Overview

overview

10

Static

static

3

pdf.exe

windows7-x64

10

pdf.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    306s
  • max time network
    309s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-11-2023 10:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    pdf.exe

  • Size

    1.9MB

  • MD5

    4c681a85055387f6680f9f329f425c45

  • SHA1

    1347e0f77ff1b4fa3d58f15aa863a11bc7ffa9a6

  • SHA256

    c0a31c17baaae9d4fe88b19bbaec9fd55733552545692572082bd3c56a79a0fd

  • SHA512

    32513605638682426e1ac86663872aa5442d0e7f3e7cc196951691e97bc166dd4772d3f5afc3efc2ea6d2a92667eef3250db0a124b284ffa914cd4b6ce79cf18

  • SSDEEP

    49152:Ad8fIwCjykkGo5ITnLK+Ey9S1qXtfRGHKpk3H8eiTwHFimH9jIrMKSIa+GGXHIf8:AdoIwkkrITnG69S1qXtfRGHKpk3H8ei9

Score
10/10
formbookmodiloaderqh1npersistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

qh1n

Decoy

hyw0902destiny.xyz

mkquan.net

tisml8yn.top

norcliffecapital.com

dennemeyer-antipiracy.com

kastlosa.com

ghsdhzs.com

fdkeatlah.best

pvpvhhhvmk1z5r7.xyz

pumperwopingrld.com

traveloka.website

yunzhizhao.top

wtwvmemphis.com

aquaceen.com

flynovaa.info

qr-sens.events

yihetrading.com

miamipaintingcompany.com

kunikokaizu.shop

kapudianzi.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Formbook payload 7 IoCs
    rat
  • ModiLoader Second Stage 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3408
    • C:\Users\Admin\AppData\Local\Temp\pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\pdf.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:844
      • C:\Windows\SysWOW64\colorcpl.exe
        C:\Windows\System32\colorcpl.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1684
    • C:\Windows\SysWOW64\cmstp.exe
      "C:\Windows\SysWOW64\cmstp.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3972
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\colorcpl.exe"
        3⤵
          PID:3016
      • C:\Users\Admin\AppData\Local\Temp\pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\pdf.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1824
        • C:\Windows\SysWOW64\SndVol.exe
          C:\Windows\System32\SndVol.exe
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:2988
      • C:\Windows\SysWOW64\WWAHost.exe
        "C:\Windows\SysWOW64\WWAHost.exe"
        2⤵
          PID:444
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:2288

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/444-70-0x0000000001860000-0x0000000001BAA000-memory.dmp

          Filesize

          3.3MB

          Download

        • memory/444-62-0x00000000004B0000-0x000000000058C000-memory.dmp

          Filesize

          880KB

          Download

        • memory/444-65-0x00000000004B0000-0x000000000058C000-memory.dmp

          Filesize

          880KB

          Download

        • memory/444-66-0x0000000000C40000-0x0000000000C6F000-memory.dmp

          Filesize

          188KB

          Download

        • memory/444-69-0x0000000000C40000-0x0000000000C6F000-memory.dmp

          Filesize

          188KB

          Download

        • memory/844-4-0x0000000004370000-0x0000000005370000-memory.dmp

          Filesize

          16.0MB

          Download

        • memory/844-3-0x0000000000400000-0x00000000005E0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/844-0-0x0000000000400000-0x00000000005E0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/844-1-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

          Download

        • memory/844-7-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

          Download

        • memory/844-2-0x0000000004370000-0x0000000005370000-memory.dmp

          Filesize

          16.0MB

          Download

        • memory/844-6-0x0000000000400000-0x00000000005E0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/1684-14-0x0000000004C50000-0x0000000005C50000-memory.dmp

          Filesize

          16.0MB

          Download

        • memory/1684-15-0x0000000016DC0000-0x0000000016DD4000-memory.dmp

          Filesize

          80KB

          Download

        • memory/1684-11-0x0000000016E20000-0x000000001716A000-memory.dmp

          Filesize

          3.3MB

          Download

        • memory/1684-10-0x0000000004C50000-0x0000000005C50000-memory.dmp

          Filesize

          16.0MB

          Download

        • memory/1824-45-0x0000000000790000-0x0000000000791000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1824-50-0x0000000000400000-0x00000000005E0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/1824-48-0x0000000004300000-0x0000000005300000-memory.dmp

          Filesize

          16.0MB

          Download

        • memory/2988-55-0x000000001C890000-0x000000001CBDA000-memory.dmp

          Filesize

          3.3MB

          Download

        • memory/2988-58-0x0000000002F70000-0x0000000003F70000-memory.dmp

          Filesize

          16.0MB

          Download

        • memory/2988-60-0x000000001C640000-0x000000001C654000-memory.dmp

          Filesize

          80KB

          Download

        • memory/3408-61-0x000000000E360000-0x000000000E504000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3408-26-0x0000000002F20000-0x000000000300A000-memory.dmp

          Filesize

          936KB

          Download

        • memory/3408-25-0x0000000002F20000-0x000000000300A000-memory.dmp

          Filesize

          936KB

          Download

        • memory/3408-29-0x0000000002F20000-0x000000000300A000-memory.dmp

          Filesize

          936KB

          Download

        • memory/3408-16-0x0000000002CF0000-0x0000000002E6A000-memory.dmp

          Filesize

          1.5MB

          Download

        • memory/3408-57-0x0000000002F20000-0x000000000300A000-memory.dmp

          Filesize

          936KB

          Download

        • memory/3972-24-0x0000000002B90000-0x0000000002C23000-memory.dmp

          Filesize

          588KB

          Download

        • memory/3972-21-0x0000000002D50000-0x000000000309A000-memory.dmp

          Filesize

          3.3MB

          Download

        • memory/3972-20-0x0000000000E20000-0x0000000000E4F000-memory.dmp

          Filesize

          188KB

          Download

        • memory/3972-19-0x0000000000AF0000-0x0000000000B06000-memory.dmp

          Filesize

          88KB

          Download

        • memory/3972-18-0x0000000000AF0000-0x0000000000B06000-memory.dmp

          Filesize

          88KB

          Download

        • memory/3972-22-0x0000000000E20000-0x0000000000E4F000-memory.dmp

          Filesize

          188KB

          Download