Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
14-02-2023 09:04
Static task
static1
Behavioral task
behavioral1
Sample
SKMBT-283202109080.pdf.exe
Resource
win7-20220812-en
General
-
Target
SKMBT-283202109080.pdf.exe
-
Size
570KB
-
MD5
1b2504eaa55097312bfb5e80d81cf897
-
SHA1
7c58194fdc6db2123a9f90cb0b921a1859158fbe
-
SHA256
2fb0a24e905687a5443fbe50d21033e4318da3275260bd82d016a9af346bb09b
-
SHA512
acf0d7dd8b019d69b6d749ba01ec5a37c4b59fe7e8dd3d8458114d093ad364e6e637500ee15688f58f393458b9f7bb9bac3d160e495d8a171992486dc5ad2184
-
SSDEEP
12288:EVFFZ6qCmhX6OibPBNXB2Fx2JUkcLtRosYEykcvjSCCMO6apu:i63mlSjmqUkOtusYjkcY1
Malware Config
Extracted
formbook
4.1
gg62
growfast.africa
lerema.com
38945.se
wheelfermotors.africa
giftshareforyou.online
burrismktg.com
keepgrowing.uk
efefhomeless.buzz
bryanokoh.com
fashion-clothing-40094.com
andreasunshine.com
naijahood.africa
aditrirealty.com
kinnoitodatsumou.com
cryptoqzclimax.com
hairly.biz
comeuphither4.com
integrity360.ltd
flushywhole.com
8869365.com
fabvance-demos.online
motherpearl.africa
dnsmctmu.com
25779.football
crimson-sunset.ru
haamyounghoon.com
0563news.com
battleb0t.site
transnetfreight.africa
djdaxroadshow.co.uk
bwrps.live
abuin.vip
impressionsbyb.store
findguyscolorado.com
jordanflowerauction.net
fdm50off.com
31seaaa.com
centuryofviolence.co.uk
againstszhanweek.com
injurylawyersconsultants.com
kuotabike.com
cruisejoy.uk
clotaire.ru
hurloic.xyz
anvair.com
ivapeonthis.com
hotsesso.xyz
khramvyazovki.store
mentalistas.dev
cahayasunnah.com
bypro1.online
flavoredkreations.info
inuwallet.com
livingemployebenefits.com
enlighthings.com
focobreathwork.com
emaskhalipahbertam.com
jswl.store
chamaera.com
abbeyspear.com
downwind.one
lovelive.buzz
essentialhealth101.com
irakit.com
cbsht.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4540-141-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4540-147-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4200-151-0x0000000000EF0000-0x0000000000F1F000-memory.dmp formbook behavioral2/memory/4200-154-0x0000000000EF0000-0x0000000000F1F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
SKMBT-283202109080.pdf.exeSKMBT-283202109080.pdf.exehelp.exedescription pid process target process PID 628 set thread context of 4540 628 SKMBT-283202109080.pdf.exe SKMBT-283202109080.pdf.exe PID 4540 set thread context of 2888 4540 SKMBT-283202109080.pdf.exe Explorer.EXE PID 4200 set thread context of 2888 4200 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
SKMBT-283202109080.pdf.exeSKMBT-283202109080.pdf.exehelp.exepid process 628 SKMBT-283202109080.pdf.exe 628 SKMBT-283202109080.pdf.exe 628 SKMBT-283202109080.pdf.exe 628 SKMBT-283202109080.pdf.exe 628 SKMBT-283202109080.pdf.exe 628 SKMBT-283202109080.pdf.exe 4540 SKMBT-283202109080.pdf.exe 4540 SKMBT-283202109080.pdf.exe 4540 SKMBT-283202109080.pdf.exe 4540 SKMBT-283202109080.pdf.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe 4200 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2888 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
SKMBT-283202109080.pdf.exehelp.exepid process 4540 SKMBT-283202109080.pdf.exe 4540 SKMBT-283202109080.pdf.exe 4540 SKMBT-283202109080.pdf.exe 4200 help.exe 4200 help.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SKMBT-283202109080.pdf.exeSKMBT-283202109080.pdf.exehelp.exedescription pid process Token: SeDebugPrivilege 628 SKMBT-283202109080.pdf.exe Token: SeDebugPrivilege 4540 SKMBT-283202109080.pdf.exe Token: SeDebugPrivilege 4200 help.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
