Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25-03-2024 16:50
Static task
static1
Behavioral task
behavioral1
Sample
Confirmação do pedido.pdf.exe
Resource
win7-20231129-en
General
-
Target
Confirmação do pedido.pdf.exe
-
Size
590KB
-
MD5
2f9e1385a9c419ad70bb121e4250ae0a
-
SHA1
ee2018b7427e3eccd78683018864043a72d841a9
-
SHA256
9a565700a3d3c7a802780c0e4ba717b082175fd33b5afc7dcfeb95905b6db784
-
SHA512
9c7a9d86a29729b1189a027e11c40175928c2c76355678ebaa06a08b42a8b0d6c0e6ba6237d61aa81a8a80e8b9d52b22c877f45dd74a233c720fee10e6419917
-
SSDEEP
12288:IS4CMwNNFJyvdgH7RPTwerlTuzRjynjSGqaJt2m8:IMFggH7RbweRTuzJsjSGqaJsm8
Malware Config
Extracted
formbook
4.1
o22d
stillsfengservices.com
protectagainstcrime.com
winiboya.com
mindbeforemusic.com
giyelz1i5.sbs
coin8899.com
coolgirls.club
ssdcf1416aasx.world
heir.solutions
soulmatchup.xyz
ingenetpy.com
knkvdqt5g.sbs
vireoremedy.com
leopolis.rent
apartment-for-rent-314.space
theenlightenedmotherhood.com
zidao.cloud
oi7982jbacdbfssagroup.monster
anandasnacks.com
start.beer
rismartenterprises.com
6lc4ry0ew8.site
d17o42ajphdk8l.xyz
dib41rkzufg74c.xyz
plannuary.com
audiencehub360.com
bwbraefh.shop
rethinkottawa.com
shimo.ltd
feather.flights
ucuzposetal.com
tryliaisononline.info
warehousejobs-germany.today
mercop.xyz
rxnbgk.live
qnn8.cyou
sasubpre.com
datapheonix.com
1jcvfipyt.site
pdax600.top
namescheetah.com
babasultankebab.com
sleekwave.sbs
noderetriever.com
itsszheall.com
rookconsultingservices.com
inventorymanagmentsystems.com
belglivenews.com
gpsgousa.com
saltydogduluth.com
xdhbkj.com
quaytvc.vip
tucciwhimsicalcreations.com
fhtrend.com
projetossustentaveis.com
maxprofltlnvestment.sbs
1znhnwhz.xyz
themadefashion.com
rtpbolaslot138new.com
yuksehatyuk.com
lln6ik0k6.sbs
rato2401023.shop
ikuai.site
stephaniewmorrison.com
piecesofadream.info
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4488-10-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4488-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3292-20-0x0000000000760000-0x000000000078F000-memory.dmp formbook behavioral2/memory/3292-22-0x0000000000760000-0x000000000078F000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
cmstp.exeflow pid process 230 3292 cmstp.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Confirmação do pedido.pdf.exeConfirmação do pedido.pdf.execmstp.exedescription pid process target process PID 2364 set thread context of 4488 2364 Confirmação do pedido.pdf.exe Confirmação do pedido.pdf.exe PID 4488 set thread context of 3204 4488 Confirmação do pedido.pdf.exe Explorer.EXE PID 3292 set thread context of 3204 3292 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 61 IoCs
Processes:
Confirmação do pedido.pdf.execmstp.exepid process 4488 Confirmação do pedido.pdf.exe 4488 Confirmação do pedido.pdf.exe 4488 Confirmação do pedido.pdf.exe 4488 Confirmação do pedido.pdf.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe 3292 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Confirmação do pedido.pdf.execmstp.exepid process 4488 Confirmação do pedido.pdf.exe 4488 Confirmação do pedido.pdf.exe 4488 Confirmação do pedido.pdf.exe 3292 cmstp.exe 3292 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Confirmação do pedido.pdf.execmstp.exedescription pid process Token: SeDebugPrivilege 4488 Confirmação do pedido.pdf.exe Token: SeDebugPrivilege 3292 cmstp.