Analysis
-
max time kernel
153s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
02-09-2021 11:43
Static task
static1
Behavioral task
behavioral1
Sample
ürün örnekleri pdf.exe
Resource
win7v20210408
General
-
Target
ürün örnekleri pdf.exe
-
Size
917KB
-
MD5
74ddae6f1130eb1417574d1c36811272
-
SHA1
233885c441c6415b0caeb7257fe4024172f05035
-
SHA256
e6ea3a65882a66ce80f1567ea6e7daab614a3dcc269ad4ade427e60be64fc255
-
SHA512
0a8c835a558dd7715ec8abfca95b45c01e5dded4085d641ac4fb23851969ec389cc82ccd2f89dfffaa6e6b867caa7d255c0f4ec08cd3ed712dbefcaf79b7e3fd
Malware Config
Extracted
formbook
4.1
n7ak
http://www.kmresults.com/n7ak/
modischoolcbse.com
theneverwinter.com
rszkjx-vps-hosting.website
fnihil.com
1pbet.com
nnowzscorrez.com
uaotgvjl.icu
starmapsqatar.com
ekisilani.com
extradeepsheets.com
jam-nins.com
buranly.com
orixentertainment.com
rawtech.energy
myol.guru
utex.club
jiapie.com
wowig.store
wweidlyyl.com
systaskautomation.com
citromudas3a.com
plasticstone.icu
pawchamamapet.com
beautybybby.com
mor-n-mor.com
getoffyourhighhorses.com
chieucaochoban9.xyz
grahamevansmp.com
amplaassessoria.net
nutricookindia.com
wazymbex.icu
joansironing.com
hallforless.com
mycourseprofits.com
precps.com
cookislandstourismpodcast.com
bestonlinedealslive.com
bug.chat
ptjbtoqonjtrwpvkfgmjvwp.com
tortniespodzianka.store
qxkbjgj.icu
aurashape.com
guinealive.com
mondialeresources.com
offthebreak.site
maxamproductivity.com
thebiztip.com
thelocalrea.com
laeducacionadistancia.com
inpakgroup.com
lvgang360.com
allvegangoods.com
tymudanzaramos.com
simpleframeswork.com
thehappycars.com
directfenetres.net
norskatferdsterapi.com
hostingcnx.com
ksmh5x.com
thespiritworldinvitational.com
jetsetwilly3.com
gameflexdev.com
tryhuge.com
vaporvspaper.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/640-127-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/640-128-0x000000000041ECE0-mapping.dmp formbook behavioral2/memory/1568-134-0x0000000000A20000-0x0000000000A4E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
ürün örnekleri pdf.exeürün örnekleri pdf.exeNETSTAT.EXEdescription pid process target process PID 808 set thread context of 640 808 ürün örnekleri pdf.exe ürün örnekleri pdf.exe PID 640 set thread context of 3056 640 ürün örnekleri pdf.exe Explorer.EXE PID 1568 set thread context of 3056 1568 NETSTAT.EXE Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 1568 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 45 IoCs
Processes:
ürün örnekleri pdf.exeürün örnekleri pdf.exeNETSTAT.EXEpid process 808 ürün örnekleri pdf.exe 640 ürün örnekleri pdf.exe 640 ürün örnekleri pdf.exe 640 ürün örnekleri pdf.exe 640 ürün örnekleri pdf.exe 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE 1568 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3056 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
ürün örnekleri pdf.exeNETSTAT.EXEpid process 640 ürün örnekleri pdf.exe 640 ürün örnekleri pdf.exe 640 ürün örnekleri pdf.exe 1568 NETSTAT.EXE 1568 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
ürün örnekleri pdf.exeürün örnekleri pdf.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 808 ürün örnekleri pdf.exe Token: SeDebugPrivilege 640 ürün örnekleri pdf.exe Token: SeDebugPrivilege 1568 NETSTAT.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3056 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