SKMBT-283202109080.pdf.exeExplorer.EXEhelp.exedescription pid process target process PID 628 wrote to memory of 2812 628 SKMBT-283202109080.pdf.exe SKMBT-283202109080.pdf.exe PID 628 wrote to memory of 2812 628 SKMBT-283202109080.pdf.exe SKMBT-283202109080.pdf.exe PID 628 wrote to memory of 2812 628 SKMBT-283202109080.pdf.exe SKMBT-283202109080.pdf.exe PID 628 wrote to memory of 4996 628 SKMBT-283202109080.pdf.exe SKMBT-283202109080.pdf.exe PID 628 wrote to memory of 4996 628 SKMBT-283202109080.pdf.exe SKMBT-283202109080.pdf.exe PID 628 wrote to memory of 4996 628 SKMBT-283202109080.pdf.exe SKMBT-283202109080.pdf.exe PID 628 wrote to memory of 4040 628 SKMBT-283202109080.pdf.exe SKMBT-283202109080.pdf.exe PID 628 wrote to memory of 4040 628 SKMBT-283202109080.pdf.exe SKMBT-283202109080.pdf.exe PID 628 wrote to memory of 4040 628 SKMBT-283202109080.pdf.exe SKMBT-283202109080.pdf.exe PID 628 wrote to memory of 4540 628 SKMBT-283202109080.pdf.exe SKMBT-283202109080.pdf.exe PID 628 wrote to memory of 4540 628 SKMBT-283202109080.pdf.exe SKMBT-283202109080.pdf.exe PID 628 wrote to memory of 4540 628 SKMBT-283202109080.pdf.exe SKMBT-283202109080.pdf.exe PID 628 wrote to memory of 4540 628 SKMBT-283202109080.pdf.exe SKMBT-283202109080.pdf.exe PID 628 wrote to memory of 4540 628 SKMBT-283202109080.pdf.exe SKMBT-283202109080.pdf.exe PID 628 wrote to memory of 4540 628 SKMBT-283202109080.pdf.exe SKMBT-283202109080.pdf.exe PID 2888 wrote to memory of 4200 2888 Explorer.EXE help.exe PID 2888 wrote to memory of 4200 2888 Explorer.EXE help.exe PID 2888 wrote to memory of 4200 2888 Explorer.EXE help.exe PID 4200 wrote to memory of 4336 4200 help.exe cmd.exe PID 4200 wrote to memory of 4336 4200 help.exe cmd.exe PID 4200 wrote to memory of 4336 4200 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SKMBT-283202109080.pdf.exe"C:\Users\Admin\AppData\Local\Temp\SKMBT-283202109080.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SKMBT-283202109080.pdf.exe"C:\Users\Admin\AppData\Local\Temp\SKMBT-283202109080.pdf.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\SKMBT-283202109080.pdf.exe"C:\Users\Admin\AppData\Local\Temp\SKMBT-283202109080.pdf.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\SKMBT-283202109080.pdf.exe"C:\Users\Admin\AppData\Local\Temp\SKMBT-283202109080.pdf.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\SKMBT-283202109080.pdf.exe"C:\Users\Admin\AppData\Local\Temp\SKMBT-283202109080.pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SKMBT-283202109080.pdf.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/628-132-0x0000000000C20000-0x0000000000CB4000-memory.dmpFilesize
592KB
-
memory/628-133-0x0000000005C80000-0x0000000006224000-memory.dmpFilesize
5.6MB
-
memory/628-134-0x0000000005580000-0x0000000005612000-memory.dmpFilesize
584KB
-
memory/628-135-0x00000000031C0000-0x00000000031CA000-memory.dmpFilesize
40KB
-
memory/628-136-0x0000000009360000-0x00000000093FC000-memory.dmpFilesize
624KB
-
memory/2812-137-0x0000000000000000-mapping.dmp
-
memory/2888-145-0x0000000007AF0000-0x0000000007C7A000-memory.dmpFilesize
1.5MB
-
memory/2888-153-0x00000000075A0000-0x00000000076BF000-memory.dmpFilesize
1.1MB
-
memory/2888-155-0x00000000075A0000-0x00000000076BF000-memory.dmpFilesize
1.1MB
-
memory/4040-139-0x0000000000000000-mapping.dmp
-
memory/4200-154-0x0000000000EF0000-0x0000000000F1F000-memory.dmpFilesize
188KB
-
memory/4200-152-0x00000000016E0000-0x0000000001773000-memory.dmpFilesize
588KB
-
memory/4200-151-0x0000000000EF0000-0x0000000000F1F000-memory.dmpFilesize
188KB
-
memory/4200-149-0x0000000000EE0000-0x0000000000EE7000-memory.dmpFilesize
28KB
-
memory/4200-146-0x0000000000000000-mapping.dmp
-
memory/4200-150-0x0000000001830000-0x0000000001B7A000-memory.dmpFilesize
3.3MB
-
memory/4336-148-0x0000000000000000-mapping.dmp
-
memory/4540-147-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4540-144-0x0000000001920000-0x0000000001934000-memory.dmpFilesize
80KB
-
memory/4540-143-0x0000000001A80000-0x0000000001DCA000-memory.dmpFilesize
3.3MB
-
memory/4540-141-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4540-140-0x0000000000000000-mapping.dmp
-
memory/4996-138-0x0000000000000000-mapping.dmp