Analysis
-
max time kernel
159s -
max time network
136s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
21-02-2022 10:06
Static task
static1
Behavioral task
behavioral1
Sample
yeni sipari? pdf.exe
Resource
win7-en-20211208
General
-
Target
yeni sipari? pdf.exe
-
Size
855KB
-
MD5
b66417695e3a8844a9ee9fa5828bfd8c
-
SHA1
701f2da68cfe095527a6c66fd6aee55204eb57d9
-
SHA256
8f10623db4fc1e8289a02e94db58942a94a25c59a06e559fa910094da3db7e9d
-
SHA512
98121e7d46376026499e450c519d012e721a14b075e46e711b077a7beb507a77dc3a4e4264cd9e52346c88e56a8607235e942f29be504f72d837e8de7dba242d
Malware Config
Extracted
formbook
4.1
n7ak
audereventur.com
huro14.com
wwwjinsha155.com
antiquevendor.com
samuraisoulfood.net
traffic4updates.download
hypersarv.com
rapport-happy-wedding.com
rokutechnosupport.online
allworljob.com
hanaleedossmann.com
kauai-marathon.com
bepbosch.com
kangen-international.com
zoneshopemenowz.com
belviderewrestling.com
ipllink.com
sellingforcreators.com
wwwswty6655.com
qtumboa.com
bazarmoney.net
librosdecienciaficcion.com
shopmomsthebomb.com
vanjacob.com
tgyaa.com
theporncollective.net
hydrabadproperties.com
brindesecologicos.com
sayagayrimenkul.net
4btoken.com
shycedu.com
overall789.top
maison-pierre-bayle.com
elitemediamasters.com
sharmasfabrics.com
hoshamp.com
myultimateleadgenerator.com
office4u.info
thaimart1.com
ultimatewindowusa.com
twoblazesartworks.com
airteloffer.com
shoupaizhao.com
741dakotadr.info
books4arab.net
artedelcioccolato.biz
tjqcu.info
teccoop.net
maturebridesdressguide.com
excelcapfunding.com
bitcoinak.com
profileorderflow.com
unbelievabowboutique.com
midlandshomesolutionsltd.com
healthywithhook.com
stirlingpiper.com
manfast.online
arikorin.com
texastrustedinsurance.com
moodandmystery.com
yh77808.com
s-immotanger.com
runzexd.com
meteoannecy.net
joomlas123.info
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1784-60-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/436-67-0x0000000000080000-0x00000000000AD000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 996 cmd.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
yeni sipari_ pdf.execmmon32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run yeni sipari_ pdf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\ProPlayer = "C:\\Users\\Admin\\AppData\\Roaming\\ProPlayer\\Player.exe.exe" yeni sipari_ pdf.exe Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run cmmon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VFIHZLNHGZY8 = "C:\\Program Files (x86)\\Albs\\taskhost8pm81.exe" cmmon32.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
yeni sipari_ pdf.exeyeni sipari_ pdf.EXEcmmon32.exedescription pid process target process PID 1272 set thread context of 1784 1272 yeni sipari_ pdf.exe yeni sipari_ pdf.EXE PID 1784 set thread context of 1220 1784 yeni sipari_ pdf.EXE Explorer.EXE PID 436 set thread context of 1220 436 cmmon32.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
cmmon32.exedescription ioc process File opened for modification C:\Program Files (x86)\Albs\taskhost8pm81.exe cmmon32.exe -
Processes:
cmmon32.exedescription ioc process Key created \Registry\User\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmmon32.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
yeni sipari_ pdf.EXEcmmon32.exepid process 1784 yeni sipari_ pdf.EXE 1784 yeni sipari_ pdf.EXE 436 cmmon32.exe 436 cmmon32.exe 436 cmmon32.exe 436 cmmon32.exe 436 cmmon32.exe 436 cmmon32.exe 436 cmmon32.exe 436 cmmon32.exe 436 cmmon32.exe 436 cmmon32.exe 436 cmmon32.exe 436 cmmon32.exe 436 cmmon32.exe 436 cmmon32.exe 436 cmmon32.exe 436 cmmon32.exe 436 cmmon32.exe 436 cmmon32.exe 436 cmmon32.exe 436 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
