Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
24-10-2023 05:34
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order_A7.pdf.exe
Resource
win7-20231020-en
General
-
Target
Purchase Order_A7.pdf.exe
-
Size
613KB
-
MD5
5b1b412ccc9ccca7f9156c3a4e3badee
-
SHA1
8222046cd5c8c57d2b4e51f4b987ac339afb2461
-
SHA256
fa8b2e6ab78a1b6cb804a7125624b693a9271e19a6091737534d1f471c7762c6
-
SHA512
f6c99f41c7f58b4e9a4906911771669215f9ce7525d27c0f9f19e3263a712e5e4bbdd41b5560cc73f795176e79aaaf0ce6d3bc9068796dd3b7010a010a39a4a8
-
SSDEEP
12288:XhNh6sxTA6qNh3NDsJkr7ZAYkUPBzknjq2/68Q3ZfKNtX7+A7yNse8yFx5t1h:XDDxs6gzsJ+PBzknjx6vQV7wNsIFN1
Malware Config
Extracted
formbook
4.1
fw02
photonplayground.shop
bestonlinecasinos1.com
ks3633.com
vozandvalor.com
crowdfundmylife.com
rfidci.top
onhdl.cloud
asianwithshorthair.com
m4i6g.com
sb1388.com
ekantipurdainik.com
jonesbridgeltd.com
emilylau.xyz
alveomx.com
stekloff.online
gzzzcszx.com
hi-fishop.com
eureka-fashion.shop
mprojektai.com
scaletiktokyws.com
pornmovs.cam
ggyxw.com
h-deez.com
luxdope.com
surptb.xyz
konzertbern25.com
theworldwidepost.com
sugarmedica.com
alivebodyreset.com
ne-ops.com
rsteamproject.com
telesur889.com
ruianxinlei.com
accountingist.com
ashewabranding.com
systemasmdp.com
memphiswaterandmold.com
iptv-germany.com
thedollsstudiosuite.com
goldenbahis511.com
triveniholidays.com
vinjd.com
yushan2021.com
p326.vip
tcg01.top
wpseoaimarketing.com
tintedpanda.com
etinteracdeposit.com
coachingprozesse.online
deardeafdogs.com
xtratorrent.com
losbelones.com
mritalentpodcast.com
monarchstitle.com
pentecostalsermons.com
animeshia.com
justem-aws.com
vifit.store
oceanfreightcarriers.com
zakbyajklqrra.top
kbq9r.top
converonlinefree.com
deinservice.com
taofinland.com
dr-seek.life
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4052-13-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4052-18-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4844-24-0x0000000000A20000-0x0000000000A4F000-memory.dmp formbook behavioral2/memory/4844-26-0x0000000000A20000-0x0000000000A4F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Purchase Order_A7.pdf.exePurchase Order_A7.pdf.exeraserver.exedescription pid process target process PID 2792 set thread context of 4052 2792 Purchase Order_A7.pdf.exe Purchase Order_A7.pdf.exe PID 4052 set thread context of 3296 4052 Purchase Order_A7.pdf.exe Explorer.EXE PID 4844 set thread context of 3296 4844 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
Purchase Order_A7.pdf.exeraserver.exepid process 4052 Purchase Order_A7.pdf.exe 4052 Purchase Order_A7.pdf.exe 4052 Purchase Order_A7.pdf.exe 4052 Purchase Order_A7.pdf.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe 4844 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3296 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Purchase Order_A7.pdf.exeraserver.exepid process 4052 Purchase Order_A7.pdf.exe 4052 Purchase Order_A7.pdf.exe 4052 Purchase Order_A7.pdf.exe 4844 raserver.exe 4844 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Purchase Order_A7.pdf.exeraserver.exedescription pid process Token: SeDebugPrivilege 4052 Purchase Order_A7.pdf.exe Token: SeDebugPrivilege 4844 raserver.