Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-01-2021 07:22
Static task
static1
Behavioral task
behavioral1
Sample
3131_50SG0BK00T1,pdf.exe
Resource
win7v20201028
General
-
Target
3131_50SG0BK00T1,pdf.exe
-
Size
1.0MB
-
MD5
8898f586289faf1cc074c328eb64e0c6
-
SHA1
8df1daf9fb7147fd61a1e18a5b1e5bfa7bbe94fa
-
SHA256
134447d4a42fa0c68719a166022b19728ab3b771a025fcb40b9e01eb0472bd8b
-
SHA512
1ef511b05999e0346b8698f51b5a7950744dff2f6ff726a39414886c840a5e191e4dcf5ab5c54cbb23df79199da225f8da78af8e74c0cc7b677c9c7bec1e0ea0
Malware Config
Extracted
formbook
http://www.radissonhotelsusa.com/cp5/
glcpunix.com
marabierta-coaching.com
osrs-remastered.com
lineagehealthxwellness.com
dunyadagezilecekyerler.com
negociosyfinanzasfaciles.com
bifa510.com
houseofutamasa.com
dopeneeds.com
sailacc.com
thewindgallery.com
elvinrisky.com
flowersassistedliving.com
lzbnwy.com
mrpentester.com
joinmytradingteam.com
jasabuatvisa.com
meherunnessa-foundation.com
notyourtypicaljocks.com
lobo-sports.com
nails-of-art.com
skinatoms.com
huadijc.com
elegantligting.com
zwasperr.com
401ne19thstapt51.com
semedburiti.com
andieweb.com
best20hookups.com
planttan.com
entrenamientoenequilibrio.com
newsecho.net
cocktailcrates.com
gurumedicalsupplies.com
legaca.trade
carscompetition.com
disloc.net
hsupi.com
s-sgasia.com
dictuse.xyz
vayocart.com
boxedhawaii.com
wateryourlandscape.com
countrytouring.com
shifamedico.com
gdhymc.com
sessionsup.com
viettellongxuyen.com
shindeconstruction.com
theautocareshop.com
maxwellgolf.com
hongdajunheng.com
mwakossolutions.com
fabulashpro.com
sklsdcollege.com
sensualblogs.com
gtainsinde.com
nehyam.com
itool.group
noblehare.com
amylaib.com
photosbylanie.com
palmoiltech.com
harrypotterwithguna.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1232-17-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/1232-18-0x000000000041EBF0-mapping.dmp formbook behavioral2/memory/1220-25-0x0000000000D80000-0x0000000000DAE000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
3131_50SG0BK00T1,pdf.exeMSBuild.execmd.exedescription pid process target process PID 4000 set thread context of 1232 4000 3131_50SG0BK00T1,pdf.exe MSBuild.exe PID 1232 set thread context of 3036 1232 MSBuild.exe Explorer.EXE PID 1220 set thread context of 3036 1220 cmd.exe Explorer.EXE -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
Processes:
3131_50SG0BK00T1,pdf.exeMSBuild.execmd.exepid process 4000 3131_50SG0BK00T1,pdf.exe 4000 3131_50SG0BK00T1,pdf.exe 4000 3131_50SG0BK00T1,pdf.exe 1232 MSBuild.exe 1232 MSBuild.exe 1232 MSBuild.exe 1232 MSBuild.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe 1220 cmd.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
MSBuild.execmd.exepid process 1232 MSBuild.exe 1232 MSBuild.exe 1232 MSBuild.exe 1220 cmd.exe 1220 cmd.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
3131_50SG0BK00T1,pdf.exeMSBuild.execmd.exedescription pid process Token: SeDebugPrivilege 4000 3131_50SG0BK00T1,pdf.exe Token: SeDebugPrivilege 1232 MSBuild.exe Token: SeDebugPrivilege 1220 cmd.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
