Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2022 14:53
Static task
static1
Behavioral task
behavioral1
Sample
PEDIDO pdf.exe
Resource
win7-20220812-en
General
-
Target
PEDIDO pdf.exe
-
Size
752KB
-
MD5
e3698fc9d5c6152297de00168360d550
-
SHA1
eb53bcf6fd90162cc5b3d74fd018e6a981919c43
-
SHA256
26166c41b0a5364406a3c3f9c42d3f2bc3786aa5f32c71ee0675773bd7cc2125
-
SHA512
7c3c6c80fbda902fbde5ff554147852295d7c9508f4237ca3fba8ce03e7ae94cabb8d259f01dcd029036c5b7e845ac6c657a7638b5e9319ff66f6f298d9e55f2
-
SSDEEP
12288:mUdLctyTcf0hA/p4f2MjHJJY90LmRO1oTznmbhMGg3g43XR8:0UT40a/p4f2QLmEiTznmbvg3R3XR8
Malware Config
Extracted
formbook
asdo
31/RFVD/FFkpCuo=
LS2evkT1Hf54yJ3A01ZhjLFKSw==
Dw25w8eoM4HRQ9T8YA==
F2rI9TgH1uCf
VOuuxD/qTPifG/QDJ76coQ==
9smUEHwvvAcD3rnTM3IZg7fh
k4RlZq6jXYrfEg==
1+E7QsiGloB8qoio4Oh/
dALS/H0nMg+jCtM1RpZ+
thNv9GMouDLIFvESJ76coQ==
Tc54uifIU66mck2hvrtXnVbp
cINUAYgiqlkpCuo=
ma2AwPyPmpxd2bPRMksak0T7uEg9kA==
RlMlYJ9UpFIz7dg1RpZ+
klG+mNmHrHcFhmZ12SNGhmN+0f6MaMs=
V/nT2VgHD+hito+tBumEzTyVl5g=
0Zto8FjseN7v8MAW6ZkZg7fh
gbGlkddlXYrfEg==
pymXGHouvjhnKg8+qD8bLcY=
VelU01Tk/+CzegtywL4=
beu8i8uQo444B/I=
l1M5dadWfFDeV+s9sqk=
/dYkHYIfGV7iGA==
yI9kAZU8sDb2xrLNME4qL1L8A1UDR0OUTA==
Kfe3Bk7moSq5R+T9SYR9qQ==
qOu+wD/TXqzjQ9T8YA==
gwj+jqGpw1nLC/0=
AossQ3UoIIdVQaw8Qrt39kyJVA==
8LSKJa5YfmQ89cT/ecbD8xsqqOY2WJHY
0B3g3lkKOCTyMP4Y
wsAuMK9S5GDVQ9T8YA==
MWg6ADHDUNx798o1RpZ+
+72b1gyswJlV+Nc1RpZ+
Sw3lduGKXYrfEg==
80+uIIs4wk0fHfc=
pD8e4SDKUbj08LYZJnmGrg==
xxTq1hvSAQGl6Nf8PpOhCN12a4U=
YqmMV6xd71Cj38P0TZSIzjyVl5g=
dvNQ4FX8oersPiFXxNd2
LQfLIFcA+NFGmnSu/Wd6s03ye5CxR0OUTA==
qwNh7W8Yp1kpCuo=
BVci+UD6CS+lIfca
EAPiDT3fBA7wuI28CTu0J9E=
cLWLnh7W7vPyMP4Y
AIvnULNVyjd7rUx3wbw=
4eNBGEvs69ru8Lz+J76coQ==
xij4yO2DJIbQQ9T8YA==
DtnMDfkH1uCf
Vdm1hqpJVmckmGyb+xHn6yvMWKdbtz/X
6suQ4TbR5PHHaTNdwBoyUXqbrulBPsU=
iUJfoPR8XYrfEg==
1dg8GFYOGfbyMP4Y
jJZbru2GpG/VQ9T8YA==
BYtrRoA53ixudFOW/ju0J9E=
t0YlD4JO+WejmX6b7Du0J9E=
SBd2efu0XOnu/+g=
lSmLCnwmxiAe/MvoOVYzPjyVl5g=
BhFhVLlkzKEOQ9T8YA==
HeW78yHca87Xtpy7GGFep077uEg9kA==
aTobtETW3LLDMhpFkItevrdLQw==
laVzGpVKyTx+bQtywL4=
QDubmhTJgQ0OHvc=
K6PvmaTA4K0TQ9T8YA==
5/FSIl39tjnJF/ISJ76coQ==
somosterraingenieria.com
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PEDIDO pdf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation PEDIDO pdf.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
PEDIDO pdf.exePEDIDO pdf.execmd.exedescription pid process target process PID 4136 set thread context of 3496 4136 PEDIDO pdf.exe PEDIDO pdf.exe PID 3496 set thread context of 3020 3496 PEDIDO pdf.exe Explorer.EXE PID 3496 set thread context of 3020 3496 PEDIDO pdf.exe Explorer.EXE PID 3272 set thread context of 3020 3272 cmd.exe Explorer.EXE -
Processes:
cmd.exedescription ioc process Key created \Registry\User\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmd.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
PEDIDO pdf.execmd.exepid process 3496 PEDIDO pdf.exe 3496 PEDIDO pdf.exe 3496 PEDIDO pdf.exe 3496 PEDIDO pdf.exe 3496 PEDIDO pdf.exe 3496 PEDIDO pdf.exe 3496 PEDIDO pdf.exe 3496 PEDIDO pdf.exe 3496 PEDIDO pdf.exe 3496 PEDIDO pdf.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3020 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
