Analysis
-
max time kernel
147s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-03-2024 16:50
Static task
static1
Behavioral task
behavioral1
Sample
Confirmação do pedido.pdf.exe
Resource
win7-20240221-en
General
-
Target
Confirmação do pedido.pdf.exe
-
Size
590KB
-
MD5
2f9e1385a9c419ad70bb121e4250ae0a
-
SHA1
ee2018b7427e3eccd78683018864043a72d841a9
-
SHA256
9a565700a3d3c7a802780c0e4ba717b082175fd33b5afc7dcfeb95905b6db784
-
SHA512
9c7a9d86a29729b1189a027e11c40175928c2c76355678ebaa06a08b42a8b0d6c0e6ba6237d61aa81a8a80e8b9d52b22c877f45dd74a233c720fee10e6419917
-
SSDEEP
12288:IS4CMwNNFJyvdgH7RPTwerlTuzRjynjSGqaJt2m8:IMFggH7RbweRTuzJsjSGqaJsm8
Malware Config
Extracted
formbook
4.1
o22d
stillsfengservices.com
protectagainstcrime.com
winiboya.com
mindbeforemusic.com
giyelz1i5.sbs
coin8899.com
coolgirls.club
ssdcf1416aasx.world
heir.solutions
soulmatchup.xyz
ingenetpy.com
knkvdqt5g.sbs
vireoremedy.com
leopolis.rent
apartment-for-rent-314.space
theenlightenedmotherhood.com
zidao.cloud
oi7982jbacdbfssagroup.monster
anandasnacks.com
start.beer
rismartenterprises.com
6lc4ry0ew8.site
d17o42ajphdk8l.xyz
dib41rkzufg74c.xyz
plannuary.com
audiencehub360.com
bwbraefh.shop
rethinkottawa.com
shimo.ltd
feather.flights
ucuzposetal.com
tryliaisononline.info
warehousejobs-germany.today
mercop.xyz
rxnbgk.live
qnn8.cyou
sasubpre.com
datapheonix.com
1jcvfipyt.site
pdax600.top
namescheetah.com
babasultankebab.com
sleekwave.sbs
noderetriever.com
itsszheall.com
rookconsultingservices.com
inventorymanagmentsystems.com
belglivenews.com
gpsgousa.com
saltydogduluth.com
xdhbkj.com
quaytvc.vip
tucciwhimsicalcreations.com
fhtrend.com
projetossustentaveis.com
maxprofltlnvestment.sbs
1znhnwhz.xyz
themadefashion.com
rtpbolaslot138new.com
yuksehatyuk.com
lln6ik0k6.sbs
rato2401023.shop
ikuai.site
stephaniewmorrison.com
piecesofadream.info
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/3012-10-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/3012-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/3012-19-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2572-25-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook behavioral1/memory/2572-27-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2532 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Confirmação do pedido.pdf.exeConfirmação do pedido.pdf.execmd.exedescription pid process target process PID 1124 set thread context of 3012 1124 Confirmação do pedido.pdf.exe Confirmação do pedido.pdf.exe PID 3012 set thread context of 1204 3012 Confirmação do pedido.pdf.exe Explorer.EXE PID 3012 set thread context of 1204 3012 Confirmação do pedido.pdf.exe Explorer.EXE PID 2572 set thread context of 1204 2572 cmd.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
Confirmação do pedido.pdf.execmd.exepid process 3012 Confirmação do pedido.pdf.exe 3012 Confirmação do pedido.pdf.exe 3012 Confirmação do pedido.pdf.exe 2572 cmd.exe 2572 cmd.exe 2572 cmd.exe 2572 cmd.exe 2572 cmd.exe 2572 cmd.exe 2572 cmd.exe 2572 cmd.exe 2572 cmd.exe 2572 cmd.exe 2572 cmd.exe 2572 cmd.exe 2572 cmd.exe 2572 cmd.exe 2572 cmd.exe 2572 cmd.exe 2572 cmd.exe 2572 cmd.exe 2572 cmd.exe 2572 cmd.exe 2572 cmd.exe 2572 cmd.exe 2572 cmd.exe 2572 cmd.exe 2572 cmd.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Confirmação do pedido.pdf.execmd.exepid process 3012 Confirmação do pedido.pdf.exe 3012 Confirmação do pedido.pdf.exe 3012 Confirmação do pedido.pdf.exe 3012 Confirmação do pedido.pdf.exe 2572 cmd.exe 2572 cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Confirmação do pedido.pdf.execmd.exedescription pid process Token: SeDebugPrivilege 3012 Confirmação do pedido.pdf.exe Token: SeDebugPrivilege 2572 cmd.