ürün örnekleri pdf.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 808 wrote to memory of 2036 808 ürün örnekleri pdf.exe schtasks.exe PID 808 wrote to memory of 2036 808 ürün örnekleri pdf.exe schtasks.exe PID 808 wrote to memory of 2036 808 ürün örnekleri pdf.exe schtasks.exe PID 808 wrote to memory of 640 808 ürün örnekleri pdf.exe ürün örnekleri pdf.exe PID 808 wrote to memory of 640 808 ürün örnekleri pdf.exe ürün örnekleri pdf.exe PID 808 wrote to memory of 640 808 ürün örnekleri pdf.exe ürün örnekleri pdf.exe PID 808 wrote to memory of 640 808 ürün örnekleri pdf.exe ürün örnekleri pdf.exe PID 808 wrote to memory of 640 808 ürün örnekleri pdf.exe ürün örnekleri pdf.exe PID 808 wrote to memory of 640 808 ürün örnekleri pdf.exe ürün örnekleri pdf.exe PID 3056 wrote to memory of 1568 3056 Explorer.EXE NETSTAT.EXE PID 3056 wrote to memory of 1568 3056 Explorer.EXE NETSTAT.EXE PID 3056 wrote to memory of 1568 3056 Explorer.EXE NETSTAT.EXE PID 1568 wrote to memory of 3876 1568 NETSTAT.EXE cmd.exe PID 1568 wrote to memory of 3876 1568 NETSTAT.EXE cmd.exe PID 1568 wrote to memory of 3876 1568 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ürün örnekleri pdf.exe"C:\Users\Admin\AppData\Local\Temp\ürün örnekleri pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CyLcKKHcd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2FDB.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\ürün örnekleri pdf.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ürün örnekleri pdf.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2FDB.tmpMD5
862c2230c6323650837e496fc3a2e4fa
SHA12f50377ee6e16c9548c6886d18feb00f0f7720d9
SHA2567b8ba9aa096287865cc3c8843d46d5231e630682adbab30da2c3383997447d0b
SHA51215bd52a52caf1c39fbdcb36e02b87c71ee945e52fecdc92c78b32bcead9ecba7c435cc635d29c372302062bf05812da6db526bad09cbbef1be3d8ccc35b034b6
-
memory/640-129-0x0000000001290000-0x00000000015B0000-memory.dmpFilesize
3.1MB
-
memory/640-130-0x0000000000FA0000-0x0000000000FB4000-memory.dmpFilesize
80KB
-
memory/640-128-0x000000000041ECE0-mapping.dmp
-
memory/640-127-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/808-121-0x00000000052C0000-0x00000000052C1000-memory.dmpFilesize
4KB
-
memory/808-116-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/808-122-0x0000000004A60000-0x0000000004A6E000-memory.dmpFilesize
56KB
-
memory/808-123-0x000000000DCD0000-0x000000000DD61000-memory.dmpFilesize
580KB
-
memory/808-124-0x0000000006D60000-0x0000000006DA0000-memory.dmpFilesize
256KB
-
memory/808-114-0x00000000006E0000-0x00000000006E1000-memory.dmpFilesize
4KB
-
memory/808-120-0x0000000004FE0000-0x0000000004FE1000-memory.dmpFilesize
4KB
-
memory/808-119-0x00000000050E0000-0x00000000055DE000-memory.dmpFilesize
5.0MB
-
memory/808-118-0x00000000050E0000-0x00000000050E1000-memory.dmpFilesize
4KB
-
memory/808-117-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/1568-133-0x0000000000F80000-0x0000000000F8B000-memory.dmpFilesize
44KB
-
memory/1568-132-0x0000000000000000-mapping.dmp
-
memory/1568-134-0x0000000000A20000-0x0000000000A4E000-memory.dmpFilesize
184KB
-
memory/1568-135-0x00000000032D0000-0x00000000035F0000-memory.dmpFilesize
3.1MB
-
memory/1568-137-0x0000000003080000-0x0000000003113000-memory.dmpFilesize
588KB
-
memory/2036-125-0x0000000000000000-mapping.dmp
-
memory/3056-131-0x0000000003290000-0x000000000338A000-memory.dmpFilesize
1000KB
-
memory/3056-138-0x00000000057D0000-0x00000000058B1000-memory.dmpFilesize
900KB
-
memory/3876-136-0x0000000000000000-mapping.dmp