 3108 wrote to memory of 1096 3108 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe PID 3108 wrote to memory of 1096 3108 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe PID 3108 wrote to memory of 1096 3108 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe PID 3108 wrote to memory of 1096 3108 RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe PID 2756 wrote to memory of 3244 2756 Explorer.EXE NETSTAT.EXE PID 2756 wrote to memory of 3244 2756 Explorer.EXE NETSTAT.EXE PID 2756 wrote to memory of 3244 2756 Explorer.EXE NETSTAT.EXE PID 3244 wrote to memory of 3884 3244 NETSTAT.EXE cmd.exe PID 3244 wrote to memory of 3884 3244 NETSTAT.EXE cmd.exe PID 3244 wrote to memory of 3884 3244 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe"C:\Users\Admin\AppData\Local\Temp\RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RE SHIPPING DOCS MNL 1X20GP+1X40HC ETD27012021pdf.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1096-13-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1096-18-0x0000000000FF0000-0x0000000001004000-memory.dmpFilesize
80KB
-
memory/1096-16-0x0000000001090000-0x00000000013B0000-memory.dmpFilesize
3.1MB
-
memory/1096-14-0x000000000041EB70-mapping.dmp
-
memory/2756-26-0x0000000002B90000-0x0000000002C94000-memory.dmpFilesize
1.0MB
-
memory/2756-19-0x00000000065A0000-0x0000000006703000-memory.dmpFilesize
1.4MB
-
memory/3108-8-0x0000000004F00000-0x0000000004F01000-memory.dmpFilesize
4KB
-
memory/3108-6-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/3108-11-0x0000000008380000-0x00000000083DA000-memory.dmpFilesize
360KB
-
memory/3108-12-0x0000000008480000-0x0000000008481000-memory.dmpFilesize
4KB
-
memory/3108-9-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/3108-2-0x00000000739A0000-0x000000007408E000-memory.dmpFilesize
6.9MB
-
memory/3108-7-0x00000000051B0000-0x00000000051B1000-memory.dmpFilesize
4KB
-
memory/3108-10-0x00000000054B0000-0x00000000054BE000-memory.dmpFilesize
56KB
-
memory/3108-5-0x0000000004D30000-0x0000000004DAA000-memory.dmpFilesize
488KB
-
memory/3108-3-0x0000000000310000-0x0000000000311000-memory.dmpFilesize
4KB
-
memory/3244-23-0x0000000000780000-0x00000000007AE000-memory.dmpFilesize
184KB
-
memory/3244-22-0x0000000000AD0000-0x0000000000ADB000-memory.dmpFilesize
44KB
-
memory/3244-24-0x0000000002C80000-0x0000000002FA0000-memory.dmpFilesize
3.1MB
-
memory/3244-25-0x0000000002B80000-0x0000000002C13000-memory.dmpFilesize
588KB
-
memory/3244-20-0x0000000000000000-mapping.dmp
-
memory/3884-21-0x0000000000000000-mapping.dmp