yeni sipari_ pdf.EXEcmmon32.exepid process 1784 yeni sipari_ pdf.EXE 1784 yeni sipari_ pdf.EXE 1784 yeni sipari_ pdf.EXE 436 cmmon32.exe 436 cmmon32.exe 436 cmmon32.exe 436 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
yeni sipari_ pdf.EXEcmmon32.exedescription pid process Token: SeDebugPrivilege 1784 yeni sipari_ pdf.EXE Token: SeDebugPrivilege 436 cmmon32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
yeni sipari_ pdf.exepid process 1272 yeni sipari_ pdf.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
yeni sipari_ pdf.exeExplorer.EXEcmmon32.exedescription pid process target process PID 1272 wrote to memory of 1784 1272 yeni sipari_ pdf.exe yeni sipari_ pdf.EXE PID 1272 wrote to memory of 1784 1272 yeni sipari_ pdf.exe yeni sipari_ pdf.EXE PID 1272 wrote to memory of 1784 1272 yeni sipari_ pdf.exe yeni sipari_ pdf.EXE PID 1272 wrote to memory of 1784 1272 yeni sipari_ pdf.exe yeni sipari_ pdf.EXE PID 1272 wrote to memory of 1784 1272 yeni sipari_ pdf.exe yeni sipari_ pdf.EXE PID 1272 wrote to memory of 1784 1272 yeni sipari_ pdf.exe yeni sipari_ pdf.EXE PID 1272 wrote to memory of 1784 1272 yeni sipari_ pdf.exe yeni sipari_ pdf.EXE PID 1220 wrote to memory of 436 1220 Explorer.EXE cmmon32.exe PID 1220 wrote to memory of 436 1220 Explorer.EXE cmmon32.exe PID 1220 wrote to memory of 436 1220 Explorer.EXE cmmon32.exe PID 1220 wrote to memory of 436 1220 Explorer.EXE cmmon32.exe PID 436 wrote to memory of 996 436 cmmon32.exe cmd.exe PID 436 wrote to memory of 996 436 cmmon32.exe cmd.exe PID 436 wrote to memory of 996 436 cmmon32.exe cmd.exe PID 436 wrote to memory of 996 436 cmmon32.exe cmd.exe PID 436 wrote to memory of 1180 436 cmmon32.exe Firefox.exe PID 436 wrote to memory of 1180 436 cmmon32.exe Firefox.exe PID 436 wrote to memory of 1180 436 cmmon32.exe Firefox.exe PID 436 wrote to memory of 1180 436 cmmon32.exe Firefox.exe PID 436 wrote to memory of 1180 436 cmmon32.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\yeni sipari_ pdf.exe"C:\Users\Admin\AppData\Local\Temp\yeni sipari_ pdf.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\yeni sipari_ pdf.EXE"C:\Users\Admin\AppData\Local\Temp\yeni sipari_ pdf.EXE"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\yeni sipari_ pdf.EXE"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/436-69-0x00000000009A0000-0x0000000000A33000-memory.dmpFilesize
588KB
-
memory/436-68-0x00000000020C0000-0x00000000023C3000-memory.dmpFilesize
3.0MB
-
memory/436-67-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/436-66-0x0000000000CB0000-0x0000000000CBD000-memory.dmpFilesize
52KB
-
memory/1220-65-0x0000000005020000-0x000000000511A000-memory.dmpFilesize
1000KB
-
memory/1220-70-0x00000000049C0000-0x0000000004B36000-memory.dmpFilesize
1.5MB
-
memory/1272-57-0x00000000756C1000-0x00000000756C3000-memory.dmpFilesize
8KB
-
memory/1784-60-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1784-64-0x0000000000480000-0x0000000000494000-memory.dmpFilesize
80KB
-
memory/1784-62-0x0000000000730000-0x0000000000A33000-memory.dmpFilesize
3.0MB
-
memory/1784-63-0x000000000041E000-0x000000000041F000-memory.dmpFilesize
4KB
-
memory/1784-59-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1784-58-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB