Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
26-07-2021 08:26
Static task
static1
Behavioral task
behavioral1
Sample
077869509# Invitation PQ Documents Submission QTN.pdf.exe
Resource
win7v20210410
General
-
Target
077869509# Invitation PQ Documents Submission QTN.pdf.exe
-
Size
492KB
-
MD5
18fa8099b62e8f056fe58725632b860d
-
SHA1
34be165cd7bbf63732f599cccb666a0e3af3377e
-
SHA256
9316b9fe5a317761f719e6ee8602f20b356cde2e5e566fdec0a388dc390b2bd0
-
SHA512
eada997d7167c718a0d0154a269c1a9693cddad91e71055b93b3dc55cb08ad6df4e98c993fb0ed6475970306c5ab7bf46d66ebd1272226d777241021d646a876
Malware Config
Extracted
formbook
4.1
http://www.headairload.com/jdge/
cungcaptapvu.com
lantianren.net
mydivorcepsychologist.com
bageurapparel.com
citydealmaker.com
historyegress.com
litekkutu.xyz
perksofkerala.com
flairmax.com
washingmachineservicerepair.xyz
organicbeauty.club
rehmazbeauty.com
goodgly.com
imtheonlyperson.systems
shbanjia199.com
mwfbd.com
halsonpipe.com
0927487.com
perfectpeachco.com
danielprok.com
townertoren.com
innerviewreflectionsofyou.com
fudgroups.info
ostfriesensuende.com
instafreefollowers.xyz
cryfortrade.com
wepavela.com
dwj-xj9bt.net
tiyujsqicai.com
chothuethietbiquayphim.com
behintejaratpourasa.com
thenotaryexperts.com
fncconline.com
poapay-com.xyz
nieght.com
tanheidl.com
storycraftinternational.com
freegunsafetytraining.com
latitudedaytonarealty.com
makeupheaven.club
fiathfirst.com
sonicdrovein.com
nationaltimesharerelief.com
crbhub.net
shopmocker.com
diversifiedhiring.com
angularjsacademy.com
jasoncordingleyart.com
healthybenefitsplustlus.com
vienkhopkhangbinh.asia
sstaylace.com
honolulumicroschools.com
zalihancehcp.net
cdnxsalty2.com
ylpsbla.com
bjcci.com
kingfisherwebsitesaustralia.com
distribuidoradetejados.com
xis-technology.com
yuthikaassociates.com
linqingxian.com
aimarshfly.com
simplydeliciouscooking.com
vyvelectricistas.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1248-124-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/1248-125-0x000000000041EBA0-mapping.dmp formbook behavioral2/memory/2196-131-0x0000000003330000-0x000000000335E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
077869509# Invitation PQ Documents Submission QTN.pdf.exe077869509# Invitation PQ Documents Submission QTN.pdf.exewscript.exedescription pid process target process PID 636 set thread context of 1248 636 077869509# Invitation PQ Documents Submission QTN.pdf.exe 077869509# Invitation PQ Documents Submission QTN.pdf.exe PID 1248 set thread context of 3052 1248 077869509# Invitation PQ Documents Submission QTN.pdf.exe Explorer.EXE PID 2196 set thread context of 3052 2196 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
077869509# Invitation PQ Documents Submission QTN.pdf.exewscript.exepid process 1248 077869509# Invitation PQ Documents Submission QTN.pdf.exe 1248 077869509# Invitation PQ Documents Submission QTN.pdf.exe 1248 077869509# Invitation PQ Documents Submission QTN.pdf.exe 1248 077869509# Invitation PQ Documents Submission QTN.pdf.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe 2196 wscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3052 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
077869509# Invitation PQ Documents Submission QTN.pdf.exewscript.exepid process 1248 077869509# Invitation PQ Documents Submission QTN.pdf.exe 1248 077869509# Invitation PQ Documents Submission QTN.pdf.exe 1248 077869509# Invitation PQ Documents Submission QTN.pdf.exe 2196 wscript.exe 2196 wscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
