Analysis
-
max time kernel
150s -
max time network
10s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 07:22
Static task
static1
Behavioral task
behavioral1
Sample
3131_50SG0BK00T1,pdf.exe
Resource
win7v20201028
General
-
Target
3131_50SG0BK00T1,pdf.exe
-
Size
1.0MB
-
MD5
8898f586289faf1cc074c328eb64e0c6
-
SHA1
8df1daf9fb7147fd61a1e18a5b1e5bfa7bbe94fa
-
SHA256
134447d4a42fa0c68719a166022b19728ab3b771a025fcb40b9e01eb0472bd8b
-
SHA512
1ef511b05999e0346b8698f51b5a7950744dff2f6ff726a39414886c840a5e191e4dcf5ab5c54cbb23df79199da225f8da78af8e74c0cc7b677c9c7bec1e0ea0
Malware Config
Extracted
formbook
http://www.radissonhotelsusa.com/cp5/
glcpunix.com
marabierta-coaching.com
osrs-remastered.com
lineagehealthxwellness.com
dunyadagezilecekyerler.com
negociosyfinanzasfaciles.com
bifa510.com
houseofutamasa.com
dopeneeds.com
sailacc.com
thewindgallery.com
elvinrisky.com
flowersassistedliving.com
lzbnwy.com
mrpentester.com
joinmytradingteam.com
jasabuatvisa.com
meherunnessa-foundation.com
notyourtypicaljocks.com
lobo-sports.com
nails-of-art.com
skinatoms.com
huadijc.com
elegantligting.com
zwasperr.com
401ne19thstapt51.com
semedburiti.com
andieweb.com
best20hookups.com
planttan.com
entrenamientoenequilibrio.com
newsecho.net
cocktailcrates.com
gurumedicalsupplies.com
legaca.trade
carscompetition.com
disloc.net
hsupi.com
s-sgasia.com
dictuse.xyz
vayocart.com
boxedhawaii.com
wateryourlandscape.com
countrytouring.com
shifamedico.com
gdhymc.com
sessionsup.com
viettellongxuyen.com
shindeconstruction.com
theautocareshop.com
maxwellgolf.com
hongdajunheng.com
mwakossolutions.com
fabulashpro.com
sklsdcollege.com
sensualblogs.com
gtainsinde.com
nehyam.com
itool.group
noblehare.com
amylaib.com
photosbylanie.com
palmoiltech.com
harrypotterwithguna.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/888-10-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/888-11-0x000000000041EBF0-mapping.dmp formbook behavioral1/memory/844-19-0x00000000000C0000-0x00000000000EE000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
3131_50SG0BK00T1,pdf.exeMSBuild.execmmon32.exedescription pid process target process PID 1288 set thread context of 888 1288 3131_50SG0BK00T1,pdf.exe MSBuild.exe PID 888 set thread context of 1200 888 MSBuild.exe Explorer.EXE PID 844 set thread context of 1200 844 cmmon32.exe Explorer.EXE -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
3131_50SG0BK00T1,pdf.exeMSBuild.execmmon32.exepid process 1288 3131_50SG0BK00T1,pdf.exe 888 MSBuild.exe 888 MSBuild.exe 844 cmmon32.exe 844 cmmon32.exe 844 cmmon32.exe 844 cmmon32.exe 844 cmmon32.exe 844 cmmon32.exe 844 cmmon32.exe 844 cmmon32.exe 844 cmmon32.exe 844 cmmon32.exe 844 cmmon32.exe 844 cmmon32.exe 844 cmmon32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
MSBuild.execmmon32.exepid process 888 MSBuild.exe 888 MSBuild.exe 888 MSBuild.exe 844 cmmon32.exe 844 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
3131_50SG0BK00T1,pdf.exeMSBuild.execmmon32.exedescription pid process Token: SeDebugPrivilege 1288 3131_50SG0BK00T1,pdf.exe Token: SeDebugPrivilege 888 MSBuild.exe Token: SeDebugPrivilege 844 cmmon32.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
