Analysis
-
max time kernel
148s -
max time network
163s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
29-10-2021 11:36
Static task
static1
Behavioral task
behavioral1
Sample
PO4809217226898789.pdf.exe
Resource
win7-en-20211014
General
-
Target
PO4809217226898789.pdf.exe
-
Size
347KB
-
MD5
e3d87c2d533796d8a78793bf4ef179ec
-
SHA1
7855d161dc42e4a0936f71274c9142950fc542c8
-
SHA256
f40c731716d135ea7e583819570a83d92e24c3dfb2a3b0ac375bd97774ffd689
-
SHA512
b4af236df96ad68bac6cc0522de034083c5b49d295bff8c1c83223ba1d137dfae48601ec443f346c1f672846dd8f58124d6c076be85b736060e083ee12725812
Malware Config
Extracted
formbook
4.1
gr1c
http://www.illusiontrick.com/gr1c/
soakyourgrains.com
duwego.com
aenkdesign.com
bikabbziu.xyz
thesawyerlegacy.com
koreanmodelbj.xyz
exceed-standards.com
syirsve.com
sachisushimontreal.com
thegalwaykitchen.com
accarwash-hub.com
connectwithmentor.com
luftfundament.online
ibrahimkaracan.com
biggersinsurance.com
desellon.com
tvnewscloset.com
digital-dre.com
ingocg.com
fernanda-ortiz.com
globallbazar.com
goldballoons.com
save-insta.net
jr-cons.com
ahyaqing.com
dawoodkhalil.com
paris-moi.com
pitchnft.net
shopdivastore.com
clarksclumpiesforkids.com
boutiquedulinge.com
tephineproperties.com
536484.com
testbegetregainfo.info
descontazzo.com
complioso.com
cashvax.xyz
bezeqimt.net
niqi666.com
daqishoes.com
uichin.info
boostarassa.quest
tarrings.info
caringhearts.one
untouchableinnovations.com
raymondcase.com
trippyhippieinc.com
fischernude.top
mazurschool.com
fswde.online
boldlarentals.com
welmovs.xyz
bandardunia.xyz
9594851.com
jioi.top
brequity.com
krakennewhour.com
polyteq.net
033xj.com
066ss.xyz
aluthgossip.xyz
grandezapura.com
kenneth-p.online
dadsaman.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3708-126-0x000000000041F0B0-mapping.dmp formbook behavioral2/memory/3708-125-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4092-133-0x00000000027C0000-0x00000000027EF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO4809217226898789.pdf.exePO4809217226898789.pdf.exewscript.exedescription pid process target process PID 2192 set thread context of 3708 2192 PO4809217226898789.pdf.exe PO4809217226898789.pdf.exe PID 3708 set thread context of 1588 3708 PO4809217226898789.pdf.exe Explorer.EXE PID 4092 set thread context of 1588 4092 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 54 IoCs
Processes:
PO4809217226898789.pdf.exePO4809217226898789.pdf.exewscript.exepid process 2192 PO4809217226898789.pdf.exe 2192 PO4809217226898789.pdf.exe 2192 PO4809217226898789.pdf.exe 2192 PO4809217226898789.pdf.exe 2192 PO4809217226898789.pdf.exe 2192 PO4809217226898789.pdf.exe 2192 PO4809217226898789.pdf.exe 2192 PO4809217226898789.pdf.exe 2192 PO4809217226898789.pdf.exe 2192 PO4809217226898789.pdf.exe 2192 PO4809217226898789.pdf.exe 2192 PO4809217226898789.pdf.exe 2192 PO4809217226898789.pdf.exe 2192 PO4809217226898789.pdf.exe 2192 PO4809217226898789.pdf.exe 2192 PO4809217226898789.pdf.exe 2192 PO4809217226898789.pdf.exe 2192 PO4809217226898789.pdf.exe 2192 PO4809217226898789.pdf.exe 2192 PO4809217226898789.pdf.exe 2192 PO4809217226898789.pdf.exe 2192 PO4809217226898789.pdf.exe 3708 PO4809217226898789.pdf.exe 3708 PO4809217226898789.pdf.exe 3708 PO4809217226898789.pdf.exe 3708 PO4809217226898789.pdf.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe 4092 wscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1588 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PO4809217226898789.pdf.exewscript.exepid process 3708 PO4809217226898789.pdf.exe 3708 PO4809217226898789.pdf.exe 3708 PO4809217226898789.pdf.exe 4092 wscript.exe 4092 wscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PO4809217226898789.pdf.exePO4809217226898789.pdf.exewscript.exedescription pid process Token: SeDebugPrivilege 2192 PO4809217226898789.pdf.exe Token: SeDebugPrivilege 3708 PO4809217226898789.pdf.exe Token: SeDebugPrivilege 4092 wscript.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
