Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:44
Static task
static1
Behavioral task
behavioral1
Sample
SwiftLCCM.scan.pdf..exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SwiftLCCM.scan.pdf..exe
Resource
win10v2004-20220414-en
General
-
Target
SwiftLCCM.scan.pdf..exe
-
Size
378KB
-
MD5
a3eec98af0fabb24461e543dc05e4ac9
-
SHA1
ada78ad3c6dfc5ee6490c615094283f7ed4811f6
-
SHA256
56b7da0dee74f57d90b0f1f5e1871c153d399521f9361a96dc3d298ae9f0d462
-
SHA512
96cf4d0e789dce546a24081413a198c1ba51a753ce6b9ca85d1f8455b6112da2c1d5f96c47c8a2d14571ab96150375e277a7c32cedff99205dd35e8187856fd2
Malware Config
Extracted
formbook
4.1
fgf
cat5irma.com
leadershiplakewood.info
flm1tr.biz
silverstarps.com
tzsbhy.net
disseny-web-lleida.net
cancellationofcontract.com
potentialanalysen.com
realinja.net
cateraggio.com
17017brookwooddrive.com
liberty-hope.net
northmnsword.com
500lombardy.com
roykossena.com
bowelral.com
hidiinvestmentgroup.com
urbarecords.net
404chianti.com
zimomor.com
beyaqi.com
flc282.com
digimaxmw.com
movble.net
nauticallion.info
august12v.com
top-amatrice.com
xn--takrcke24-y2a.com
balada.online
bleaktochic.info
jackpotfix.com
mindful-math-tutoring.com
scenia-bay-nhatrang.com
platapormicasa.com
klb2xu.info
greenrayciel.com
animalcontrolportstluciefl.com
rewarded.tech
beushopping.com
columbiapacific.site
hifholdings.com
for.watch
steeleawayfarm.net
gotaphoto.com
we-teams.com
feiya-group.com
repulift.com
liminaireschauffeurs.com
bottegamente.com
yutanfu.com
py0534.net
testdomain9132017.com
ferien-versicherungen.com
naturally-jo.com
loveourmen.com
sdppgl.com
zwysoft.com
email-ag.win
placebonjour.win
theonboarding.agency
johncfazio.net
vitino.net
shuangm.com
zuzcvhv.com
sandrxy.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1764-63-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/1764-64-0x000000000041E300-mapping.dmp formbook behavioral1/memory/1764-66-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/1124-73-0x0000000000090000-0x00000000000BD000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 664 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wuapp.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run wuapp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DPWTJLEHF8 = "C:\\Program Files (x86)\\Kqdil0ti\\gdinj80wbm.exe" wuapp.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
SwiftLCCM.scan.pdf..exeSwiftLCCM.scan.pdf..exewuapp.exedescription pid process target process PID 560 set thread context of 1764 560 SwiftLCCM.scan.pdf..exe SwiftLCCM.scan.pdf..exe PID 1764 set thread context of 1428 1764 SwiftLCCM.scan.pdf..exe Explorer.EXE PID 1124 set thread context of 1428 1124 wuapp.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
wuapp.exedescription ioc process File opened for modification C:\Program Files (x86)\Kqdil0ti\gdinj80wbm.exe wuapp.exe -
Processes:
wuapp.exedescription ioc process Key created \Registry\User\S-1-5-21-1819626980-2277161760-1023733287-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wuapp.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
SwiftLCCM.scan.pdf..exeSwiftLCCM.scan.pdf..exewuapp.exepid process 560 SwiftLCCM.scan.pdf..exe 560 SwiftLCCM.scan.pdf..exe 560 SwiftLCCM.scan.pdf..exe 560 SwiftLCCM.scan.pdf..exe 560 SwiftLCCM.scan.pdf..exe 560 SwiftLCCM.scan.pdf..exe 560 SwiftLCCM.scan.pdf..exe 560 SwiftLCCM.scan.pdf..exe 560 SwiftLCCM.scan.pdf..exe 560 SwiftLCCM.scan.pdf..exe 1764 SwiftLCCM.scan.pdf..exe 1764 SwiftLCCM.scan.pdf..exe 1124 wuapp.exe 1124 wuapp.exe 1124 wuapp.exe 1124 wuapp.exe 1124 wuapp.exe 1124 wuapp.exe 1124 wuapp.exe 1124 wuapp.exe 1124 wuapp.exe 1124 wuapp.exe 1124 wuapp.exe 1124 wuapp.exe 1124 wuapp.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
SwiftLCCM.scan.pdf..exewuapp.exepid process 1764 SwiftLCCM.scan.pdf..exe 1764 SwiftLCCM.scan.pdf..exe 1764 SwiftLCCM.scan.pdf..exe 1124 wuapp.exe 1124 wuapp.exe 1124 wuapp.exe 1124 wuapp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SwiftLCCM.scan.pdf..exeSwiftLCCM.scan.pdf..exewuapp.exedescription pid process Token: SeDebugPrivilege 560 SwiftLCCM.scan.pdf..exe Token: SeDebugPrivilege 1764 SwiftLCCM.scan.pdf..exe Token: SeDebugPrivilege 1124 wuapp.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1428 Explorer.EXE 1428 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1428 Explorer.EXE 1428 Explorer.EXE -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