077869509# Invitation PQ Documents Submission QTN.pdf.exewscript.exedescription pid process Token: SeDebugPrivilege 1248 077869509# Invitation PQ Documents Submission QTN.pdf.exe Token: SeDebugPrivilege 2196 wscript.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3052 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
077869509# Invitation PQ Documents Submission QTN.pdf.exeExplorer.EXEwscript.exedescription pid process target process PID 636 wrote to memory of 1248 636 077869509# Invitation PQ Documents Submission QTN.pdf.exe 077869509# Invitation PQ Documents Submission QTN.pdf.exe PID 636 wrote to memory of 1248 636 077869509# Invitation PQ Documents Submission QTN.pdf.exe 077869509# Invitation PQ Documents Submission QTN.pdf.exe PID 636 wrote to memory of 1248 636 077869509# Invitation PQ Documents Submission QTN.pdf.exe 077869509# Invitation PQ Documents Submission QTN.pdf.exe PID 636 wrote to memory of 1248 636 077869509# Invitation PQ Documents Submission QTN.pdf.exe 077869509# Invitation PQ Documents Submission QTN.pdf.exe PID 636 wrote to memory of 1248 636 077869509# Invitation PQ Documents Submission QTN.pdf.exe 077869509# Invitation PQ Documents Submission QTN.pdf.exe PID 636 wrote to memory of 1248 636 077869509# Invitation PQ Documents Submission QTN.pdf.exe 077869509# Invitation PQ Documents Submission QTN.pdf.exe PID 3052 wrote to memory of 2196 3052 Explorer.EXE wscript.exe PID 3052 wrote to memory of 2196 3052 Explorer.EXE wscript.exe PID 3052 wrote to memory of 2196 3052 Explorer.EXE wscript.exe PID 2196 wrote to memory of 1156 2196 wscript.exe cmd.exe PID 2196 wrote to memory of 1156 2196 wscript.exe cmd.exe PID 2196 wrote to memory of 1156 2196 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\077869509# Invitation PQ Documents Submission QTN.pdf.exe"C:\Users\Admin\AppData\Local\Temp\077869509# Invitation PQ Documents Submission QTN.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\077869509# Invitation PQ Documents Submission QTN.pdf.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\077869509# Invitation PQ Documents Submission QTN.pdf.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/636-114-0x0000000000A00000-0x0000000000A01000-memory.dmpFilesize
4KB
-
memory/636-116-0x00000000057F0000-0x00000000057F1000-memory.dmpFilesize
4KB
-
memory/636-117-0x0000000005390000-0x0000000005391000-memory.dmpFilesize
4KB
-
memory/636-118-0x00000000052B0000-0x00000000052B1000-memory.dmpFilesize
4KB
-
memory/636-119-0x00000000055D0000-0x00000000055D2000-memory.dmpFilesize
8KB
-
memory/636-120-0x0000000007620000-0x0000000007621000-memory.dmpFilesize
4KB
-
memory/636-121-0x00000000052D0000-0x00000000052D1000-memory.dmpFilesize
4KB
-
memory/636-122-0x0000000006FC0000-0x0000000007043000-memory.dmpFilesize
524KB
-
memory/636-123-0x0000000006F00000-0x0000000006F33000-memory.dmpFilesize
204KB
-
memory/1156-132-0x0000000000000000-mapping.dmp
-
memory/1248-125-0x000000000041EBA0-mapping.dmp
-
memory/1248-126-0x00000000012B0000-0x00000000015D0000-memory.dmpFilesize
3.1MB
-
memory/1248-128-0x0000000001270000-0x0000000001284000-memory.dmpFilesize
80KB
-
memory/1248-124-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2196-129-0x0000000000000000-mapping.dmp
-
memory/2196-130-0x0000000000020000-0x0000000000047000-memory.dmpFilesize
156KB
-
memory/2196-131-0x0000000003330000-0x000000000335E000-memory.dmpFilesize
184KB
-
memory/2196-133-0x00000000049E0000-0x0000000004D00000-memory.dmpFilesize
3.1MB
-
memory/2196-134-0x0000000004DA0000-0x0000000004E33000-memory.dmpFilesize
588KB
-
memory/3052-127-0x0000000006270000-0x00000000063DE000-memory.dmpFilesize
1.4MB
-
memory/3052-135-0x00000000065F0000-0x000000000670E000-memory.dmpFilesize
1.1MB