Analysis
-
max time kernel
145s -
max time network
133s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
26-07-2021 08:26
Static task
static1
Behavioral task
behavioral1
Sample
077869509# Invitation PQ Documents Submission QTN.pdf.exe
Resource
win7v20210410
General
-
Target
077869509# Invitation PQ Documents Submission QTN.pdf.exe
-
Size
492KB
-
MD5
18fa8099b62e8f056fe58725632b860d
-
SHA1
34be165cd7bbf63732f599cccb666a0e3af3377e
-
SHA256
9316b9fe5a317761f719e6ee8602f20b356cde2e5e566fdec0a388dc390b2bd0
-
SHA512
eada997d7167c718a0d0154a269c1a9693cddad91e71055b93b3dc55cb08ad6df4e98c993fb0ed6475970306c5ab7bf46d66ebd1272226d777241021d646a876
Malware Config
Extracted
formbook
4.1
http://www.headairload.com/jdge/
cungcaptapvu.com
lantianren.net
mydivorcepsychologist.com
bageurapparel.com
citydealmaker.com
historyegress.com
litekkutu.xyz
perksofkerala.com
flairmax.com
washingmachineservicerepair.xyz
organicbeauty.club
rehmazbeauty.com
goodgly.com
imtheonlyperson.systems
shbanjia199.com
mwfbd.com
halsonpipe.com
0927487.com
perfectpeachco.com
danielprok.com
townertoren.com
innerviewreflectionsofyou.com
fudgroups.info
ostfriesensuende.com
instafreefollowers.xyz
cryfortrade.com
wepavela.com
dwj-xj9bt.net
tiyujsqicai.com
chothuethietbiquayphim.com
behintejaratpourasa.com
thenotaryexperts.com
fncconline.com
poapay-com.xyz
nieght.com
tanheidl.com
storycraftinternational.com
freegunsafetytraining.com
latitudedaytonarealty.com
makeupheaven.club
fiathfirst.com
sonicdrovein.com
nationaltimesharerelief.com
crbhub.net
shopmocker.com
diversifiedhiring.com
angularjsacademy.com
jasoncordingleyart.com
healthybenefitsplustlus.com
vienkhopkhangbinh.asia
sstaylace.com
honolulumicroschools.com
zalihancehcp.net
cdnxsalty2.com
ylpsbla.com
bjcci.com
kingfisherwebsitesaustralia.com
distribuidoradetejados.com
xis-technology.com
yuthikaassociates.com
linqingxian.com
aimarshfly.com
simplydeliciouscooking.com
vyvelectricistas.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1532-66-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1532-67-0x000000000041EBA0-mapping.dmp formbook behavioral1/memory/1688-74-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 640 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
077869509# Invitation PQ Documents Submission QTN.pdf.exe077869509# Invitation PQ Documents Submission QTN.pdf.execmmon32.exedescription pid process target process PID 540 set thread context of 1532 540 077869509# Invitation PQ Documents Submission QTN.pdf.exe 077869509# Invitation PQ Documents Submission QTN.pdf.exe PID 1532 set thread context of 1256 1532 077869509# Invitation PQ Documents Submission QTN.pdf.exe Explorer.EXE PID 1688 set thread context of 1256 1688 cmmon32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
077869509# Invitation PQ Documents Submission QTN.pdf.execmmon32.exepid process 1532 077869509# Invitation PQ Documents Submission QTN.pdf.exe 1532 077869509# Invitation PQ Documents Submission QTN.pdf.exe 1688 cmmon32.exe 1688 cmmon32.exe 1688 cmmon32.exe 1688 cmmon32.exe 1688 cmmon32.exe 1688 cmmon32.exe 1688 cmmon32.exe 1688 cmmon32.exe 1688 cmmon32.exe 1688 cmmon32.exe 1688 cmmon32.exe 1688 cmmon32.exe 1688 cmmon32.exe 1688 cmmon32.exe 1688 cmmon32.exe 1688 cmmon32.exe 1688 cmmon32.exe 1688 cmmon32.exe 1688 cmmon32.exe 1688 cmmon32.exe 1688 cmmon32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
077869509# Invitation PQ Documents Submission QTN.pdf.execmmon32.exepid process 1532 077869509# Invitation PQ Documents Submission QTN.pdf.exe 1532 077869509# Invitation PQ Documents Submission QTN.pdf.exe 1532 077869509# Invitation PQ Documents Submission QTN.pdf.exe 1688 cmmon32.exe 1688 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
