Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
26-07-2021 08:26
Static task
static1
Behavioral task
behavioral1
Sample
077869509# Invitation PQ Documents Submission QTN.pdf.exe
Resource
win7v20210410
General
-
Target
077869509# Invitation PQ Documents Submission QTN.pdf.exe
-
Size
492KB
-
MD5
18fa8099b62e8f056fe58725632b860d
-
SHA1
34be165cd7bbf63732f599cccb666a0e3af3377e
-
SHA256
9316b9fe5a317761f719e6ee8602f20b356cde2e5e566fdec0a388dc390b2bd0
-
SHA512
eada997d7167c718a0d0154a269c1a9693cddad91e71055b93b3dc55cb08ad6df4e98c993fb0ed6475970306c5ab7bf46d66ebd1272226d777241021d646a876
Malware Config
Extracted
formbook
4.1
http://www.headairload.com/jdge/
cungcaptapvu.com
lantianren.net
mydivorcepsychologist.com
bageurapparel.com
citydealmaker.com
historyegress.com
litekkutu.xyz
perksofkerala.com
flairmax.com
washingmachineservicerepair.xyz
organicbeauty.club
rehmazbeauty.com
goodgly.com
imtheonlyperson.systems
shbanjia199.com
mwfbd.com
halsonpipe.com
0927487.com
perfectpeachco.com
danielprok.com
townertoren.com
innerviewreflectionsofyou.com
fudgroups.info
ostfriesensuende.com
instafreefollowers.xyz
cryfortrade.com
wepavela.com
dwj-xj9bt.net
tiyujsqicai.com
chothuethietbiquayphim.com
behintejaratpourasa.com
thenotaryexperts.com
fncconline.com
poapay-com.xyz
nieght.com
tanheidl.com
storycraftinternational.com
freegunsafetytraining.com
latitudedaytonarealty.com
makeupheaven.club
fiathfirst.com
sonicdrovein.com
nationaltimesharerelief.com
crbhub.net
shopmocker.com
diversifiedhiring.com
angularjsacademy.com
jasoncordingleyart.com
healthybenefitsplustlus.com
vienkhopkhangbinh.asia
sstaylace.com
honolulumicroschools.com
zalihancehcp.net
cdnxsalty2.com
ylpsbla.com
bjcci.com
kingfisherwebsitesaustralia.com
distribuidoradetejados.com
xis-technology.com
yuthikaassociates.com
linqingxian.com
aimarshfly.com
simplydeliciouscooking.com
vyvelectricistas.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2228-124-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2228-125-0x000000000041EBA0-mapping.dmp formbook behavioral2/memory/996-134-0x0000000001000000-0x000000000102E000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
077869509# Invitation PQ Documents Submission QTN.pdf.exe077869509# Invitation PQ Documents Submission QTN.pdf.execontrol.exedescription pid process target process PID 992 set thread context of 2228 992 077869509# Invitation PQ Documents Submission QTN.pdf.exe 077869509# Invitation PQ Documents Submission QTN.pdf.exe PID 2228 set thread context of 3020 2228 077869509# Invitation PQ Documents Submission QTN.pdf.exe Explorer.EXE PID 2228 set thread context of 3020 2228 077869509# Invitation PQ Documents Submission QTN.pdf.exe Explorer.EXE PID 996 set thread context of 3020 996 control.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
077869509# Invitation PQ Documents Submission QTN.pdf.execontrol.exepid process 2228 077869509# Invitation PQ Documents Submission QTN.pdf.exe 2228 077869509# Invitation PQ Documents Submission QTN.pdf.exe 2228 077869509# Invitation PQ Documents Submission QTN.pdf.exe 2228 077869509# Invitation PQ Documents Submission QTN.pdf.exe 2228 077869509# Invitation PQ Documents Submission QTN.pdf.exe 2228 077869509# Invitation PQ Documents Submission QTN.pdf.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe 996 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3020 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
077869509# Invitation PQ Documents Submission QTN.pdf.execontrol.exepid process 2228 077869509# Invitation PQ Documents Submission QTN.pdf.exe 2228 077869509# Invitation PQ Documents Submission QTN.pdf.exe 2228 077869509# Invitation PQ Documents Submission QTN.pdf.exe 2228 077869509# Invitation PQ Documents Submission QTN.pdf.exe 996 control.exe 996 control.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
