Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2024 04:39
Static task
static1
Behavioral task
behavioral1
Sample
payment receipt.pdf.exe
Resource
win7-20240221-en
General
-
Target
payment receipt.pdf.exe
-
Size
718KB
-
MD5
bf89abfa9b6ab9c4a57db5755c9cdfcd
-
SHA1
2d4a41455d99fbd04c7b57b2305e9d94b336f7e5
-
SHA256
577c82fedb4b5c3eb243952bb75cf48386cc4c04e969a13f15c3b1c27afccdcd
-
SHA512
f480f044a02eba1856abdda2e74ddc09722a9196ebf0d183384a2f8ddf074e1979c8001b75c114e8bd0bfda0291759c3062908c58ad9348df6d21944c0e0bbfd
-
SSDEEP
12288:lGxqRSVdMkuvMNptn0UF0QHUeHJzet10aqKgD3HtgeNA6aDCbuvqJFTPy:lGY4vaHQ0w+vqKgrNgeNjaDFvqm
Malware Config
Extracted
formbook
4.1
ghgn
nongnongqingyi.com
memojav.net
nothingbutallgoods.com
qiubaogu.com
consumeru.net
whitesandretreat.com
protectingtherepublic.com
rkpnews.com
captaincobyscajunseasoning.com
happyfilings.com
mznqa.com
food-truth-app.com
16crystallake.com
theisanitize.com
livefeelinggood.com
skiniences.com
rethgi4.icu
bucky.cloud
massageexchange.club
drshesalipatel.com
empowermentking.com
ssdtest.net
vivid-beats.com
zskdkc.com
pearsonconnexxus.com
freshf.world
tijancompound.com
ljplegal.net
undtctyky.club
bestnewhomeconstruction.com
lcsdgbc.com
wholisticexecutivecoaching.com
installatoricappotto.com
bestweightlosskey.com
thenestkeepers.com
s89sf.com
pupzilas.com
ssgasie.com
funhandwritinganalysis.com
hififa.com
penyaluranpuk05.net
yourautomationsimplified.com
directconnectiontuning.com
twobirdswithonestoned.net
ompeaceloveamen.com
hghat.com
one-san.net
bhaihost.com
dajiangzhibo28.com
roboticstrust.club
inventconsultancy.com
minuit-trois.com
estudiodigitalrc.com
luisxe.info
roadtorainbows.com
cash4yourcart.com
mtae2.icu
bitcoinasks.com
babalawoolaifa.com
omnirera.com
thedesignertravel.com
baersland.com
ace-expertises.com
thisisnotacookbook.com
podseedz.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2028-13-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2028-18-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3468-24-0x0000000000150000-0x000000000017E000-memory.dmp formbook behavioral2/memory/3468-26-0x0000000000150000-0x000000000017E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
payment receipt.pdf.exepayment receipt.pdf.execmd.exedescription pid process target process PID 2324 set thread context of 2028 2324 payment receipt.pdf.exe payment receipt.pdf.exe PID 2028 set thread context of 3484 2028 payment receipt.pdf.exe Explorer.EXE PID 3468 set thread context of 3484 3468 cmd.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
payment receipt.pdf.execmd.exepid process 2028 payment receipt.pdf.exe 2028 payment receipt.pdf.exe 2028 payment receipt.pdf.exe 2028 payment receipt.pdf.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe 3468 cmd.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
payment receipt.pdf.execmd.exepid process 2028 payment receipt.pdf.exe 2028 payment receipt.pdf.exe 2028 payment receipt.pdf.exe 3468 cmd.exe 3468 cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
payment receipt.pdf.execmd.exedescription pid process Token: SeDebugPrivilege 2028 payment receipt.pdf.exe Token: SeDebugPrivilege 3468 cmd.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3484 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