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Purchase Order_A7.pdf.exeExplorer.EXEraserver.exedescription pid process target process PID 2792 wrote to memory of 4052 2792 Purchase Order_A7.pdf.exe Purchase Order_A7.pdf.exe PID 2792 wrote to memory of 4052 2792 Purchase Order_A7.pdf.exe Purchase Order_A7.pdf.exe PID 2792 wrote to memory of 4052 2792 Purchase Order_A7.pdf.exe Purchase Order_A7.pdf.exe PID 2792 wrote to memory of 4052 2792 Purchase Order_A7.pdf.exe Purchase Order_A7.pdf.exe PID 2792 wrote to memory of 4052 2792 Purchase Order_A7.pdf.exe Purchase Order_A7.pdf.exe PID 2792 wrote to memory of 4052 2792 Purchase Order_A7.pdf.exe Purchase Order_A7.pdf.exe PID 3296 wrote to memory of 4844 3296 Explorer.EXE raserver.exe PID 3296 wrote to memory of 4844 3296 Explorer.EXE raserver.exe PID 3296 wrote to memory of 4844 3296 Explorer.EXE raserver.exe PID 4844 wrote to memory of 2416 4844 raserver.exe cmd.exe PID 4844 wrote to memory of 2416 4844 raserver.exe cmd.exe PID 4844 wrote to memory of 2416 4844 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order_A7.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order_A7.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order_A7.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order_A7.pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order_A7.pdf.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2792-15-0x0000000074400000-0x0000000074BB0000-memory.dmpFilesize
7.7MB
-
memory/2792-4-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/2792-0-0x0000000074400000-0x0000000074BB0000-memory.dmpFilesize
7.7MB
-
memory/2792-3-0x0000000004CA0000-0x0000000004D32000-memory.dmpFilesize
584KB
-
memory/2792-11-0x000000000B010000-0x000000000B07E000-memory.dmpFilesize
440KB
-
memory/2792-5-0x0000000002930000-0x000000000293A000-memory.dmpFilesize
40KB
-
memory/2792-6-0x0000000004DB0000-0x0000000004DCC000-memory.dmpFilesize
112KB
-
memory/2792-7-0x0000000002920000-0x000000000292C000-memory.dmpFilesize
48KB
-
memory/2792-8-0x0000000074400000-0x0000000074BB0000-memory.dmpFilesize
7.7MB
-
memory/2792-9-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/2792-10-0x0000000004E10000-0x0000000004E20000-memory.dmpFilesize
64KB
-
memory/2792-1-0x0000000000230000-0x00000000002D0000-memory.dmpFilesize
640KB
-
memory/2792-12-0x000000000E5B0000-0x000000000E64C000-memory.dmpFilesize
624KB
-
memory/2792-2-0x00000000053E0000-0x0000000005984000-memory.dmpFilesize
5.6MB
-
memory/3296-27-0x0000000007C80000-0x0000000007D77000-memory.dmpFilesize
988KB
-
memory/3296-33-0x0000000008F80000-0x0000000009095000-memory.dmpFilesize
1.1MB
-
memory/3296-31-0x0000000008F80000-0x0000000009095000-memory.dmpFilesize
1.1MB
-
memory/3296-20-0x0000000007C80000-0x0000000007D77000-memory.dmpFilesize
988KB
-
memory/3296-30-0x0000000008F80000-0x0000000009095000-memory.dmpFilesize
1.1MB
-
memory/4052-19-0x0000000001E20000-0x0000000001E35000-memory.dmpFilesize
84KB
-
memory/4052-16-0x00000000019D0000-0x0000000001D1A000-memory.dmpFilesize
3.3MB
-
memory/4052-18-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4052-13-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4844-21-0x0000000000730000-0x000000000074F000-memory.dmpFilesize
124KB
-
memory/4844-26-0x0000000000A20000-0x0000000000A4F000-memory.dmpFilesize
188KB
-
memory/4844-29-0x0000000002880000-0x0000000002914000-memory.dmpFilesize
592KB
-
memory/4844-25-0x0000000002A90000-0x0000000002DDA000-memory.dmpFilesize
3.3MB
-
memory/4844-23-0x0000000000730000-0x000000000074F000-memory.dmpFilesize
124KB
-
memory/4844-24-0x0000000000A20000-0x0000000000A4F000-memory.dmpFilesize
188KB