Analysis
-
max time kernel
146s -
max time network
14s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
27-02-2021 06:42
Static task
static1
Behavioral task
behavioral1
Sample
doc359680138546284.pdf.exe
Resource
win7v20201028
General
-
Target
doc359680138546284.pdf.exe
-
Size
368KB
-
MD5
07c858ed1fe8ee34db817fa6e9fc87f3
-
SHA1
5d22b7982a5ea8233cf18e20c57b3e90d90a48d6
-
SHA256
b04fb6a2bc53196885c36c1de64a717a47bd0c450f2948999c368cf489e9ffb8
-
SHA512
07e38d23692aa1a99153548572a261d9353abe1e85f5c4df25d3097eaed3e364f9b8eba89da29858b8f4c793b4fa9b45113a69f35ce1d4624dc9bba20a866568
Malware Config
Extracted
formbook
http://www.supinapp.com/grv/
morganofatlanta.com
vz473.com
hengetelt.com
bailcally.com
virtuosoonline.com
tenthousandli.com
ohanamascota.com
digi-plates.com
prismagtech.com
we-cinema.com
372680.com
smartautoexpert.xyz
mrxzg.com
apartment-brussels.com
reverseincubator.com
linkasean.com
yummicrabva.com
diguchaye.com
reaktorfatura.com
thecatsaysno.com
mpgcommunications.net
lindustrieetleca.com
seosansar.com
alohalily.com
novergi.com
universityincanada.info
atrocity.xyz
johnsonballoonblessings.com
laurelmcintosh.com
nubedepalabras.com
ycmath.com
daveysdestinations.com
yourgutterguru.com
mayas.website
bessgarments.com
xhegu.com
mybusinessdoor.com
vivaceactivewear.com
nongyan.net
tgi-mail.net
j999a.com
slteka.com
pikipikiit.com
as0594.com
insuremydriverslicense.com
kclundsblades.com
haircleanerpro.com
charlesnwahiwe.com
ervoth.com
authentiekinnovations.com
molvmg.icu
xn--k1abtc6be.xn--p1acf
arm-srl.com
hood2healer.com
austinchapter7.com
clarityentct.com
bryllaw.com
twinworksllc.com
top-trend.website
rueschlink.com
oogilab.com
thewritersbookshelf.com
jademarkproducts.com
400city.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/332-8-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/332-9-0x000000000041EC20-mapping.dmp formbook behavioral1/memory/816-20-0x00000000000F0000-0x000000000011E000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1224 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
doc359680138546284.pdf.exedoc359680138546284.pdf.execmstp.exedescription pid process target process PID 1108 set thread context of 332 1108 doc359680138546284.pdf.exe doc359680138546284.pdf.exe PID 332 set thread context of 1264 332 doc359680138546284.pdf.exe Explorer.EXE PID 332 set thread context of 1264 332 doc359680138546284.pdf.exe Explorer.EXE PID 816 set thread context of 1264 816 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
doc359680138546284.pdf.execmstp.exepid process 332 doc359680138546284.pdf.exe 332 doc359680138546284.pdf.exe 332 doc359680138546284.pdf.exe 816 cmstp.exe 816 cmstp.exe 816 cmstp.exe 816 cmstp.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
doc359680138546284.pdf.execmstp.exepid process 332 doc359680138546284.pdf.exe 332 doc359680138546284.pdf.exe 332 doc359680138546284.pdf.exe 332 doc359680138546284.pdf.exe 816 cmstp.exe 816 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
doc359680138546284.pdf.execmstp.exedescription pid process Token: SeDebugPrivilege 332 doc359680138546284.pdf.exe Token: SeDebugPrivilege 816 cmstp.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
