Analysis
-
max time kernel
151s -
max time network
139s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
07-02-2022 00:45
Static task
static1
Behavioral task
behavioral1
Sample
sipari? pdf.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
sipari? pdf.exe
Resource
win10v2004-en-20220113
General
-
Target
sipari? pdf.exe
-
Size
465KB
-
MD5
2f54478ff3ea553fd34af1a0d207d704
-
SHA1
20a9f40fe6b15c8fe7de61b85a730e01c2b71661
-
SHA256
259275b0c056a9fec50378b2d268c48447e8ebe8827e8e55aae4484aba8b1939
-
SHA512
41212e6d4add91df9173ac0429f8f3532f98a2cd11418c5c0577f6784f31a4d411057cdd1a331f87ede1326a85f824184b7c1ee8106cd812ca6cecffb80bbc5f
Malware Config
Extracted
formbook
4.1
n7ak
audereventur.com
huro14.com
wwwjinsha155.com
antiquevendor.com
samuraisoulfood.net
traffic4updates.download
hypersarv.com
rapport-happy-wedding.com
rokutechnosupport.online
allworljob.com
hanaleedossmann.com
kauai-marathon.com
bepbosch.com
kangen-international.com
zoneshopemenowz.com
belviderewrestling.com
ipllink.com
sellingforcreators.com
wwwswty6655.com
qtumboa.com
bazarmoney.net
librosdecienciaficcion.com
shopmomsthebomb.com
vanjacob.com
tgyaa.com
theporncollective.net
hydrabadproperties.com
brindesecologicos.com
sayagayrimenkul.net
4btoken.com
shycedu.com
overall789.top
maison-pierre-bayle.com
elitemediamasters.com
sharmasfabrics.com
hoshamp.com
myultimateleadgenerator.com
office4u.info
thaimart1.com
ultimatewindowusa.com
twoblazesartworks.com
airteloffer.com
shoupaizhao.com
741dakotadr.info
books4arab.net
artedelcioccolato.biz
tjqcu.info
teccoop.net
maturebridesdressguide.com
excelcapfunding.com
bitcoinak.com
profileorderflow.com
unbelievabowboutique.com
midlandshomesolutionsltd.com
healthywithhook.com
stirlingpiper.com
manfast.online
arikorin.com
texastrustedinsurance.com
moodandmystery.com
yh77808.com
s-immotanger.com
runzexd.com
meteoannecy.net
joomlas123.info
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral1/memory/2016-57-0x00000000004B0000-0x00000000004B8000-memory.dmp CustAttr -
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/872-61-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/872-66-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/692-70-0x00000000000C0000-0x00000000000ED000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1220 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
sipari_ pdf.exesipari_ pdf.execscript.exedescription pid process target process PID 2016 set thread context of 872 2016 sipari_ pdf.exe sipari_ pdf.exe PID 872 set thread context of 1376 872 sipari_ pdf.exe Explorer.EXE PID 872 set thread context of 1376 872 sipari_ pdf.exe Explorer.EXE PID 692 set thread context of 1376 692 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
sipari_ pdf.execscript.exepid process 872 sipari_ pdf.exe 872 sipari_ pdf.exe 872 sipari_ pdf.exe 692 cscript.exe 692 cscript.exe 692 cscript.exe 692 cscript.exe 692 cscript.exe 692 cscript.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
sipari_ pdf.execscript.exepid process 872 sipari_ pdf.exe 872 sipari_ pdf.exe 872 sipari_ pdf.exe 872 sipari_ pdf.exe 692 cscript.exe 692 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
sipari_ pdf.execscript.exedescription pid process Token: SeDebugPrivilege 872 sipari_ pdf.exe Token: SeDebugPrivilege 692 cscript.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1376 Explorer.EXE 1376 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1376 Explorer.EXE 1376 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
sipari_ pdf.exeExplorer.EXEcscript.exedescription pid process target process PID 2016 wrote to memory of 872 2016 sipari_ pdf.exe sipari_ pdf.exe PID 2016 wrote to memory of 872 2016 sipari_ pdf.exe sipari_ pdf.exe PID 2016 wrote to memory of 872 2016 sipari_ pdf.exe sipari_ pdf.exe PID 2016 wrote to memory of 872 2016 sipari_ pdf.exe sipari_ pdf.exe PID 2016 wrote to memory of 872 2016 sipari_ pdf.exe sipari_ pdf.exe PID 2016 wrote to memory of 872 2016 sipari_ pdf.exe sipari_ pdf.exe PID 2016 wrote to memory of 872 2016 sipari_ pdf.exe sipari_ pdf.exe PID 1376 wrote to memory of 692 1376 Explorer.EXE cscript.exe PID 1376 wrote to memory of 692 1376 Explorer.EXE cscript.exe PID 1376 wrote to memory of 692 1376 Explorer.EXE cscript.exe PID 1376 wrote to memory of 692 1376 Explorer.EXE cscript.exe PID 692 wrote to memory of 1220 692 cscript.exe cmd.exe PID 692 wrote to memory of 1220 692 cscript.exe cmd.exe PID 692 wrote to memory of 1220 692 cscript.exe cmd.exe PID 692 wrote to memory of 1220 692 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sipari_ pdf.exe"C:\Users\Admin\AppData\Local\Temp\sipari_ pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sipari_ pdf.exe"C:\Users\Admin\AppData\Local\Temp\sipari_ pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\sipari_ pdf.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/692-69-0x0000000000090000-0x00000000000B2000-memory.dmpFilesize
136KB
-
memory/692-72-0x0000000001D20000-0x0000000001DB3000-memory.dmpFilesize
588KB
-
memory/692-70-0x00000000000C0000-0x00000000000ED000-memory.dmpFilesize
180KB
-
memory/692-71-0x0000000001FF0000-0x00000000022F3000-memory.dmpFilesize
3.0MB
-
memory/872-67-0x0000000000260000-0x0000000000274000-memory.dmpFilesize
80KB
-
memory/872-66-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/872-60-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/872-61-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/872-63-0x00000000008D0000-0x0000000000BD3000-memory.dmpFilesize
3.0MB
-
memory/872-64-0x0000000000220000-0x0000000000234000-memory.dmpFilesize
80KB
-
memory/872-59-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1376-65-0x0000000006A10000-0x0000000006B87000-memory.dmpFilesize
1.5MB
-
memory/1376-68-0x0000000003A50000-0x0000000003B3B000-memory.dmpFilesize
940KB
-
memory/1376-73-0x0000000006B90000-0x0000000006CE7000-memory.dmpFilesize
1.3MB
-
memory/2016-54-0x0000000000FE0000-0x000000000105A000-memory.dmpFilesize
488KB
-
memory/2016-58-0x0000000004AF0000-0x0000000004B4A000-memory.dmpFilesize
360KB
-
memory/2016-57-0x00000000004B0000-0x00000000004B8000-memory.dmpFilesize
32KB
-
memory/2016-56-0x0000000000B30000-0x0000000000B31000-memory.dmpFilesize
4KB
-
memory/2016-55-0x00000000751B1000-0x00000000751B3000-memory.dmpFilesize
8KB