PO4809217226898789.pdf.exeExplorer.EXEwscript.exedescription pid process target process PID 2192 wrote to memory of 3580 2192 PO4809217226898789.pdf.exe PO4809217226898789.pdf.exe PID 2192 wrote to memory of 3580 2192 PO4809217226898789.pdf.exe PO4809217226898789.pdf.exe PID 2192 wrote to memory of 3580 2192 PO4809217226898789.pdf.exe PO4809217226898789.pdf.exe PID 2192 wrote to memory of 3156 2192 PO4809217226898789.pdf.exe PO4809217226898789.pdf.exe PID 2192 wrote to memory of 3156 2192 PO4809217226898789.pdf.exe PO4809217226898789.pdf.exe PID 2192 wrote to memory of 3156 2192 PO4809217226898789.pdf.exe PO4809217226898789.pdf.exe PID 2192 wrote to memory of 4060 2192 PO4809217226898789.pdf.exe PO4809217226898789.pdf.exe PID 2192 wrote to memory of 4060 2192 PO4809217226898789.pdf.exe PO4809217226898789.pdf.exe PID 2192 wrote to memory of 4060 2192 PO4809217226898789.pdf.exe PO4809217226898789.pdf.exe PID 2192 wrote to memory of 3708 2192 PO4809217226898789.pdf.exe PO4809217226898789.pdf.exe PID 2192 wrote to memory of 3708 2192 PO4809217226898789.pdf.exe PO4809217226898789.pdf.exe PID 2192 wrote to memory of 3708 2192 PO4809217226898789.pdf.exe PO4809217226898789.pdf.exe PID 2192 wrote to memory of 3708 2192 PO4809217226898789.pdf.exe PO4809217226898789.pdf.exe PID 2192 wrote to memory of 3708 2192 PO4809217226898789.pdf.exe PO4809217226898789.pdf.exe PID 2192 wrote to memory of 3708 2192 PO4809217226898789.pdf.exe PO4809217226898789.pdf.exe PID 1588 wrote to memory of 4092 1588 Explorer.EXE wscript.exe PID 1588 wrote to memory of 4092 1588 Explorer.EXE wscript.exe PID 1588 wrote to memory of 4092 1588 Explorer.EXE wscript.exe PID 4092 wrote to memory of 1196 4092 wscript.exe cmd.exe PID 4092 wrote to memory of 1196 4092 wscript.exe cmd.exe PID 4092 wrote to memory of 1196 4092 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO4809217226898789.pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO4809217226898789.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO4809217226898789.pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO4809217226898789.pdf.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\PO4809217226898789.pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO4809217226898789.pdf.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\PO4809217226898789.pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO4809217226898789.pdf.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\PO4809217226898789.pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO4809217226898789.pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO4809217226898789.pdf.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1196-135-0x0000000000000000-mapping.dmp
-
memory/1588-130-0x0000000004FF0000-0x000000000519C000-memory.dmpFilesize
1.7MB
-
memory/1588-137-0x00000000061B0000-0x0000000006332000-memory.dmpFilesize
1.5MB
-
memory/2192-117-0x00000000058E0000-0x00000000058E1000-memory.dmpFilesize
4KB
-
memory/2192-118-0x00000000053E0000-0x00000000053E1000-memory.dmpFilesize
4KB
-
memory/2192-119-0x0000000005370000-0x0000000005371000-memory.dmpFilesize
4KB
-
memory/2192-120-0x0000000005380000-0x0000000005381000-memory.dmpFilesize
4KB
-
memory/2192-121-0x0000000005620000-0x0000000005621000-memory.dmpFilesize
4KB
-
memory/2192-122-0x0000000005800000-0x0000000005807000-memory.dmpFilesize
28KB
-
memory/2192-123-0x000000007EA80000-0x000000007EA81000-memory.dmpFilesize
4KB
-
memory/2192-124-0x0000000007840000-0x0000000007890000-memory.dmpFilesize
320KB
-
memory/2192-115-0x0000000000AF0000-0x0000000000AF1000-memory.dmpFilesize
4KB
-
memory/3708-125-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3708-129-0x00000000019C0000-0x00000000019D4000-memory.dmpFilesize
80KB
-
memory/3708-128-0x0000000001680000-0x00000000019A0000-memory.dmpFilesize
3.1MB
-
memory/3708-126-0x000000000041F0B0-mapping.dmp
-
memory/4092-131-0x0000000000000000-mapping.dmp
-
memory/4092-132-0x0000000000030000-0x0000000000057000-memory.dmpFilesize
156KB
-
memory/4092-133-0x00000000027C0000-0x00000000027EF000-memory.dmpFilesize
188KB
-
memory/4092-134-0x00000000044F0000-0x0000000004810000-memory.dmpFilesize
3.1MB
-
memory/4092-136-0x0000000004350000-0x00000000043E3000-memory.dmpFilesize
588KB