077869509# Invitation PQ Documents Submission QTN.pdf.execontrol.exedescription pid process Token: SeDebugPrivilege 2228 077869509# Invitation PQ Documents Submission QTN.pdf.exe Token: SeDebugPrivilege 996 control.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3020 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
077869509# Invitation PQ Documents Submission QTN.pdf.exeExplorer.EXEcontrol.exedescription pid process target process PID 992 wrote to memory of 2228 992 077869509# Invitation PQ Documents Submission QTN.pdf.exe 077869509# Invitation PQ Documents Submission QTN.pdf.exe PID 992 wrote to memory of 2228 992 077869509# Invitation PQ Documents Submission QTN.pdf.exe 077869509# Invitation PQ Documents Submission QTN.pdf.exe PID 992 wrote to memory of 2228 992 077869509# Invitation PQ Documents Submission QTN.pdf.exe 077869509# Invitation PQ Documents Submission QTN.pdf.exe PID 992 wrote to memory of 2228 992 077869509# Invitation PQ Documents Submission QTN.pdf.exe 077869509# Invitation PQ Documents Submission QTN.pdf.exe PID 992 wrote to memory of 2228 992 077869509# Invitation PQ Documents Submission QTN.pdf.exe 077869509# Invitation PQ Documents Submission QTN.pdf.exe PID 992 wrote to memory of 2228 992 077869509# Invitation PQ Documents Submission QTN.pdf.exe 077869509# Invitation PQ Documents Submission QTN.pdf.exe PID 3020 wrote to memory of 996 3020 Explorer.EXE control.exe PID 3020 wrote to memory of 996 3020 Explorer.EXE control.exe PID 3020 wrote to memory of 996 3020 Explorer.EXE control.exe PID 996 wrote to memory of 1276 996 control.exe cmd.exe PID 996 wrote to memory of 1276 996 control.exe cmd.exe PID 996 wrote to memory of 1276 996 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\077869509# Invitation PQ Documents Submission QTN.pdf.exe"C:\Users\Admin\AppData\Local\Temp\077869509# Invitation PQ Documents Submission QTN.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\077869509# Invitation PQ Documents Submission QTN.pdf.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\077869509# Invitation PQ Documents Submission QTN.pdf.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/992-121-0x0000000006D40000-0x0000000006D41000-memory.dmpFilesize
4KB
-
memory/992-123-0x0000000006610000-0x0000000006643000-memory.dmpFilesize
204KB
-
memory/992-117-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB
-
memory/992-118-0x0000000004940000-0x0000000004941000-memory.dmpFilesize
4KB
-
memory/992-119-0x0000000004A10000-0x0000000004F0E000-memory.dmpFilesize
5.0MB
-
memory/992-120-0x0000000004C90000-0x0000000004C92000-memory.dmpFilesize
8KB
-
memory/992-116-0x0000000004F10000-0x0000000004F11000-memory.dmpFilesize
4KB
-
memory/992-122-0x00000000066B0000-0x0000000006733000-memory.dmpFilesize
524KB
-
memory/992-114-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/996-136-0x0000000004940000-0x00000000049D3000-memory.dmpFilesize
588KB
-
memory/996-131-0x0000000000000000-mapping.dmp
-
memory/996-135-0x0000000004580000-0x00000000048A0000-memory.dmpFilesize
3.1MB
-
memory/996-134-0x0000000001000000-0x000000000102E000-memory.dmpFilesize
184KB
-
memory/996-133-0x0000000001050000-0x0000000001070000-memory.dmpFilesize
128KB
-
memory/1276-132-0x0000000000000000-mapping.dmp
-
memory/2228-125-0x000000000041EBA0-mapping.dmp
-
memory/2228-129-0x0000000003170000-0x0000000003184000-memory.dmpFilesize
80KB
-
memory/2228-127-0x0000000001410000-0x0000000001424000-memory.dmpFilesize
80KB
-
memory/2228-126-0x0000000001430000-0x0000000001750000-memory.dmpFilesize
3.1MB
-
memory/2228-124-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3020-130-0x0000000003090000-0x000000000316E000-memory.dmpFilesize
888KB
-
memory/3020-128-0x0000000006C40000-0x0000000006DBD000-memory.dmpFilesize
1.5MB
-
memory/3020-137-0x0000000006E60000-0x0000000006FB3000-memory.dmpFilesize
1.3MB