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3204 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Confirmação do pedido.pdf.exeExplorer.EXEcmstp.exedescription pid process target process PID 2364 wrote to memory of 4488 2364 Confirmação do pedido.pdf.exe Confirmação do pedido.pdf.exe PID 2364 wrote to memory of 4488 2364 Confirmação do pedido.pdf.exe Confirmação do pedido.pdf.exe PID 2364 wrote to memory of 4488 2364 Confirmação do pedido.pdf.exe Confirmação do pedido.pdf.exe PID 2364 wrote to memory of 4488 2364 Confirmação do pedido.pdf.exe Confirmação do pedido.pdf.exe PID 2364 wrote to memory of 4488 2364 Confirmação do pedido.pdf.exe Confirmação do pedido.pdf.exe PID 2364 wrote to memory of 4488 2364 Confirmação do pedido.pdf.exe Confirmação do pedido.pdf.exe PID 3204 wrote to memory of 3292 3204 Explorer.EXE cmstp.exe PID 3204 wrote to memory of 3292 3204 Explorer.EXE cmstp.exe PID 3204 wrote to memory of 3292 3204 Explorer.EXE cmstp.exe PID 3292 wrote to memory of 876 3292 cmstp.exe cmd.exe PID 3292 wrote to memory of 876 3292 cmstp.exe cmd.exe PID 3292 wrote to memory of 876 3292 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Confirmação do pedido.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Confirmação do pedido.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Confirmação do pedido.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Confirmação do pedido.pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Confirmação do pedido.pdf.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2364-8-0x0000000006690000-0x0000000006706000-memory.dmpFilesize
472KB
-
memory/2364-6-0x0000000005390000-0x00000000053A2000-memory.dmpFilesize
72KB
-
memory/2364-2-0x00000000057F0000-0x0000000005D94000-memory.dmpFilesize
5.6MB
-
memory/2364-3-0x0000000005180000-0x0000000005212000-memory.dmpFilesize
584KB
-
memory/2364-0-0x0000000074B50000-0x0000000075300000-memory.dmpFilesize
7.7MB
-
memory/2364-5-0x0000000005330000-0x000000000533A000-memory.dmpFilesize
40KB
-
memory/2364-1-0x0000000000700000-0x000000000079A000-memory.dmpFilesize
616KB
-
memory/2364-7-0x00000000057E0000-0x00000000057EC000-memory.dmpFilesize
48KB
-
memory/2364-4-0x00000000053A0000-0x00000000053B0000-memory.dmpFilesize
64KB
-
memory/2364-9-0x00000000090D0000-0x000000000916C000-memory.dmpFilesize
624KB
-
memory/2364-12-0x0000000074B50000-0x0000000075300000-memory.dmpFilesize
7.7MB
-
memory/3204-32-0x00000000085A0000-0x000000000872C000-memory.dmpFilesize
1.5MB
-
memory/3204-29-0x00000000085A0000-0x000000000872C000-memory.dmpFilesize
1.5MB
-
memory/3204-28-0x00000000085A0000-0x000000000872C000-memory.dmpFilesize
1.5MB
-
memory/3204-25-0x00000000082A0000-0x0000000008446000-memory.dmpFilesize
1.6MB
-
memory/3204-17-0x00000000082A0000-0x0000000008446000-memory.dmpFilesize
1.6MB
-
memory/3292-20-0x0000000000760000-0x000000000078F000-memory.dmpFilesize
188KB
-
memory/3292-19-0x0000000000870000-0x0000000000886000-memory.dmpFilesize
88KB
-
memory/3292-18-0x0000000000870000-0x0000000000886000-memory.dmpFilesize
88KB
-
memory/3292-21-0x0000000002B40000-0x0000000002E8A000-memory.dmpFilesize
3.3MB
-
memory/3292-22-0x0000000000760000-0x000000000078F000-memory.dmpFilesize
188KB
-
memory/3292-24-0x00000000027D0000-0x0000000002863000-memory.dmpFilesize
588KB
-
memory/4488-16-0x0000000001620000-0x0000000001634000-memory.dmpFilesize
80KB
-
memory/4488-15-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4488-13-0x00000000016D0000-0x0000000001A1A000-memory.dmpFilesize
3.3MB
-
memory/4488-10-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB