Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
23/10/2023, 11:33
Static task
static1
Behavioral task
behavioral1
Sample
Payment Copy (MT103 _03 _171023)_pdf.exe
Resource
win7-20231020-en
General
-
Target
Payment Copy (MT103 _03 _171023)_pdf.exe
-
Size
592KB
-
MD5
a57ad3a116cc0b544c63e7655047570f
-
SHA1
0729e7e1300ab2b0fa9cf60d32cd2a15276a1f87
-
SHA256
25e8610d483e74bac4bfc7189060e7fdeed775f6e82cd69b3a36d1a12b4e2af9
-
SHA512
16af9ccb2a0e59d5c16469b219a2ffba7b3963e83da889a9277b2803714dabe5367b820edf18d9908d2e4f1d28eadd69b0eda1a055e9cf5b10a11eea8d4cb15a
-
SSDEEP
12288:p//s02mvB+6ld9l/5ReV2fqy+/xCEL9HJfC/6afTTpcmUbgR/mZRM+:p//Z2mJ9p2hzhppqDrTpEgkZR5
Malware Config
Extracted
formbook
4.1
eg02
erc20.gold
elainevannmorgan.photography
melbet-el4.top
guvenilir.bet
sesamecsre.com
kevinjaydenwivano.tech
condohotelguru.com
shjcdz.com
innocarta.store
collinstradingpost.com
6om3j4.top
nagtco.xyz
fasist.fit
arkansaspremiertournaments.com
mrscsnowschool.com
ma-group.online
lillyjriley.icu
electric-cars-87253.bond
lila.tools
hollamia.com
snartonlinecheck.work
zaymnokni.online
rapidreviewmd.online
p8m.xyz
crowdhailer.online
needwaterpump.online
vi-apk.com
anenza.com
smarters-iptv.live
yachtfuellife.com
gbconsulting.online
limasise.com
bankir-ru.com
alexanderbonnet.com
bevontrade.com
inovarevending.com
aamrut.com
asalgacor.info
qqdwua.icu
ownableai.com
karoobaar.com
8lode88.vip
eblata.com
foxhouston26.com
www653f8918344e.com
pg290.fun
blacktowhitecuckold.com
lindsaybea.com
tripitour.com
senhormarceneiro.com
blacktowhitecuckold.com
zephyra.bet
seleneexport.com
nfertilityinwomen.com
godestas.com
pickuptruk.com
broadwayscg.com
jordanwatts.link
escuelawakana.com
compreiganhei.site
wolfandthecrow.com
nagoya-naisou-kaitai.com
wiseleadership.net
midowallwet.com
mygeneralmotorsretirement.com
Signatures
-
Formbook payload 4 IoCs
resource yara_rule behavioral2/memory/4660-13-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4660-18-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3296-23-0x0000000001270000-0x000000000129F000-memory.dmp formbook behavioral2/memory/3296-26-0x0000000001270000-0x000000000129F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3136 set thread context of 4660 3136 Payment Copy (MT103 _03 _171023)_pdf.exe 94 PID 4660 set thread context of 3268 4660 Payment Copy (MT103 _03 _171023)_pdf.exe 58 PID 3296 set thread context of 3268 3296 help.exe 58 -
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 3136 Payment Copy (MT103 _03 _171023)_pdf.exe 3136 Payment Copy (MT103 _03 _171023)_pdf.exe 4660 Payment Copy (MT103 _03 _171023)_pdf.exe 4660 Payment Copy (MT103 _03 _171023)_pdf.exe 4660 Payment Copy (MT103 _03 _171023)_pdf.exe 4660 Payment Copy (MT103 _03 _171023)_pdf.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe 3296 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3268 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 4660 Payment Copy (MT103 _03 _171023)_pdf.exe 4660 Payment Copy (MT103 _03 _171023)_pdf.exe 4660 Payment Copy (MT103 _03 _171023)_pdf.exe 3296 help.exe 3296 help.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 3136 Payment Copy (MT103 _03 _171023)_pdf.exe Token: SeDebugPrivilege 4660 Payment Copy (MT103 _03 _171023)_pdf.exe Token: SeDebugPrivilege 3296 help.exe Token: SeShutdownPrivilege 3268 Explorer.EXE Token: SeCreatePagefilePrivilege 3268 Explorer.EXE Token: SeShutdownPrivilege 3268 Explorer.EXE Token: SeCreatePagefilePrivilege 3268 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3268 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3136 wrote to memory of 3188 3136 Payment Copy (MT103 _03 _171023)_pdf.exe 93 PID 3136 wrote to memory of 3188 3136 Payment Copy (MT103 _03 _171023)_pdf.exe 93 PID 3136 wrote to memory of 3188 3136 Payment Copy (MT103 _03 _171023)_pdf.exe 93 PID 3136 wrote to memory of 4660 3136 Payment Copy (MT103 _03 _171023)_pdf.exe 94 PID 3136 wrote to memory of 4660 3136 Payment Copy (MT103 _03 _171023)_pdf.exe 94 PID 3136 wrote to memory of 4660 3136 Payment Copy (MT103 _03 _171023)_pdf.exe 94 PID 3136 wrote to memory of 4660 3136 Payment Copy (MT103 _03 _171023)_pdf.exe 94 PID 3136 wrote to memory of 4660 3136 Payment Copy (MT103 _03 _171023)_pdf.exe 94 PID 3136 wrote to memory of 4660 3136 Payment Copy (MT103 _03 _171023)_pdf.exe 94 PID 3268 wrote to memory of 3296 3268 Explorer.EXE 95 PID 3268 wrote to memory of 3296 3268 Explorer.EXE 95 PID 3268 wrote to memory of 3296 3268 Explorer.EXE 95 PID 3296 wrote to memory of 2288 3296 help.exe 96 PID 3296 wrote to memory of 2288 3296 help.exe 96 PID 3296 wrote to memory of 2288 3296 help.exe 96
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\Payment Copy (MT103 _03 _171023)_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Payment Copy (MT103 _03 _171023)_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\Payment Copy (MT103 _03 _171023)_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Payment Copy (MT103 _03 _171023)_pdf.exe"3⤵PID:3188
-
-
C:\Users\Admin\AppData\Local\Temp\Payment Copy (MT103 _03 _171023)_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Payment Copy (MT103 _03 _171023)_pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4660
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Payment Copy (MT103 _03 _171023)_pdf.exe"3⤵PID:2288
-
-