payment receipt.pdf.exeExplorer.EXEcmd.exedescription pid process target process PID 2324 wrote to memory of 2028 2324 payment receipt.pdf.exe payment receipt.pdf.exe PID 2324 wrote to memory of 2028 2324 payment receipt.pdf.exe payment receipt.pdf.exe PID 2324 wrote to memory of 2028 2324 payment receipt.pdf.exe payment receipt.pdf.exe PID 2324 wrote to memory of 2028 2324 payment receipt.pdf.exe payment receipt.pdf.exe PID 2324 wrote to memory of 2028 2324 payment receipt.pdf.exe payment receipt.pdf.exe PID 2324 wrote to memory of 2028 2324 payment receipt.pdf.exe payment receipt.pdf.exe PID 3484 wrote to memory of 3468 3484 Explorer.EXE cmd.exe PID 3484 wrote to memory of 3468 3484 Explorer.EXE cmd.exe PID 3484 wrote to memory of 3468 3484 Explorer.EXE cmd.exe PID 3468 wrote to memory of 400 3468 cmd.exe cmd.exe PID 3468 wrote to memory of 400 3468 cmd.exe cmd.exe PID 3468 wrote to memory of 400 3468 cmd.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\payment receipt.pdf.exe"C:\Users\Admin\AppData\Local\Temp\payment receipt.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\payment receipt.pdf.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\payment receipt.pdf.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2028-13-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2028-19-0x0000000001170000-0x0000000001184000-memory.dmpFilesize
80KB
-
memory/2028-18-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2028-16-0x00000000013B0000-0x00000000016FA000-memory.dmpFilesize
3.3MB
-
memory/2324-15-0x0000000074D90000-0x0000000075540000-memory.dmpFilesize
7.7MB
-
memory/2324-0-0x0000000000900000-0x00000000009BA000-memory.dmpFilesize
744KB
-
memory/2324-6-0x00000000052D0000-0x00000000052DA000-memory.dmpFilesize
40KB
-
memory/2324-7-0x00000000054F0000-0x0000000005546000-memory.dmpFilesize
344KB
-
memory/2324-8-0x00000000055F0000-0x0000000005604000-memory.dmpFilesize
80KB
-
memory/2324-9-0x0000000074D90000-0x0000000075540000-memory.dmpFilesize
7.7MB
-
memory/2324-10-0x00000000054E0000-0x00000000054F0000-memory.dmpFilesize
64KB
-
memory/2324-11-0x00000000080D0000-0x0000000008156000-memory.dmpFilesize
536KB
-
memory/2324-12-0x000000000A810000-0x000000000A844000-memory.dmpFilesize
208KB
-
memory/2324-4-0x0000000005340000-0x00000000053D2000-memory.dmpFilesize
584KB
-
memory/2324-1-0x0000000074D90000-0x0000000075540000-memory.dmpFilesize
7.7MB
-
memory/2324-3-0x0000000005850000-0x0000000005DF4000-memory.dmpFilesize
5.6MB
-
memory/2324-2-0x0000000005200000-0x000000000529C000-memory.dmpFilesize
624KB
-
memory/2324-5-0x00000000054E0000-0x00000000054F0000-memory.dmpFilesize
64KB
-
memory/3468-21-0x0000000000A50000-0x0000000000AAA000-memory.dmpFilesize
360KB
-
memory/3468-23-0x0000000000A50000-0x0000000000AAA000-memory.dmpFilesize
360KB
-
memory/3468-24-0x0000000000150000-0x000000000017E000-memory.dmpFilesize
184KB
-
memory/3468-25-0x0000000000E10000-0x000000000115A000-memory.dmpFilesize
3.3MB
-
memory/3468-26-0x0000000000150000-0x000000000017E000-memory.dmpFilesize
184KB
-
memory/3468-27-0x0000000000C80000-0x0000000000D13000-memory.dmpFilesize
588KB
-
memory/3484-20-0x0000000008960000-0x0000000008A8E000-memory.dmpFilesize
1.2MB
-
memory/3484-29-0x0000000008960000-0x0000000008A8E000-memory.dmpFilesize
1.2MB
-
memory/3484-32-0x0000000002F80000-0x000000000302A000-memory.dmpFilesize
680KB
-
memory/3484-33-0x0000000002F80000-0x000000000302A000-memory.dmpFilesize
680KB
-
memory/3484-36-0x0000000002F80000-0x000000000302A000-memory.dmpFilesize
680KB