Analysis
-
max time kernel
151s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2023 13:03
Static task
static1
Behavioral task
behavioral1
Sample
Urgent-N65.pdf.exe
Resource
win7-20230831-en
General
-
Target
Urgent-N65.pdf.exe
-
Size
559KB
-
MD5
641b93249d87d4a7c59d4896a61a29cd
-
SHA1
c1259ec9f29890ea520faa81c2b10ffe61add985
-
SHA256
89bcf1ff783e9986332cd6debe5fe5f424439518b7638f56b8322541a460f596
-
SHA512
c6014c21a90711a8ca83ba9a2b843e9fa855a5808caecab4841c08609bb5c2dc919c58ffd2777dc0b3e887e85b2b1555bdc20e2c1df6b3910b59e6a3b63973e5
-
SSDEEP
12288:VXICvof8kZTYRFm6YCrkEitIq+fX7qk8AVyiI:VXICvof8SMR8ZUeIq+v7sqw
Malware Config
Extracted
formbook
4.1
fw02
photonplayground.shop
bestonlinecasinos1.com
ks3633.com
vozandvalor.com
crowdfundmylife.com
rfidci.top
onhdl.cloud
asianwithshorthair.com
m4i6g.com
sb1388.com
ekantipurdainik.com
jonesbridgeltd.com
emilylau.xyz
alveomx.com
stekloff.online
gzzzcszx.com
hi-fishop.com
eureka-fashion.shop
mprojektai.com
scaletiktokyws.com
pornmovs.cam
ggyxw.com
h-deez.com
luxdope.com
surptb.xyz
konzertbern25.com
theworldwidepost.com
sugarmedica.com
alivebodyreset.com
ne-ops.com
rsteamproject.com
telesur889.com
ruianxinlei.com
accountingist.com
ashewabranding.com
systemasmdp.com
memphiswaterandmold.com
iptv-germany.com
thedollsstudiosuite.com
goldenbahis511.com
triveniholidays.com
vinjd.com
yushan2021.com
p326.vip
tcg01.top
wpseoaimarketing.com
tintedpanda.com
etinteracdeposit.com
coachingprozesse.online
deardeafdogs.com
xtratorrent.com
losbelones.com
mritalentpodcast.com
monarchstitle.com
pentecostalsermons.com
animeshia.com
justem-aws.com
vifit.store
oceanfreightcarriers.com
zakbyajklqrra.top
kbq9r.top
converonlinefree.com
deinservice.com
taofinland.com
dr-seek.life
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3948-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3948-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/224-22-0x0000000000800000-0x000000000082F000-memory.dmp formbook behavioral2/memory/224-24-0x0000000000800000-0x000000000082F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Urgent-N65.pdf.exeUrgent-N65.pdf.exemsdt.exedescription pid process target process PID 4064 set thread context of 3948 4064 Urgent-N65.pdf.exe Urgent-N65.pdf.exe PID 3948 set thread context of 772 3948 Urgent-N65.pdf.exe Explorer.EXE PID 224 set thread context of 772 224 msdt.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
Urgent-N65.pdf.exemsdt.exepid process 3948 Urgent-N65.pdf.exe 3948 Urgent-N65.pdf.exe 3948 Urgent-N65.pdf.exe 3948 Urgent-N65.pdf.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe 224 msdt.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 772 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Urgent-N65.pdf.exemsdt.exepid process 3948 Urgent-N65.pdf.exe 3948 Urgent-N65.pdf.exe 3948 Urgent-N65.pdf.exe 224 msdt.exe 224 msdt.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
Urgent-N65.pdf.exemsdt.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3948 Urgent-N65.pdf.exe Token: SeDebugPrivilege 224 msdt.exe Token: SeShutdownPrivilege 772 Explorer.EXE Token: SeCreatePagefilePrivilege 772 Explorer.EXE Token: SeShutdownPrivilege 772 Explorer.EXE Token: SeCreatePagefilePrivilege 772 Explorer.EXE Token: SeShutdownPrivilege 772 Explorer.EXE Token: SeCreatePagefilePrivilege 772 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Urgent-N65.pdf.exeExplorer.EXEmsdt.exedescription pid process target process PID 4064 wrote to memory of 3948 4064 Urgent-N65.pdf.exe Urgent-N65.pdf.exe PID 4064 wrote to memory of 3948 4064 Urgent-N65.pdf.exe Urgent-N65.pdf.exe PID 4064 wrote to memory of 3948 4064 Urgent-N65.pdf.exe Urgent-N65.pdf.exe PID 4064 wrote to memory of 3948 4064 Urgent-N65.pdf.exe Urgent-N65.pdf.exe PID 4064 wrote to memory of 3948 4064 Urgent-N65.pdf.exe Urgent-N65.pdf.exe PID 4064 wrote to memory of 3948 4064 Urgent-N65.pdf.exe Urgent-N65.pdf.exe PID 772 wrote to memory of 224 772 Explorer.EXE msdt.exe PID 772 wrote to memory of 224 772 Explorer.EXE msdt.exe PID 772 wrote to memory of 224 772 Explorer.EXE msdt.exe PID 224 wrote to memory of 4260 224 msdt.exe cmd.exe PID 224 wrote to memory of 4260 224 msdt.exe cmd.exe PID 224 wrote to memory of 4260 224 msdt.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Urgent-N65.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Urgent-N65.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Urgent-N65.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Urgent-N65.pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Urgent-N65.pdf.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/224-20-0x0000000000FB0000-0x0000000001007000-memory.dmpFilesize
