Analysis
-
max time kernel
148s -
max time network
161s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 07:36
Static task
static1
Behavioral task
behavioral1
Sample
DHL Consgnment Notification_pdf.exe
Resource
win7-20221111-en
General
-
Target
DHL Consgnment Notification_pdf.exe
-
Size
814KB
-
MD5
eccc5475dd661be20724e6b8a131f664
-
SHA1
adbd86d7ccdab284d0080f0a08e3d426a8df21b8
-
SHA256
5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a
-
SHA512
f61dfbb25c44e9bcc5334b95c1c54c2275876ee50610995dfda2fc6090b9b05e5da66831d288b53e313b6c1aec4b0e24d001792425965914eb03f6d6bdfd19c6
-
SSDEEP
12288:vFyMNTl159j9G9+a3DY366UqXbAyBWWapIg95lvTHRyoY:3b1XZGAaT56VrAyepIgvpjRpY
Malware Config
Extracted
formbook
4.1
g28p
whhmgs.asia
wellmedcaredirect.net
beggarded.com
wtpjiv.site
todo-celulares.com
parkitny.net
43345.top
pro-genie.com
cwdxz.com
cbc-inc.xyz
healthspots.net
rulil.top
pyramidaudit.solutions
k8sb15.live
hempaware.report
usclink.life
stayefs.net
05262.top
shop-izakaya-jin.com
iccworldcupnews.com
lulamail.xyz
dubaistocks.club
royaleyeandearhospital.com
cash-date.biz
hbfcjgj.com
zcx625.fun
compra-venta-autos.online
waltherchen.xyz
asyimpo.xyz
gayxxxporn.info
xn--igvy44d.xn--55qx5d
teaktime.net
aydesign.xyz
hfamq.site
tunayreklam.net
rxof.rest
naturebody.love
elijahelijah.com
lojasiadis.com
amazrsxrszwna.com
realtranzex.com
elelfo3d.fun
fse.community
28369.xyz
minigolfauthority.net
venturebestdeals.click
robeholidayrentals.store
edarva.skin
xikixvtj.work
ecolabspeyua.store
infidelitytoolkit.com
crawfordbayoysterroast.net
adenongel.dentist
appliancegrey.site
ky7769.com
kshd.xyz
ausbonusbets.com
aks.capital
rv8288.xyz
retetelebunicii.com
younginheart.net
ps4controller.net
todotutoriales10.com
boletosdeavionbaratos.com
spartanburgwebdesign.com
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1176-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1176-64-0x000000000041F100-mapping.dmp formbook behavioral1/memory/1176-70-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1688-73-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/1688-78-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1820 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
DHL Consgnment Notification_pdf.exeDHL Consgnment Notification_pdf.execolorcpl.exedescription pid process target process PID 1748 set thread context of 1176 1748 DHL Consgnment Notification_pdf.exe DHL Consgnment Notification_pdf.exe PID 1176 set thread context of 1228 1176 DHL Consgnment Notification_pdf.exe Explorer.EXE PID 1688 set thread context of 1228 1688 colorcpl.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
DHL Consgnment Notification_pdf.execolorcpl.exepid process 1176 DHL Consgnment Notification_pdf.exe 1176 DHL Consgnment Notification_pdf.exe 1688 colorcpl.exe 1688 colorcpl.exe 1688 colorcpl.exe 1688 colorcpl.exe 1688 colorcpl.exe 1688 colorcpl.exe 1688 colorcpl.exe 1688 colorcpl.exe 1688 colorcpl.exe 1688 colorcpl.exe 1688 colorcpl.exe 1688 colorcpl.exe 1688 colorcpl.exe 1688 colorcpl.exe 1688 colorcpl.exe 1688 colorcpl.exe 1688 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
DHL Consgnment Notification_pdf.execolorcpl.exepid process 1176 DHL Consgnment Notification_pdf.exe 1176 DHL Consgnment Notification_pdf.exe 1176 DHL Consgnment Notification_pdf.exe 1688 colorcpl.exe 1688 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
DHL Consgnment Notification_pdf.execolorcpl.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1176 DHL Consgnment Notification_pdf.exe Token: SeDebugPrivilege 1688 colorcpl.exe Token: SeShutdownPrivilege 1228 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE 1228 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE 1228 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