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Confirmação do pedido.pdf.exeExplorer.EXEcmd.exedescription pid process target process PID 1124 wrote to memory of 3012 1124 Confirmação do pedido.pdf.exe Confirmação do pedido.pdf.exe PID 1124 wrote to memory of 3012 1124 Confirmação do pedido.pdf.exe Confirmação do pedido.pdf.exe PID 1124 wrote to memory of 3012 1124 Confirmação do pedido.pdf.exe Confirmação do pedido.pdf.exe PID 1124 wrote to memory of 3012 1124 Confirmação do pedido.pdf.exe Confirmação do pedido.pdf.exe PID 1124 wrote to memory of 3012 1124 Confirmação do pedido.pdf.exe Confirmação do pedido.pdf.exe PID 1124 wrote to memory of 3012 1124 Confirmação do pedido.pdf.exe Confirmação do pedido.pdf.exe PID 1124 wrote to memory of 3012 1124 Confirmação do pedido.pdf.exe Confirmação do pedido.pdf.exe PID 1204 wrote to memory of 2572 1204 Explorer.EXE cmd.exe PID 1204 wrote to memory of 2572 1204 Explorer.EXE cmd.exe PID 1204 wrote to memory of 2572 1204 Explorer.EXE cmd.exe PID 1204 wrote to memory of 2572 1204 Explorer.EXE cmd.exe PID 2572 wrote to memory of 2532 2572 cmd.exe cmd.exe PID 2572 wrote to memory of 2532 2572 cmd.exe cmd.exe PID 2572 wrote to memory of 2532 2572 cmd.exe cmd.exe PID 2572 wrote to memory of 2532 2572 cmd.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Confirmação do pedido.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Confirmação do pedido.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Confirmação do pedido.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Confirmação do pedido.pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Confirmação do pedido.pdf.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1124-1-0x00000000745A0000-0x0000000074C8E000-memory.dmpFilesize
6.9MB
-
memory/1124-2-0x0000000004CF0000-0x0000000004D30000-memory.dmpFilesize
256KB
-
memory/1124-3-0x0000000000320000-0x0000000000332000-memory.dmpFilesize
72KB
-
memory/1124-4-0x0000000000340000-0x000000000034C000-memory.dmpFilesize
48KB
-
memory/1124-5-0x0000000004C40000-0x0000000004CB6000-memory.dmpFilesize
472KB
-
memory/1124-0-0x0000000000F00000-0x0000000000F9A000-memory.dmpFilesize
616KB
-
memory/1124-11-0x00000000745A0000-0x0000000074C8E000-memory.dmpFilesize
6.9MB
-
memory/1204-15-0x0000000002DF0000-0x0000000002EF0000-memory.dmpFilesize
1024KB
-
memory/1204-30-0x0000000006EA0000-0x0000000007006000-memory.dmpFilesize
1.4MB
-
memory/1204-22-0x0000000006EA0000-0x0000000007006000-memory.dmpFilesize
1.4MB
-
memory/1204-17-0x00000000067D0000-0x00000000068F7000-memory.dmpFilesize
1.2MB
-
memory/2572-29-0x0000000002200000-0x0000000002293000-memory.dmpFilesize
588KB
-
memory/2572-25-0x00000000000C0000-0x00000000000EF000-memory.dmpFilesize
188KB
-
memory/2572-24-0x000000004AA10000-0x000000004AA5C000-memory.dmpFilesize
304KB
-
memory/2572-26-0x0000000001EF0000-0x00000000021F3000-memory.dmpFilesize
3.0MB
-
memory/2572-27-0x00000000000C0000-0x00000000000EF000-memory.dmpFilesize
188KB
-
memory/2572-23-0x000000004AA10000-0x000000004AA5C000-memory.dmpFilesize
304KB
-
memory/3012-6-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3012-20-0x00000000002D0000-0x00000000002E4000-memory.dmpFilesize
80KB
-
memory/3012-19-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3012-16-0x0000000000180000-0x0000000000194000-memory.dmpFilesize
80KB
-
memory/3012-14-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3012-12-0x0000000000A40000-0x0000000000D43000-memory.dmpFilesize
3.0MB
-
memory/3012-10-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3012-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/3012-7-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB