Analysis
-
max time kernel
148s -
max time network
140s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
27-02-2021 07:13
Static task
static1
Behavioral task
behavioral1
Sample
Bookibg Confirmation_Pdf.exe
Resource
win7v20201028
General
-
Target
Bookibg Confirmation_Pdf.exe
-
Size
792KB
-
MD5
f8ebfd07c19a299ac8da762992a3c36b
-
SHA1
7ef77d36b5bc3ab145d6482396c9d73500083859
-
SHA256
929a7bad454fe91b472f3cf802633eaab7c4673e55a9dc03ff820cedf8309251
-
SHA512
5f0b71f880408f306ea267098f46b340538cf4529d9c8c2838694eef9047410bf0bbed1f2f11c5addf50eb94eb0029db87eb8730349d1a5b63603e06ab61ac2f
Malware Config
Extracted
formbook
http://www.workonlinetimallen.com/dll/
nyeconcreations.com
generar-k.com
refugiodelmate.com
elementclubhouse.com
freescorrs.xyz
tonesweettone.com
lojachicco.com
cyberxchange.net
strobelsolutions.com
tipsytravelerbar.com
shesheofnewyork.com
jdallmed.com
woefys.online
naviwatch.net
yuelvzuche.com
thehoneysuppliers.site
smokindeebflavors.com
preventvaccins.com
thepraisehouse.com
lgbtpridedirectory.com
bestconcretelifting.com
commissary.xyz
jakeleeeakin.info
partakpakhsh.com
mystyleonline.online
brunoloulopes.com
softwarexcompanies.com
stockincloud.net
volemate.com
pubjek.com
miamibotany.com
khoing.com
abdpublicidad.com
sundialandpanel.com
latitiaseymour.xyz
ameluskajewelry.net
coltivazioneelementare.info
ontoicase.com
coeurdeconscience.com
komgo.net
literatur.site
shopbrandnew.com
propertiesnaija.com
vaca2day.net
laytikes.com
cryptocustodianship.com
chicagoarthaus.com
worm-tea.com
purchase-support.com
cdamultisport.com
capecodmicrowedding.com
firsttimehomebuyerusinfo.com
thedeepdivelab.com
xn--eiswrfelform-glb.com
oceanupdate.xyz
s8agency.com
lovethybodi.com
xeonnet.com
verificationrelay.xyz
0310li.com
richardpanitch.com
jaydenmichaelgouchie.com
oiltankremovaljc.com
olenfex.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2756-13-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2756-14-0x000000000041EBD0-mapping.dmp formbook behavioral2/memory/748-21-0x0000000000D30000-0x0000000000D5E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Bookibg Confirmation_Pdf.exeBookibg Confirmation_Pdf.execscript.exedescription pid process target process PID 2604 set thread context of 2756 2604 Bookibg Confirmation_Pdf.exe Bookibg Confirmation_Pdf.exe PID 2756 set thread context of 2828 2756 Bookibg Confirmation_Pdf.exe Explorer.EXE PID 748 set thread context of 2828 748 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
Bookibg Confirmation_Pdf.exeBookibg Confirmation_Pdf.execscript.exepid process 2604 Bookibg Confirmation_Pdf.exe 2604 Bookibg Confirmation_Pdf.exe 2756 Bookibg Confirmation_Pdf.exe 2756 Bookibg Confirmation_Pdf.exe 2756 Bookibg Confirmation_Pdf.exe 2756 Bookibg Confirmation_Pdf.exe 748 cscript.exe 748 cscript.exe 748 cscript.exe 748 cscript.exe 748 cscript.exe 748 cscript.exe 748 cscript.exe 748 cscript.exe 748 cscript.exe 748 cscript.exe 748 cscript.exe 748 cscript.exe 748 cscript.exe 748 cscript.exe 748 cscript.exe 748 cscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Bookibg Confirmation_Pdf.execscript.exepid process 2756 Bookibg Confirmation_Pdf.exe 2756 Bookibg Confirmation_Pdf.exe 2756 Bookibg Confirmation_Pdf.exe 748 cscript.exe 748 cscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Bookibg Confirmation_Pdf.exeBookibg Confirmation_Pdf.execscript.exedescription pid process Token: SeDebugPrivilege 2604 Bookibg Confirmation_Pdf.exe Token: SeDebugPrivilege 2756 Bookibg Confirmation_Pdf.exe Token: SeDebugPrivilege 748 cscript.