3131_50SG0BK00T1,pdf.exeExplorer.EXEcmmon32.exedescription pid process target process PID 1288 wrote to memory of 684 1288 3131_50SG0BK00T1,pdf.exe schtasks.exe PID 1288 wrote to memory of 684 1288 3131_50SG0BK00T1,pdf.exe schtasks.exe PID 1288 wrote to memory of 684 1288 3131_50SG0BK00T1,pdf.exe schtasks.exe PID 1288 wrote to memory of 684 1288 3131_50SG0BK00T1,pdf.exe schtasks.exe PID 1288 wrote to memory of 888 1288 3131_50SG0BK00T1,pdf.exe MSBuild.exe PID 1288 wrote to memory of 888 1288 3131_50SG0BK00T1,pdf.exe MSBuild.exe PID 1288 wrote to memory of 888 1288 3131_50SG0BK00T1,pdf.exe MSBuild.exe PID 1288 wrote to memory of 888 1288 3131_50SG0BK00T1,pdf.exe MSBuild.exe PID 1288 wrote to memory of 888 1288 3131_50SG0BK00T1,pdf.exe MSBuild.exe PID 1288 wrote to memory of 888 1288 3131_50SG0BK00T1,pdf.exe MSBuild.exe PID 1288 wrote to memory of 888 1288 3131_50SG0BK00T1,pdf.exe MSBuild.exe PID 1200 wrote to memory of 844 1200 Explorer.EXE cmmon32.exe PID 1200 wrote to memory of 844 1200 Explorer.EXE cmmon32.exe PID 1200 wrote to memory of 844 1200 Explorer.EXE cmmon32.exe PID 1200 wrote to memory of 844 1200 Explorer.EXE cmmon32.exe PID 844 wrote to memory of 916 844 cmmon32.exe cmd.exe PID 844 wrote to memory of 916 844 cmmon32.exe cmd.exe PID 844 wrote to memory of 916 844 cmmon32.exe cmd.exe PID 844 wrote to memory of 916 844 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3131_50SG0BK00T1,pdf.exe"C:\Users\Admin\AppData\Local\Temp\3131_50SG0BK00T1,pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jLhxUiIQnuLl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7EF0.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp7EF0.tmpMD5
851e2c84c5f2b9beb34e0a27b63947be
SHA16f0e6ce445877ee652e778f18c0a60e54ed222ba
SHA256d2fb195635bd2e4332b46a49610f5581234963141658a08875431dd6d02f5470
SHA5120d8b8f232aea7ba32a48c1a3a6bcc0276e20200e48a5d5d1ead585214c31882193d0ae33f473268add276da1deac0835077b11ed2d4eec460aeb7a8bff7234bd
-
memory/684-8-0x0000000000000000-mapping.dmp
-
memory/844-16-0x0000000000000000-mapping.dmp
-
memory/844-21-0x0000000000840000-0x00000000008D3000-memory.dmpFilesize
588KB
-
memory/844-20-0x00000000020E0000-0x00000000023E3000-memory.dmpFilesize
3.0MB
-
memory/844-19-0x00000000000C0000-0x00000000000EE000-memory.dmpFilesize
184KB
-
memory/844-18-0x0000000000CD0000-0x0000000000CDD000-memory.dmpFilesize
52KB
-
memory/888-11-0x000000000041EBF0-mapping.dmp
-
memory/888-13-0x00000000008F0000-0x0000000000BF3000-memory.dmpFilesize
3.0MB
-
memory/888-14-0x00000000003D0000-0x00000000003E4000-memory.dmpFilesize
80KB
-
memory/888-10-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/916-17-0x0000000000000000-mapping.dmp
-
memory/1200-15-0x0000000004FE0000-0x0000000005119000-memory.dmpFilesize
1.2MB
-
memory/1288-2-0x0000000074390000-0x0000000074A7E000-memory.dmpFilesize
6.9MB
-
memory/1288-7-0x0000000004C30000-0x0000000004C96000-memory.dmpFilesize
408KB
-
memory/1288-6-0x0000000000550000-0x0000000000573000-memory.dmpFilesize
140KB
-
memory/1288-5-0x0000000004DC0000-0x0000000004DC1000-memory.dmpFilesize
4KB
-
memory/1288-3-0x0000000001210000-0x0000000001211000-memory.dmpFilesize
4KB