DHL Consgnment Notification_pdf.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 1748 wrote to memory of 1176 1748 DHL Consgnment Notification_pdf.exe DHL Consgnment Notification_pdf.exe PID 1748 wrote to memory of 1176 1748 DHL Consgnment Notification_pdf.exe DHL Consgnment Notification_pdf.exe PID 1748 wrote to memory of 1176 1748 DHL Consgnment Notification_pdf.exe DHL Consgnment Notification_pdf.exe PID 1748 wrote to memory of 1176 1748 DHL Consgnment Notification_pdf.exe DHL Consgnment Notification_pdf.exe PID 1748 wrote to memory of 1176 1748 DHL Consgnment Notification_pdf.exe DHL Consgnment Notification_pdf.exe PID 1748 wrote to memory of 1176 1748 DHL Consgnment Notification_pdf.exe DHL Consgnment Notification_pdf.exe PID 1748 wrote to memory of 1176 1748 DHL Consgnment Notification_pdf.exe DHL Consgnment Notification_pdf.exe PID 1228 wrote to memory of 1688 1228 Explorer.EXE colorcpl.exe PID 1228 wrote to memory of 1688 1228 Explorer.EXE colorcpl.exe PID 1228 wrote to memory of 1688 1228 Explorer.EXE colorcpl.exe PID 1228 wrote to memory of 1688 1228 Explorer.EXE colorcpl.exe PID 1688 wrote to memory of 1820 1688 colorcpl.exe cmd.exe PID 1688 wrote to memory of 1820 1688 colorcpl.exe cmd.exe PID 1688 wrote to memory of 1820 1688 colorcpl.exe cmd.exe PID 1688 wrote to memory of 1820 1688 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\DHL Consgnment Notification_pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL Consgnment Notification_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\DHL Consgnment Notification_pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL Consgnment Notification_pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1176 -
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DHL Consgnment Notification_pdf.exe"3⤵
- Deletes itself
PID:1820
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1176-66-0x00000000008D0000-0x0000000000BD3000-memory.dmpFilesize
3.0MB
-
memory/1176-70-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1176-67-0x0000000000280000-0x0000000000294000-memory.dmpFilesize
80KB
-
memory/1176-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1176-64-0x000000000041F100-mapping.dmp
-
memory/1176-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1176-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1228-79-0x0000000003C20000-0x0000000003CE8000-memory.dmpFilesize
800KB
-
memory/1228-77-0x0000000003C20000-0x0000000003CE8000-memory.dmpFilesize
800KB
-
memory/1228-68-0x0000000005070000-0x00000000051A6000-memory.dmpFilesize
1.2MB
-
memory/1688-72-0x0000000000EF0000-0x0000000000F08000-memory.dmpFilesize
96KB
-
memory/1688-69-0x0000000000000000-mapping.dmp
-
memory/1688-73-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1688-75-0x0000000000B20000-0x0000000000E23000-memory.dmpFilesize
3.0MB
-
memory/1688-76-0x0000000000990000-0x0000000000A23000-memory.dmpFilesize
588KB
-
memory/1688-78-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1748-59-0x0000000000690000-0x00000000006C4000-memory.dmpFilesize
208KB
-
memory/1748-58-0x0000000005ED0000-0x0000000005F40000-memory.dmpFilesize
448KB
-
memory/1748-57-0x0000000000490000-0x000000000049E000-memory.dmpFilesize
56KB
-
memory/1748-54-0x0000000001270000-0x0000000001342000-memory.dmpFilesize
840KB
-
memory/1748-56-0x00000000003F0000-0x0000000000406000-memory.dmpFilesize
88KB
-
memory/1748-55-0x0000000076381000-0x0000000076383000-memory.dmpFilesize
8KB
-
memory/1820-74-0x0000000000000000-mapping.dmp