PEDIDO pdf.execmd.exepid process 3496 PEDIDO pdf.exe 3496 PEDIDO pdf.exe 3496 PEDIDO pdf.exe 3496 PEDIDO pdf.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe 3272 cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PEDIDO pdf.execmd.exedescription pid process Token: SeDebugPrivilege 3496 PEDIDO pdf.exe Token: SeDebugPrivilege 3272 cmd.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PEDIDO pdf.exeExplorer.EXEcmd.exedescription pid process target process PID 4136 wrote to memory of 3496 4136 PEDIDO pdf.exe PEDIDO pdf.exe PID 4136 wrote to memory of 3496 4136 PEDIDO pdf.exe PEDIDO pdf.exe PID 4136 wrote to memory of 3496 4136 PEDIDO pdf.exe PEDIDO pdf.exe PID 4136 wrote to memory of 3496 4136 PEDIDO pdf.exe PEDIDO pdf.exe PID 4136 wrote to memory of 3496 4136 PEDIDO pdf.exe PEDIDO pdf.exe PID 4136 wrote to memory of 3496 4136 PEDIDO pdf.exe PEDIDO pdf.exe PID 3020 wrote to memory of 3272 3020 Explorer.EXE cmd.exe PID 3020 wrote to memory of 3272 3020 Explorer.EXE cmd.exe PID 3020 wrote to memory of 3272 3020 Explorer.EXE cmd.exe PID 3272 wrote to memory of 1976 3272 cmd.exe Firefox.exe PID 3272 wrote to memory of 1976 3272 cmd.exe Firefox.exe PID 3272 wrote to memory of 1976 3272 cmd.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PEDIDO pdf.exe"C:\Users\Admin\AppData\Local\Temp\PEDIDO pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PEDIDO pdf.exe"C:\Users\Admin\AppData\Local\Temp\PEDIDO pdf.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3020-145-0x0000000002DF0000-0x0000000002F30000-memory.dmpFilesize
1.2MB
-
memory/3020-158-0x0000000003340000-0x00000000033E6000-memory.dmpFilesize
664KB
-
memory/3020-156-0x0000000003340000-0x00000000033E6000-memory.dmpFilesize
664KB
-
memory/3020-148-0x0000000002F30000-0x0000000002FF5000-memory.dmpFilesize
788KB
-
memory/3272-157-0x0000000000BB0000-0x0000000000BDD000-memory.dmpFilesize
180KB
-
memory/3272-155-0x0000000001670000-0x00000000016FF000-memory.dmpFilesize
572KB
-
memory/3272-154-0x0000000000BB0000-0x0000000000BDD000-memory.dmpFilesize
180KB
-
memory/3272-152-0x0000000000A90000-0x0000000000AEA000-memory.dmpFilesize
360KB
-
memory/3272-153-0x0000000001760000-0x0000000001AAA000-memory.dmpFilesize
3.3MB
-
memory/3272-149-0x0000000000000000-mapping.dmp
-
memory/3496-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3496-150-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3496-146-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3496-147-0x0000000001320000-0x0000000001330000-memory.dmpFilesize
64KB
-
memory/3496-143-0x00000000015F0000-0x000000000193A000-memory.dmpFilesize
3.3MB
-
memory/3496-141-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/3496-151-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/3496-144-0x00000000012C0000-0x00000000012D0000-memory.dmpFilesize
64KB
-
memory/3496-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3496-137-0x0000000000000000-mapping.dmp
-
memory/4136-132-0x0000000000FD0000-0x0000000001092000-memory.dmpFilesize
776KB
-
memory/4136-136-0x00000000085B0000-0x000000000864C000-memory.dmpFilesize
624KB
-
memory/4136-135-0x0000000005AE0000-0x0000000005AEA000-memory.dmpFilesize
40KB
-
memory/4136-134-0x0000000005A40000-0x0000000005AD2000-memory.dmpFilesize
584KB
-
memory/4136-133-0x0000000005FF0000-0x0000000006594000-memory.dmpFilesize
5.6MB