doc359680138546284.pdf.exedoc359680138546284.pdf.execmstp.exedescription pid process target process PID 1108 wrote to memory of 332 1108 doc359680138546284.pdf.exe doc359680138546284.pdf.exe PID 1108 wrote to memory of 332 1108 doc359680138546284.pdf.exe doc359680138546284.pdf.exe PID 1108 wrote to memory of 332 1108 doc359680138546284.pdf.exe doc359680138546284.pdf.exe PID 1108 wrote to memory of 332 1108 doc359680138546284.pdf.exe doc359680138546284.pdf.exe PID 1108 wrote to memory of 332 1108 doc359680138546284.pdf.exe doc359680138546284.pdf.exe PID 1108 wrote to memory of 332 1108 doc359680138546284.pdf.exe doc359680138546284.pdf.exe PID 1108 wrote to memory of 332 1108 doc359680138546284.pdf.exe doc359680138546284.pdf.exe PID 1108 wrote to memory of 332 1108 doc359680138546284.pdf.exe doc359680138546284.pdf.exe PID 1108 wrote to memory of 332 1108 doc359680138546284.pdf.exe doc359680138546284.pdf.exe PID 1108 wrote to memory of 332 1108 doc359680138546284.pdf.exe doc359680138546284.pdf.exe PID 332 wrote to memory of 816 332 doc359680138546284.pdf.exe cmstp.exe PID 332 wrote to memory of 816 332 doc359680138546284.pdf.exe cmstp.exe PID 332 wrote to memory of 816 332 doc359680138546284.pdf.exe cmstp.exe PID 332 wrote to memory of 816 332 doc359680138546284.pdf.exe cmstp.exe PID 332 wrote to memory of 816 332 doc359680138546284.pdf.exe cmstp.exe PID 332 wrote to memory of 816 332 doc359680138546284.pdf.exe cmstp.exe PID 332 wrote to memory of 816 332 doc359680138546284.pdf.exe cmstp.exe PID 816 wrote to memory of 1224 816 cmstp.exe cmd.exe PID 816 wrote to memory of 1224 816 cmstp.exe cmd.exe PID 816 wrote to memory of 1224 816 cmstp.exe cmd.exe PID 816 wrote to memory of 1224 816 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\doc359680138546284.pdf.exe"C:\Users\Admin\AppData\Local\Temp\doc359680138546284.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\doc359680138546284.pdf.exe"C:\Users\Admin\AppData\Local\Temp\doc359680138546284.pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\doc359680138546284.pdf.exe"5⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/332-8-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/332-14-0x00000000002E0000-0x00000000002F4000-memory.dmpFilesize
80KB
-
memory/332-12-0x00000000002A0000-0x00000000002B4000-memory.dmpFilesize
80KB
-
memory/332-11-0x0000000000990000-0x0000000000C93000-memory.dmpFilesize
3.0MB
-
memory/332-9-0x000000000041EC20-mapping.dmp
-
memory/816-16-0x0000000000000000-mapping.dmp
-
memory/816-17-0x00000000760D1000-0x00000000760D3000-memory.dmpFilesize
8KB
-
memory/816-22-0x00000000020A0000-0x0000000002133000-memory.dmpFilesize
588KB
-
memory/816-21-0x0000000001D90000-0x0000000002093000-memory.dmpFilesize
3.0MB
-
memory/816-19-0x00000000007E0000-0x00000000007F8000-memory.dmpFilesize
96KB
-
memory/816-20-0x00000000000F0000-0x000000000011E000-memory.dmpFilesize
184KB
-
memory/1108-2-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/1108-7-0x00000000011E0000-0x0000000001234000-memory.dmpFilesize
336KB
-
memory/1108-3-0x00000000012E0000-0x00000000012E1000-memory.dmpFilesize
4KB
-
memory/1108-5-0x0000000001260000-0x0000000001261000-memory.dmpFilesize
4KB
-
memory/1108-6-0x00000000005E0000-0x00000000005E3000-memory.dmpFilesize
12KB
-
memory/1224-18-0x0000000000000000-mapping.dmp
-
memory/1264-15-0x0000000007460000-0x00000000075DB000-memory.dmpFilesize
1.5MB
-
memory/1264-13-0x0000000006880000-0x00000000069BF000-memory.dmpFilesize
1.2MB