3131_50SG0BK00T1,pdf.exeExplorer.EXEcmd.exedescription pid process target process PID 4000 wrote to memory of 416 4000 3131_50SG0BK00T1,pdf.exe schtasks.exe PID 4000 wrote to memory of 416 4000 3131_50SG0BK00T1,pdf.exe schtasks.exe PID 4000 wrote to memory of 416 4000 3131_50SG0BK00T1,pdf.exe schtasks.exe PID 4000 wrote to memory of 1228 4000 3131_50SG0BK00T1,pdf.exe MSBuild.exe PID 4000 wrote to memory of 1228 4000 3131_50SG0BK00T1,pdf.exe MSBuild.exe PID 4000 wrote to memory of 1228 4000 3131_50SG0BK00T1,pdf.exe MSBuild.exe PID 4000 wrote to memory of 1232 4000 3131_50SG0BK00T1,pdf.exe MSBuild.exe PID 4000 wrote to memory of 1232 4000 3131_50SG0BK00T1,pdf.exe MSBuild.exe PID 4000 wrote to memory of 1232 4000 3131_50SG0BK00T1,pdf.exe MSBuild.exe PID 4000 wrote to memory of 1232 4000 3131_50SG0BK00T1,pdf.exe MSBuild.exe PID 4000 wrote to memory of 1232 4000 3131_50SG0BK00T1,pdf.exe MSBuild.exe PID 4000 wrote to memory of 1232 4000 3131_50SG0BK00T1,pdf.exe MSBuild.exe PID 3036 wrote to memory of 1220 3036 Explorer.EXE cmd.exe PID 3036 wrote to memory of 1220 3036 Explorer.EXE cmd.exe PID 3036 wrote to memory of 1220 3036 Explorer.EXE cmd.exe PID 1220 wrote to memory of 2196 1220 cmd.exe cmd.exe PID 1220 wrote to memory of 2196 1220 cmd.exe cmd.exe PID 1220 wrote to memory of 2196 1220 cmd.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3131_50SG0BK00T1,pdf.exe"C:\Users\Admin\AppData\Local\Temp\3131_50SG0BK00T1,pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jLhxUiIQnuLl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2AF9.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2AF9.tmpMD5
baa612ac5686dbcef88cbb8c2af66635
SHA1ff1e4b15b5dacf08dffc934a7cd3b2f2f099d58c
SHA256b978d4c75b855bfd0d2e5456e45dcb5b7c4e29aad525ba5862de278bc2c36480
SHA51213085ac92232ef88a727345cf7d6ef6f9b249911c732eb1a41a9d672e82993e668c9c04cfd31239a6ddb76e69fef8386e3be22b8fb0a96ed73618388be103711
-
memory/416-15-0x0000000000000000-mapping.dmp
-
memory/1220-28-0x00000000037C0000-0x0000000003853000-memory.dmpFilesize
588KB
-
memory/1220-27-0x0000000003300000-0x0000000003620000-memory.dmpFilesize
3.1MB
-
memory/1220-24-0x0000000000DD0000-0x0000000000E29000-memory.dmpFilesize
356KB
-
memory/1220-25-0x0000000000D80000-0x0000000000DAE000-memory.dmpFilesize
184KB
-
memory/1220-23-0x0000000000000000-mapping.dmp
-
memory/1232-21-0x0000000000C40000-0x0000000000C54000-memory.dmpFilesize
80KB
-
memory/1232-20-0x00000000011B0000-0x00000000014D0000-memory.dmpFilesize
3.1MB
-
memory/1232-18-0x000000000041EBF0-mapping.dmp
-
memory/1232-17-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2196-26-0x0000000000000000-mapping.dmp
-
memory/3036-22-0x0000000006180000-0x00000000062AF000-memory.dmpFilesize
1.2MB
-
memory/3036-29-0x0000000002C20000-0x0000000002CD1000-memory.dmpFilesize
708KB
-
memory/4000-9-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/4000-12-0x0000000006080000-0x00000000060A3000-memory.dmpFilesize
140KB
-
memory/4000-11-0x0000000005640000-0x0000000005641000-memory.dmpFilesize
4KB
-
memory/4000-10-0x00000000060E0000-0x00000000060E1000-memory.dmpFilesize
4KB
-
memory/4000-2-0x00000000738E0000-0x0000000073FCE000-memory.dmpFilesize
6.9MB
-
memory/4000-14-0x00000000067B0000-0x0000000006816000-memory.dmpFilesize
408KB
-
memory/4000-8-0x0000000005810000-0x0000000005811000-memory.dmpFilesize
4KB
-
memory/4000-7-0x0000000005680000-0x0000000005681000-memory.dmpFilesize
4KB
-
memory/4000-6-0x0000000005B80000-0x0000000005B81000-memory.dmpFilesize
4KB
-
memory/4000-5-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/4000-3-0x0000000000BE0000-0x0000000000BE1000-memory.dmpFilesize
4KB
-
memory/4000-13-0x0000000005800000-0x0000000005801000-memory.dmpFilesize
4KB