SwiftLCCM.scan.pdf..exeExplorer.EXEwuapp.exedescription pid process target process PID 560 wrote to memory of 1020 560 SwiftLCCM.scan.pdf..exe SwiftLCCM.scan.pdf..exe PID 560 wrote to memory of 1020 560 SwiftLCCM.scan.pdf..exe SwiftLCCM.scan.pdf..exe PID 560 wrote to memory of 1020 560 SwiftLCCM.scan.pdf..exe SwiftLCCM.scan.pdf..exe PID 560 wrote to memory of 1020 560 SwiftLCCM.scan.pdf..exe SwiftLCCM.scan.pdf..exe PID 560 wrote to memory of 1180 560 SwiftLCCM.scan.pdf..exe SwiftLCCM.scan.pdf..exe PID 560 wrote to memory of 1180 560 SwiftLCCM.scan.pdf..exe SwiftLCCM.scan.pdf..exe PID 560 wrote to memory of 1180 560 SwiftLCCM.scan.pdf..exe SwiftLCCM.scan.pdf..exe PID 560 wrote to memory of 1180 560 SwiftLCCM.scan.pdf..exe SwiftLCCM.scan.pdf..exe PID 560 wrote to memory of 1764 560 SwiftLCCM.scan.pdf..exe SwiftLCCM.scan.pdf..exe PID 560 wrote to memory of 1764 560 SwiftLCCM.scan.pdf..exe SwiftLCCM.scan.pdf..exe PID 560 wrote to memory of 1764 560 SwiftLCCM.scan.pdf..exe SwiftLCCM.scan.pdf..exe PID 560 wrote to memory of 1764 560 SwiftLCCM.scan.pdf..exe SwiftLCCM.scan.pdf..exe PID 560 wrote to memory of 1764 560 SwiftLCCM.scan.pdf..exe SwiftLCCM.scan.pdf..exe PID 560 wrote to memory of 1764 560 SwiftLCCM.scan.pdf..exe SwiftLCCM.scan.pdf..exe PID 560 wrote to memory of 1764 560 SwiftLCCM.scan.pdf..exe SwiftLCCM.scan.pdf..exe PID 1428 wrote to memory of 1124 1428 Explorer.EXE wuapp.exe PID 1428 wrote to memory of 1124 1428 Explorer.EXE wuapp.exe PID 1428 wrote to memory of 1124 1428 Explorer.EXE wuapp.exe PID 1428 wrote to memory of 1124 1428 Explorer.EXE wuapp.exe PID 1428 wrote to memory of 1124 1428 Explorer.EXE wuapp.exe PID 1428 wrote to memory of 1124 1428 Explorer.EXE wuapp.exe PID 1428 wrote to memory of 1124 1428 Explorer.EXE wuapp.exe PID 1124 wrote to memory of 664 1124 wuapp.exe cmd.exe PID 1124 wrote to memory of 664 1124 wuapp.exe cmd.exe PID 1124 wrote to memory of 664 1124 wuapp.exe cmd.exe PID 1124 wrote to memory of 664 1124 wuapp.exe cmd.exe PID 1124 wrote to memory of 112 1124 wuapp.exe Firefox.exe PID 1124 wrote to memory of 112 1124 wuapp.exe Firefox.exe PID 1124 wrote to memory of 112 1124 wuapp.exe Firefox.exe PID 1124 wrote to memory of 112 1124 wuapp.exe Firefox.exe PID 1124 wrote to memory of 112 1124 wuapp.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SwiftLCCM.scan.pdf..exe"C:\Users\Admin\AppData\Local\Temp\SwiftLCCM.scan.pdf..exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SwiftLCCM.scan.pdf..exe"C:\Users\Admin\AppData\Local\Temp\SwiftLCCM.scan.pdf..exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\SwiftLCCM.scan.pdf..exe"C:\Users\Admin\AppData\Local\Temp\SwiftLCCM.scan.pdf..exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\SwiftLCCM.scan.pdf..exe"C:\Users\Admin\AppData\Local\Temp\SwiftLCCM.scan.pdf..exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SwiftLCCM.scan.pdf..exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/560-54-0x0000000000170000-0x00000000001D4000-memory.dmpFilesize
400KB
-
memory/560-55-0x0000000075271000-0x0000000075273000-memory.dmpFilesize
8KB
-
memory/560-56-0x0000000000630000-0x0000000000638000-memory.dmpFilesize
32KB
-
memory/560-57-0x0000000001D90000-0x0000000001DC8000-memory.dmpFilesize
224KB
-
memory/560-58-0x0000000001E10000-0x0000000001E26000-memory.dmpFilesize
88KB
-
memory/560-59-0x0000000001F90000-0x0000000001F98000-memory.dmpFilesize
32KB
-
memory/664-74-0x0000000000000000-mapping.dmp
-
memory/1124-71-0x00000000001B0000-0x00000000001BB000-memory.dmpFilesize
44KB
-
memory/1124-73-0x0000000000090000-0x00000000000BD000-memory.dmpFilesize
180KB
-
memory/1124-75-0x0000000001CB0000-0x0000000001D43000-memory.dmpFilesize
588KB
-
memory/1124-72-0x0000000001F80000-0x0000000002283000-memory.dmpFilesize
3.0MB
-
memory/1124-70-0x0000000000000000-mapping.dmp
-
memory/1428-69-0x00000000069A0000-0x0000000006ADA000-memory.dmpFilesize
1.2MB
-
memory/1428-76-0x0000000007100000-0x0000000007262000-memory.dmpFilesize
1.4MB
-
memory/1764-68-0x0000000000200000-0x0000000000214000-memory.dmpFilesize
80KB
-
memory/1764-67-0x0000000000880000-0x0000000000B83000-memory.dmpFilesize
3.0MB
-
memory/1764-61-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1764-66-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1764-63-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1764-60-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1764-64-0x000000000041E300-mapping.dmp