Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
23-07-2021 12:51
Static task
static1
Behavioral task
behavioral1
Sample
Documents pdf.exe
Resource
win7v20210408
General
-
Target
Documents pdf.exe
-
Size
533KB
-
MD5
027d8e07155bc564f7b522183018efe6
-
SHA1
10348a89cc88e0911f507a2d4aa50071718b096c
-
SHA256
90e7c97ea4917a6efb5c0a69bd6f481b1a5023d6f8ad0f22d123c417edff8a68
-
SHA512
5d1c8f6f0121df79767de6de22e7f513972aceeafd7376086511c8575187e224190a408340ec57835e9c0e0a347d47d7e4fd70c8618f91cf638c23b3acc5c3d3
Malware Config
Extracted
formbook
4.1
http://www.valiantfinancial.net/hth0/
grahamandjana.com
surfpodcastnetwork.com
valkyrie20.com
hire4looks.com
wewalkfastasone.com
saveourschoolyear.com
5g23e.com
abusinesssystems.com
telefonepantalla.com
tailorscafe.com
schwarzer-markt.net
stopwatch247.com
458grandbetting.com
xpovision.com
kutkingbarbering.life
kppp-guxxz.xyz
chuckwagon-chow.com
la-casa-delle-vita.com
creativesocials.com
negociacoeshojebr.com
conservativestyle.life
825tache.com
birthmothersmaine.com
jwrl.net
gardiantparts.com
contodosyparaelbiendetodos.com
actymall.com
oxyde.net
adagiomusicacademy.com
newjerseyscubadiving.net
87oaks.com
overt.website
home-made-gifts.com
viralgoats.com
camediahub.com
bankruptcyprobabilities.com
yourlifematterswellness.email
earnestjourneycourses.com
landonpaints.com
aesegroup.com
omegle99.com
sparklinmomma.com
cofcwzrf.com
jam-nins.com
mazacz.com
copdrule.info
cahayaqq.life
helps-paxful.com
gerado.online
patanamedia.com
fromfeartotrust.com
deux-studios.com
wallinders.com
nilton-g.com
yijiamobile.com
ocheap3dbuy.com
flima2020a.site
battlefieldtitle.site
ferrebaviera.com
plushmint.com
achievementfound.com
dontbringcovidhome.com
cultigique.com
waveplumb.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1488-70-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1488-71-0x000000000041ED60-mapping.dmp formbook behavioral1/memory/432-79-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1424 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Documents pdf.exeDocuments pdf.exewlanext.exedescription pid process target process PID 1348 set thread context of 1488 1348 Documents pdf.exe Documents pdf.exe PID 1488 set thread context of 1220 1488 Documents pdf.exe Explorer.EXE PID 1488 set thread context of 1220 1488 Documents pdf.exe Explorer.EXE PID 432 set thread context of 1220 432 wlanext.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
Documents pdf.exewlanext.exepid process 1488 Documents pdf.exe 1488 Documents pdf.exe 1488 Documents pdf.exe 432 wlanext.exe 432 wlanext.exe 432 wlanext.exe 432 wlanext.exe 432 wlanext.exe 432 wlanext.exe 432 wlanext.exe 432 wlanext.exe 432 wlanext.exe 432 wlanext.exe 432 wlanext.exe 432 wlanext.exe 432 wlanext.exe 432 wlanext.exe 432 wlanext.exe 432 wlanext.exe 432 wlanext.exe 432 wlanext.exe 432 wlanext.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Documents pdf.exewlanext.exepid process 1488 Documents pdf.exe 1488 Documents pdf.exe 1488 Documents pdf.exe 1488 Documents pdf.exe 432 wlanext.exe 432 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Documents pdf.exewlanext.exedescription pid process Token: SeDebugPrivilege 1488 Documents pdf.exe Token: SeDebugPrivilege 432 wlanext.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