348KB
-
memory/224-27-0x00000000026A0000-0x0000000002734000-memory.dmpFilesize
592KB
-
memory/224-24-0x0000000000800000-0x000000000082F000-memory.dmpFilesize
188KB
-
memory/224-23-0x00000000027B0000-0x0000000002AFA000-memory.dmpFilesize
3.3MB
-
memory/224-22-0x0000000000800000-0x000000000082F000-memory.dmpFilesize
188KB
-
memory/224-21-0x0000000000FB0000-0x0000000001007000-memory.dmpFilesize
348KB
-
memory/772-57-0x0000000003220000-0x0000000003230000-memory.dmpFilesize
64KB
-
memory/772-59-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-74-0x0000000003220000-0x0000000003230000-memory.dmpFilesize
64KB
-
memory/772-72-0x0000000003220000-0x0000000003230000-memory.dmpFilesize
64KB
-
memory/772-40-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-63-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-70-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-69-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-64-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-67-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-66-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-19-0x0000000008310000-0x0000000008421000-memory.dmpFilesize
1.1MB
-
memory/772-65-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-61-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-60-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-55-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-56-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-25-0x0000000008310000-0x0000000008421000-memory.dmpFilesize
1.1MB
-
memory/772-52-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-28-0x0000000008E60000-0x0000000008F1D000-memory.dmpFilesize
756KB
-
memory/772-29-0x0000000008E60000-0x0000000008F1D000-memory.dmpFilesize
756KB
-
memory/772-31-0x0000000008E60000-0x0000000008F1D000-memory.dmpFilesize
756KB
-
memory/772-37-0x0000000003220000-0x0000000003230000-memory.dmpFilesize
64KB
-
memory/772-36-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-38-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-39-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-35-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-71-0x0000000003220000-0x0000000003230000-memory.dmpFilesize
64KB
-
memory/772-53-0x0000000003220000-0x0000000003230000-memory.dmpFilesize
64KB
-
memory/772-42-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-44-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-47-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-46-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-48-0x0000000003220000-0x0000000003230000-memory.dmpFilesize
64KB
-
memory/772-49-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-50-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-51-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/772-41-0x00000000031D0000-0x00000000031E0000-memory.dmpFilesize
64KB
-
memory/3948-15-0x00000000018E0000-0x0000000001C2A000-memory.dmpFilesize
3.3MB
-
memory/3948-18-0x00000000018A0000-0x00000000018B5000-memory.dmpFilesize
84KB
-
memory/3948-17-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3948-12-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4064-3-0x00000000057C0000-0x0000000005852000-memory.dmpFilesize
584KB
-
memory/4064-4-0x0000000005740000-0x0000000005750000-memory.dmpFilesize
64KB
-
memory/4064-5-0x0000000005960000-0x000000000596A000-memory.dmpFilesize
40KB
-
memory/4064-8-0x0000000005740000-0x0000000005750000-memory.dmpFilesize
64KB
-
memory/4064-0-0x0000000075020000-0x00000000757D0000-memory.dmpFilesize
7.7MB
-
memory/4064-2-0x0000000005CD0000-0x0000000006274000-memory.dmpFilesize
5.6MB
-
memory/4064-1-0x0000000000D30000-0x0000000000DC0000-memory.dmpFilesize
576KB
-
memory/4064-14-0x0000000075020000-0x00000000757D0000-memory.dmpFilesize
7.7MB
-
memory/4064-7-0x0000000075020000-0x00000000757D0000-memory.dmpFilesize
7.7MB
-
memory/4064-11-0x0000000008680000-0x000000000871C000-memory.dmpFilesize
624KB
-
memory/4064-10-0x00000000072F0000-0x000000000735E000-memory.dmpFilesize
440KB
-
memory/4064-9-0x0000000005CC0000-0x0000000005CD0000-memory.dmpFilesize
64KB
-
memory/4064-6-0x0000000005CB0000-0x0000000005CC6000-memory.dmpFilesize
88KB