Analysis
-
max time kernel
145s -
max time network
189s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
26-07-2021 11:16
Static task
static1
Behavioral task
behavioral1
Sample
Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe
Resource
win7v20210410
General
-
Target
Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe
-
Size
1.2MB
-
MD5
8c64b248212fd63f7c0cfdca16b6b5aa
-
SHA1
1ae15b049c1059d1e43ae5851005f50826c0d0b2
-
SHA256
88a9cfa636128b92a40156cdabb79f0058c7cf70bc392e60a9e8ec6c1090e6cf
-
SHA512
79581d25d4f35e1ae175f9b62789e1e8cf48b003f7f903a7a794aa85e43e2c8b73c890346f1608cdc13b9d6d42f4078184ee70709876e1dbfddd3c077a58cb0b
Malware Config
Extracted
formbook
4.1
http://www.elitegamerblog.com/gsg0/
telprix.com
multiremates.com
heytiday.com
toporganik.com
tutorincranleigh.com
oakandolivemalibu.com
ronaldvalentine.com
waytopshop.com
mythai-massage.com
matrixresults.com
teamwork256.com
qqemas.men
qnmark.com
rock-singer.com
mobiledevpros.com
miramar-agents.com
desjour.com
edensplace.net
ryanrafuls.com
xg8197.com
attakapas-ishak.com
very-easy-drive.com
smokeva.com
thebestgameofalltime.com
andrewrobertlawler.com
ikran-parts.com
todolieu.com
23sdsd.com
rodrigorondon.net
dirtyslushieandmore.com
bancodisantander.com
grosbeakgardens.com
cheaprestorations.com
rivertonfallfest.com
miragate.com
freedomcommercialcleaning.com
itoatoapparel.com
rodograss.com
discreetfinding.com
nanfangguniang.show
pharmacistshoko.com
pedegohyannis.com
janmt.com
high55.com
onefitearth.com
differentabilities.net
actsbooking.com
themesthatyoulike.com
justbrittany.com
serviceslincoln.com
dfa6r5.com
42everything.com
thekindergartensmorgasbord.com
wackomeat.com
admixphotovision.com
summer-activity-holidays.com
x2emails.xyz
frewave.com
legitimaterefunds.com
irishebikes.com
hauntspeak.com
cheerasia.com
nieght.com
shaunteeandrodlove.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral1/memory/1208-62-0x00000000001C0000-0x00000000001CB000-memory.dmp CustAttr -
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/684-65-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/684-66-0x000000000041EB40-mapping.dmp formbook behavioral1/memory/860-73-0x00000000000C0000-0x00000000000EE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 328 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exeProforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exechkdsk.exedescription pid process target process PID 1208 set thread context of 684 1208 Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe PID 684 set thread context of 1244 684 Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe Explorer.EXE PID 860 set thread context of 1244 860 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exechkdsk.exepid process 684 Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe 684 Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe 860 chkdsk.exe 860 chkdsk.exe 860 chkdsk.exe 860 chkdsk.exe 860 chkdsk.exe 860 chkdsk.exe 860 chkdsk.exe 860 chkdsk.exe 860 chkdsk.exe 860 chkdsk.exe 860 chkdsk.exe 860 chkdsk.exe 860 chkdsk.exe 860 chkdsk.exe 860 chkdsk.exe 860 chkdsk.exe 860 chkdsk.exe 860 chkdsk.exe 860 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exechkdsk.exepid process 684 Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe 684 Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe 684 Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe 860 chkdsk.exe 860 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exechkdsk.exedescription pid process Token: SeDebugPrivilege 684 Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe Token: SeDebugPrivilege 860 chkdsk.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1208 wrote to memory of 684 1208 Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe PID 1208 wrote to memory of 684 1208 Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe PID 1208 wrote to memory of 684 1208 Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe PID 1208 wrote to memory of 684 1208 Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe PID 1208 wrote to memory of 684 1208 Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe PID 1208 wrote to memory of 684 1208 Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe PID 1208 wrote to memory of 684 1208 Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe PID 1244 wrote to memory of 860 1244 Explorer.EXE chkdsk.exe PID 1244 wrote to memory of 860 1244 Explorer.EXE chkdsk.exe PID 1244 wrote to memory of 860 1244 Explorer.EXE chkdsk.exe PID 1244 wrote to memory of 860 1244 Explorer.EXE chkdsk.exe PID 860 wrote to memory of 328 860 chkdsk.exe cmd.exe PID 860 wrote to memory of 328 860 chkdsk.exe cmd.exe PID 860 wrote to memory of 328 860 chkdsk.exe cmd.exe PID 860 wrote to memory of 328 860 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/328-71-0x0000000000000000-mapping.dmp
-
memory/684-65-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/684-68-0x0000000000110000-0x0000000000124000-memory.dmpFilesize
80KB
-
memory/684-67-0x0000000000900000-0x0000000000C03000-memory.dmpFilesize
3.0MB
-
memory/684-66-0x000000000041EB40-mapping.dmp
-
memory/860-72-0x0000000000C60000-0x0000000000C67000-memory.dmpFilesize
28KB
-
memory/860-70-0x0000000000000000-mapping.dmp
-
memory/860-73-0x00000000000C0000-0x00000000000EE000-memory.dmpFilesize
184KB
-
memory/860-74-0x0000000002070000-0x0000000002373000-memory.dmpFilesize
3.0MB
-
memory/860-75-0x0000000000B80000-0x0000000000C13000-memory.dmpFilesize
588KB
-
memory/1208-64-0x0000000000430000-0x0000000000465000-memory.dmpFilesize
212KB
-
memory/1208-63-0x0000000004590000-0x000000000460A000-memory.dmpFilesize
488KB
-
memory/1208-62-0x00000000001C0000-0x00000000001CB000-memory.dmpFilesize
44KB
-
memory/1208-61-0x00000000002F0000-0x00000000002F1000-memory.dmpFilesize
4KB
-
memory/1208-59-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/1244-69-0x0000000006CC0000-0x0000000006E35000-memory.dmpFilesize
1.5MB
-
memory/1244-76-0x0000000003E00000-0x0000000003ECA000-memory.dmpFilesize
808KB