077869509# Invitation PQ Documents Submission QTN.pdf.execmmon32.exedescription pid process Token: SeDebugPrivilege 1532 077869509# Invitation PQ Documents Submission QTN.pdf.exe Token: SeDebugPrivilege 1688 cmmon32.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
077869509# Invitation PQ Documents Submission QTN.pdf.exeExplorer.EXEcmmon32.exedescription pid process target process PID 540 wrote to memory of 1532 540 077869509# Invitation PQ Documents Submission QTN.pdf.exe 077869509# Invitation PQ Documents Submission QTN.pdf.exe PID 540 wrote to memory of 1532 540 077869509# Invitation PQ Documents Submission QTN.pdf.exe 077869509# Invitation PQ Documents Submission QTN.pdf.exe PID 540 wrote to memory of 1532 540 077869509# Invitation PQ Documents Submission QTN.pdf.exe 077869509# Invitation PQ Documents Submission QTN.pdf.exe PID 540 wrote to memory of 1532 540 077869509# Invitation PQ Documents Submission QTN.pdf.exe 077869509# Invitation PQ Documents Submission QTN.pdf.exe PID 540 wrote to memory of 1532 540 077869509# Invitation PQ Documents Submission QTN.pdf.exe 077869509# Invitation PQ Documents Submission QTN.pdf.exe PID 540 wrote to memory of 1532 540 077869509# Invitation PQ Documents Submission QTN.pdf.exe 077869509# Invitation PQ Documents Submission QTN.pdf.exe PID 540 wrote to memory of 1532 540 077869509# Invitation PQ Documents Submission QTN.pdf.exe 077869509# Invitation PQ Documents Submission QTN.pdf.exe PID 1256 wrote to memory of 1688 1256 Explorer.EXE cmmon32.exe PID 1256 wrote to memory of 1688 1256 Explorer.EXE cmmon32.exe PID 1256 wrote to memory of 1688 1256 Explorer.EXE cmmon32.exe PID 1256 wrote to memory of 1688 1256 Explorer.EXE cmmon32.exe PID 1688 wrote to memory of 640 1688 cmmon32.exe cmd.exe PID 1688 wrote to memory of 640 1688 cmmon32.exe cmd.exe PID 1688 wrote to memory of 640 1688 cmmon32.exe cmd.exe PID 1688 wrote to memory of 640 1688 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\077869509# Invitation PQ Documents Submission QTN.pdf.exe"C:\Users\Admin\AppData\Local\Temp\077869509# Invitation PQ Documents Submission QTN.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\077869509# Invitation PQ Documents Submission QTN.pdf.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\077869509# Invitation PQ Documents Submission QTN.pdf.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/540-60-0x0000000000FF0000-0x0000000000FF1000-memory.dmpFilesize
4KB
-
memory/540-62-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB
-
memory/540-63-0x00000000003D0000-0x00000000003D2000-memory.dmpFilesize
8KB
-
memory/540-64-0x0000000005020000-0x00000000050A3000-memory.dmpFilesize
524KB
-
memory/540-65-0x0000000000F40000-0x0000000000F73000-memory.dmpFilesize
204KB
-
memory/640-72-0x0000000000000000-mapping.dmp
-
memory/1256-77-0x0000000007010000-0x000000000715F000-memory.dmpFilesize
1.3MB
-
memory/1256-70-0x0000000006860000-0x000000000691C000-memory.dmpFilesize
752KB
-
memory/1532-69-0x0000000000280000-0x0000000000294000-memory.dmpFilesize
80KB
-
memory/1532-68-0x00000000008F0000-0x0000000000BF3000-memory.dmpFilesize
3.0MB
-
memory/1532-67-0x000000000041EBA0-mapping.dmp
-
memory/1532-66-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1688-71-0x0000000000000000-mapping.dmp
-
memory/1688-73-0x0000000000380000-0x000000000038D000-memory.dmpFilesize
52KB
-
memory/1688-75-0x0000000001ED0000-0x00000000021D3000-memory.dmpFilesize
3.0MB
-
memory/1688-74-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/1688-76-0x0000000001CA0000-0x0000000001D33000-memory.dmpFilesize
588KB