Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
26-07-2021 08:26
Static task
static1
Behavioral task
behavioral1
Sample
Documents Submission QTN.pdf.exe
Resource
win7v20210410
General
-
Target
Documents Submission QTN.pdf.exe
-
Size
492KB
-
MD5
18fa8099b62e8f056fe58725632b860d
-
SHA1
34be165cd7bbf63732f599cccb666a0e3af3377e
-
SHA256
9316b9fe5a317761f719e6ee8602f20b356cde2e5e566fdec0a388dc390b2bd0
-
SHA512
eada997d7167c718a0d0154a269c1a9693cddad91e71055b93b3dc55cb08ad6df4e98c993fb0ed6475970306c5ab7bf46d66ebd1272226d777241021d646a876
Malware Config
Extracted
formbook
4.1
http://www.headairload.com/jdge/
cungcaptapvu.com
lantianren.net
mydivorcepsychologist.com
bageurapparel.com
citydealmaker.com
historyegress.com
litekkutu.xyz
perksofkerala.com
flairmax.com
washingmachineservicerepair.xyz
organicbeauty.club
rehmazbeauty.com
goodgly.com
imtheonlyperson.systems
shbanjia199.com
mwfbd.com
halsonpipe.com
0927487.com
perfectpeachco.com
danielprok.com
townertoren.com
innerviewreflectionsofyou.com
fudgroups.info
ostfriesensuende.com
instafreefollowers.xyz
cryfortrade.com
wepavela.com
dwj-xj9bt.net
tiyujsqicai.com
chothuethietbiquayphim.com
behintejaratpourasa.com
thenotaryexperts.com
fncconline.com
poapay-com.xyz
nieght.com
tanheidl.com
storycraftinternational.com
freegunsafetytraining.com
latitudedaytonarealty.com
makeupheaven.club
fiathfirst.com
sonicdrovein.com
nationaltimesharerelief.com
crbhub.net
shopmocker.com
diversifiedhiring.com
angularjsacademy.com
jasoncordingleyart.com
healthybenefitsplustlus.com
vienkhopkhangbinh.asia
sstaylace.com
honolulumicroschools.com
zalihancehcp.net
cdnxsalty2.com
ylpsbla.com
bjcci.com
kingfisherwebsitesaustralia.com
distribuidoradetejados.com
xis-technology.com
yuthikaassociates.com
linqingxian.com
aimarshfly.com
simplydeliciouscooking.com
vyvelectricistas.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/972-124-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/972-125-0x000000000041EBA0-mapping.dmp formbook behavioral2/memory/972-128-0x0000000000F00000-0x0000000000FAE000-memory.dmp formbook behavioral2/memory/3644-132-0x0000000000C40000-0x0000000000C6E000-memory.dmp formbook behavioral2/memory/3644-134-0x0000000000CD0000-0x0000000000E1A000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Documents Submission QTN.pdf.exeDocuments Submission QTN.pdf.exerundll32.exedescription pid process target process PID 900 set thread context of 972 900 Documents Submission QTN.pdf.exe Documents Submission QTN.pdf.exe PID 972 set thread context of 8 972 Documents Submission QTN.pdf.exe Explorer.EXE PID 3644 set thread context of 8 3644 rundll32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
Documents Submission QTN.pdf.exerundll32.exepid process 972 Documents Submission QTN.pdf.exe 972 Documents Submission QTN.pdf.exe 972 Documents Submission QTN.pdf.exe 972 Documents Submission QTN.pdf.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe 3644 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 8 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Documents Submission QTN.pdf.exerundll32.exepid process 972 Documents Submission QTN.pdf.exe 972 Documents Submission QTN.pdf.exe 972 Documents Submission QTN.pdf.exe 3644 rundll32.exe 3644 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Documents Submission QTN.pdf.exerundll32.exedescription pid process Token: SeDebugPrivilege 972 Documents Submission QTN.pdf.exe Token: SeDebugPrivilege 3644 rundll32.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 8 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Documents Submission QTN.pdf.exeExplorer.EXErundll32.exedescription pid process target process PID 900 wrote to memory of 972 900 Documents Submission QTN.pdf.exe Documents Submission QTN.pdf.exe PID 900 wrote to memory of 972 900 Documents Submission QTN.pdf.exe Documents Submission QTN.pdf.exe PID 900 wrote to memory of 972 900 Documents Submission QTN.pdf.exe Documents Submission QTN.pdf.exe PID 900 wrote to memory of 972 900 Documents Submission QTN.pdf.exe Documents Submission QTN.pdf.exe PID 900 wrote to memory of 972 900 Documents Submission QTN.pdf.exe Documents Submission QTN.pdf.exe PID 900 wrote to memory of 972 900 Documents Submission QTN.pdf.exe Documents Submission QTN.pdf.exe PID 8 wrote to memory of 3644 8 Explorer.EXE rundll32.exe PID 8 wrote to memory of 3644 8 Explorer.EXE rundll32.exe PID 8 wrote to memory of 3644 8 Explorer.EXE rundll32.exe PID 3644 wrote to memory of 1152 3644 rundll32.exe cmd.exe PID 3644 wrote to memory of 1152 3644 rundll32.exe cmd.exe PID 3644 wrote to memory of 1152 3644 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Documents Submission QTN.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Documents Submission QTN.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Documents Submission QTN.pdf.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Documents Submission QTN.pdf.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/8-127-0x00000000066E0000-0x0000000006860000-memory.dmpFilesize
1.5MB
-
memory/8-135-0x0000000008440000-0x000000000858E000-memory.dmpFilesize
1.3MB
-
memory/900-116-0x0000000005F80000-0x0000000005F81000-memory.dmpFilesize
4KB
-
memory/900-117-0x00000000059B0000-0x00000000059B1000-memory.dmpFilesize
4KB
-
memory/900-118-0x0000000005910000-0x00000000059A2000-memory.dmpFilesize
584KB
-
memory/900-119-0x0000000005990000-0x0000000005991000-memory.dmpFilesize
4KB
-
memory/900-120-0x0000000005BD0000-0x0000000005BD2000-memory.dmpFilesize
8KB
-
memory/900-121-0x0000000007DB0000-0x0000000007DB1000-memory.dmpFilesize
4KB
-
memory/900-122-0x0000000007740000-0x00000000077C3000-memory.dmpFilesize
524KB
-
memory/900-123-0x0000000007670000-0x00000000076A3000-memory.dmpFilesize
204KB
-
memory/900-114-0x0000000000F90000-0x0000000000F91000-memory.dmpFilesize
4KB
-
memory/972-125-0x000000000041EBA0-mapping.dmp
-
memory/972-128-0x0000000000F00000-0x0000000000FAE000-memory.dmpFilesize
696KB
-
memory/972-126-0x00000000014B0000-0x00000000017D0000-memory.dmpFilesize
3.1MB
-
memory/972-124-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1152-130-0x0000000000000000-mapping.dmp
-
memory/3644-129-0x0000000000000000-mapping.dmp
-
memory/3644-132-0x0000000000C40000-0x0000000000C6E000-memory.dmpFilesize
184KB
-
memory/3644-131-0x0000000001210000-0x0000000001223000-memory.dmpFilesize
76KB
-
memory/3644-133-0x0000000000EB0000-0x00000000011D0000-memory.dmpFilesize
3.1MB
-
memory/3644-134-0x0000000000CD0000-0x0000000000E1A000-memory.dmpFilesize
1.3MB