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Bookibg Confirmation_Pdf.exeExplorer.EXEcscript.exedescription pid process target process PID 2604 wrote to memory of 508 2604 Bookibg Confirmation_Pdf.exe Bookibg Confirmation_Pdf.exe PID 2604 wrote to memory of 508 2604 Bookibg Confirmation_Pdf.exe Bookibg Confirmation_Pdf.exe PID 2604 wrote to memory of 508 2604 Bookibg Confirmation_Pdf.exe Bookibg Confirmation_Pdf.exe PID 2604 wrote to memory of 2756 2604 Bookibg Confirmation_Pdf.exe Bookibg Confirmation_Pdf.exe PID 2604 wrote to memory of 2756 2604 Bookibg Confirmation_Pdf.exe Bookibg Confirmation_Pdf.exe PID 2604 wrote to memory of 2756 2604 Bookibg Confirmation_Pdf.exe Bookibg Confirmation_Pdf.exe PID 2604 wrote to memory of 2756 2604 Bookibg Confirmation_Pdf.exe Bookibg Confirmation_Pdf.exe PID 2604 wrote to memory of 2756 2604 Bookibg Confirmation_Pdf.exe Bookibg Confirmation_Pdf.exe PID 2604 wrote to memory of 2756 2604 Bookibg Confirmation_Pdf.exe Bookibg Confirmation_Pdf.exe PID 2828 wrote to memory of 748 2828 Explorer.EXE cscript.exe PID 2828 wrote to memory of 748 2828 Explorer.EXE cscript.exe PID 2828 wrote to memory of 748 2828 Explorer.EXE cscript.exe PID 748 wrote to memory of 740 748 cscript.exe cmd.exe PID 748 wrote to memory of 740 748 cscript.exe cmd.exe PID 748 wrote to memory of 740 748 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Bookibg Confirmation_Pdf.exe"C:\Users\Admin\AppData\Local\Temp\Bookibg Confirmation_Pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Bookibg Confirmation_Pdf.exe"C:\Users\Admin\AppData\Local\Temp\Bookibg Confirmation_Pdf.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Bookibg Confirmation_Pdf.exe"C:\Users\Admin\AppData\Local\Temp\Bookibg Confirmation_Pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Bookibg Confirmation_Pdf.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/740-22-0x0000000000000000-mapping.dmp
-
memory/748-19-0x0000000000000000-mapping.dmp
-
memory/748-25-0x0000000004D10000-0x0000000004DA3000-memory.dmpFilesize
588KB
-
memory/748-23-0x0000000004ED0000-0x00000000051F0000-memory.dmpFilesize
3.1MB
-
memory/748-20-0x0000000001270000-0x0000000001297000-memory.dmpFilesize
156KB
-
memory/748-21-0x0000000000D30000-0x0000000000D5E000-memory.dmpFilesize
184KB
-
memory/2604-8-0x0000000007440000-0x0000000007441000-memory.dmpFilesize
4KB
-
memory/2604-2-0x0000000073940000-0x000000007402E000-memory.dmpFilesize
6.9MB
-
memory/2604-11-0x000000000AA40000-0x000000000AA43000-memory.dmpFilesize
12KB
-
memory/2604-12-0x00000000090D0000-0x0000000009124000-memory.dmpFilesize
336KB
-
memory/2604-10-0x0000000007650000-0x0000000007651000-memory.dmpFilesize
4KB
-
memory/2604-3-0x00000000005F0000-0x00000000005F1000-memory.dmpFilesize
4KB
-
memory/2604-5-0x0000000007390000-0x0000000007391000-memory.dmpFilesize
4KB
-
memory/2604-6-0x0000000007930000-0x0000000007931000-memory.dmpFilesize
4KB
-
memory/2604-7-0x00000000074D0000-0x00000000074D1000-memory.dmpFilesize
4KB
-
memory/2604-9-0x00000000076C0000-0x00000000076C1000-memory.dmpFilesize
4KB
-
memory/2756-13-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2756-17-0x0000000001710000-0x0000000001724000-memory.dmpFilesize
80KB
-
memory/2756-16-0x00000000017B0000-0x0000000001AD0000-memory.dmpFilesize
3.1MB
-
memory/2756-14-0x000000000041EBD0-mapping.dmp
-
memory/2828-18-0x00000000058B0000-0x00000000059EC000-memory.dmpFilesize
1.2MB
-
memory/2828-26-0x0000000003280000-0x0000000003343000-memory.dmpFilesize
780KB