Documents pdf.exeExplorer.EXEwlanext.exedescription pid process target process PID 1348 wrote to memory of 688 1348 Documents pdf.exe schtasks.exe PID 1348 wrote to memory of 688 1348 Documents pdf.exe schtasks.exe PID 1348 wrote to memory of 688 1348 Documents pdf.exe schtasks.exe PID 1348 wrote to memory of 688 1348 Documents pdf.exe schtasks.exe PID 1348 wrote to memory of 1488 1348 Documents pdf.exe Documents pdf.exe PID 1348 wrote to memory of 1488 1348 Documents pdf.exe Documents pdf.exe PID 1348 wrote to memory of 1488 1348 Documents pdf.exe Documents pdf.exe PID 1348 wrote to memory of 1488 1348 Documents pdf.exe Documents pdf.exe PID 1348 wrote to memory of 1488 1348 Documents pdf.exe Documents pdf.exe PID 1348 wrote to memory of 1488 1348 Documents pdf.exe Documents pdf.exe PID 1348 wrote to memory of 1488 1348 Documents pdf.exe Documents pdf.exe PID 1220 wrote to memory of 432 1220 Explorer.EXE wlanext.exe PID 1220 wrote to memory of 432 1220 Explorer.EXE wlanext.exe PID 1220 wrote to memory of 432 1220 Explorer.EXE wlanext.exe PID 1220 wrote to memory of 432 1220 Explorer.EXE wlanext.exe PID 432 wrote to memory of 1424 432 wlanext.exe cmd.exe PID 432 wrote to memory of 1424 432 wlanext.exe cmd.exe PID 432 wrote to memory of 1424 432 wlanext.exe cmd.exe PID 432 wrote to memory of 1424 432 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\Documents pdf.exe"C:\Users\Admin\AppData\Local\Temp\Documents pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PwTRIU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3498.tmp"3⤵
- Creates scheduled task(s)
PID:688 -
C:\Users\Admin\AppData\Local\Temp\Documents pdf.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1488 -
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Documents pdf.exe"3⤵
- Deletes itself
PID:1424
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3498.tmpMD5
5ff73a757e03c8f9e39892a48f59afb2
SHA18d1f72e1cdb36ae307f74b8a7299824473a574a2
SHA2562a22b7c9b4eb52ff11dab357e2e22f72fd113e3e694e5ec12485944cf549f489
SHA5124bd8ff4bd44d555aaee05cb391e00c971495adecf295cfa5aa043c3d1d925d6cdd8f9f93eee95456ee29ea0856864da88dddae8e3908769626dcecc1980b6e4b
-
memory/432-82-0x0000000001E30000-0x0000000001EC3000-memory.dmpFilesize
588KB
-
memory/432-81-0x0000000001FC0000-0x00000000022C3000-memory.dmpFilesize
3.0MB
-
memory/432-79-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/432-78-0x00000000003C0000-0x00000000003D6000-memory.dmpFilesize
88KB
-
memory/432-77-0x0000000000000000-mapping.dmp
-
memory/688-68-0x0000000000000000-mapping.dmp
-
memory/1220-74-0x0000000006130000-0x0000000006271000-memory.dmpFilesize
1.3MB
-
memory/1220-83-0x0000000006280000-0x0000000006345000-memory.dmpFilesize
788KB
-
memory/1220-76-0x0000000003EB0000-0x0000000003F90000-memory.dmpFilesize
896KB
-
memory/1348-66-0x0000000004B90000-0x0000000004C1A000-memory.dmpFilesize
552KB
-
memory/1348-67-0x0000000004440000-0x000000000447A000-memory.dmpFilesize
232KB
-
memory/1348-60-0x0000000010FE0000-0x0000000010FE1000-memory.dmpFilesize
4KB
-
memory/1348-65-0x00000000048E5000-0x00000000048F6000-memory.dmpFilesize
68KB
-
memory/1348-64-0x0000000003EF0000-0x0000000003EF2000-memory.dmpFilesize
8KB
-
memory/1348-63-0x00000000048E0000-0x00000000048E1000-memory.dmpFilesize
4KB
-
memory/1348-62-0x0000000003F10000-0x0000000003F77000-memory.dmpFilesize
412KB
-
memory/1424-80-0x0000000000000000-mapping.dmp
-
memory/1488-73-0x0000000000190000-0x00000000001A4000-memory.dmpFilesize
80KB
-
memory/1488-72-0x0000000000AA0000-0x0000000000DA3000-memory.dmpFilesize
3.0MB
-
memory/1488-71-0x000000000041ED60-mapping.dmp
-
memory/1488-75-0x0000000000220000-0x0000000000234000-memory.dmpFilesize
80KB
-
memory/1488-70-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB