Overview
overview
10Static
static
30143896638...df.exe
windows7-x64
100143896638...df.exe
windows10-2004-x64
10$APPDATA/v...60.dll
windows7-x64
1$APPDATA/v...60.dll
windows10-2004-x64
1$APPDATA/v...60.dll
windows7-x64
1$APPDATA/v...60.dll
windows10-2004-x64
1$APPDATA/v...pc.exe
windows7-x64
1$APPDATA/v...pc.exe
windows10-2004-x64
1$APPDATA/v...tp.dll
windows7-x64
1$APPDATA/v...tp.dll
windows10-2004-x64
1$APPDATA/v...en.dll
windows7-x64
1$APPDATA/v...en.dll
windows10-2004-x64
1$TEMP/AnaMetaphor.dll
windows7-x64
1$TEMP/AnaMetaphor.dll
windows10-2004-x64
1$TEMP/dev6...60.dll
windows7-x64
1$TEMP/dev6...60.dll
windows10-2004-x64
1$TEMP/dev6...ib.dll
windows7-x64
1$TEMP/dev6...ib.dll
windows10-2004-x64
1$TEMP/dev6...MA.dll
windows7-x64
1$TEMP/dev6...MA.dll
windows10-2004-x64
1$TEMP/dev6...lp.dll
windows7-x64
1$TEMP/dev6...lp.dll
windows10-2004-x64
1Analysis
-
max time kernel
148s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 06:46
Static task
static1
Behavioral task
behavioral1
Sample
01438966382020_pdf.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
01438966382020_pdf.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$APPDATA/vehicletestdrive/_tmp/18.opends60.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$APPDATA/vehicletestdrive/_tmp/18.opends60.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$APPDATA/vehicletestdrive/_tmp/62.opends60.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
$APPDATA/vehicletestdrive/_tmp/62.opends60.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$APPDATA/vehicletestdrive/_tmp/cert2spc.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$APPDATA/vehicletestdrive/_tmp/cert2spc.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
$APPDATA/vehicletestdrive/_tmp/contextp.dll
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
$APPDATA/vehicletestdrive/_tmp/contextp.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$APPDATA/vehicletestdrive/_tmp/crtowordsen.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
$APPDATA/vehicletestdrive/_tmp/crtowordsen.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
$TEMP/AnaMetaphor.dll
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
$TEMP/AnaMetaphor.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$TEMP/dev60cgi/36.opends60.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$TEMP/dev60cgi/36.opends60.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
$TEMP/dev60cgi/CrystalKeyCodeLib.dll
Resource
win7-20240419-en
Behavioral task
behavioral18
Sample
$TEMP/dev60cgi/CrystalKeyCodeLib.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
$TEMP/dev60cgi/DesktopDMA.dll
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
$TEMP/dev60cgi/DesktopDMA.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
$TEMP/dev60cgi/MicrosoftVisualStudioVSHelp.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
$TEMP/dev60cgi/MicrosoftVisualStudioVSHelp.dll
Resource
win10v2004-20240426-en
General
-
Target
01438966382020_pdf.exe
-
Size
370KB
-
MD5
abfb06139a39dec1e276b04cb62ec985
-
SHA1
422cf21107f9ce0e2cb0e20398afde711f4374fc
-
SHA256
7af08bbd907a68770548426050115d6b0aeba599e0c3bd03c03f5ef8268ceb11
-
SHA512
2c3fee56e8e59a0b07cf9db17127013be4ae8b3be47dab5099d25247320fe81cfe696057c76541e567cb8cef2942a6e3b97b7b1f8584cd3363fbb5d6ce687190
-
SSDEEP
6144:rPCganNbXQ0tyqc95+FXffzBvekHyq9s28WeC2X8cESMj+W9blvcZ97B+OeVnF:ZanG0C95+5fzHDOlWeWPN9blEHBJeVF
Malware Config
Extracted
formbook
3.9
gm1
802477.com
theclippersofficial.com
mysticadventuresails.com
joshkaeding.com
www4915a.com
nicolasdumasxiii.com
transbagasputra.com
motherdaughter.date
truflorawellness.com
ff1q.com
elettronicasmart.com
obtes.com
pfamkyr.com
9ycpbr.info
gtitdunproductions.com
mashreviews.com
methvenonthemove.com
jinshavip38.com
theedgebizconnect.com
jessandalextietheknot.com
vallleylnd.net
w.mom
formacionparaelexito.com
robinruhmel.com
annualtransmission.technology
nazitube.com
executiveliontamer.com
411hotwire.com
sendoba.com
xnyppw.com
un4mo.com
pepper.guide
novaeramotoboysportoalegre.com
limper.net
cloudyans.com
atomicyou.com
jentang.com
hylg6.com
laperamordidablog.com
mannionexpertseniorcare.com
009cb.com
azasianow.com
intera-canada.com
bladexpo.com
affinityhomeinspectionpro.com
purrfectlynoble.com
3lmktgsvc.com
babooneh.net
sholarshyp.com
startboostcapital.com
pamhomedaycare.com
homecoralgables.com
q83pfq.biz
100fwq.com
incmint.com
k-pagador.com
stoxcrypto.com
sketchgecko.com
myweddingbeautiful.com
playgroundcareer.com
suite5digital.com
fristcreditunion.com
astonfly.info
www750456.com
glamotd.com
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2688-31-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/2688-35-0x0000000000400000-0x000000000042A000-memory.dmp formbook -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 2728 rundll32.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
cmd.execscript.exedescription pid process target process PID 2688 set thread context of 1208 2688 cmd.exe Explorer.EXE PID 2788 set thread context of 1208 2788 cscript.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
rundll32.execmd.execscript.exepid process 2728 rundll32.exe 2688 cmd.exe 2688 cmd.exe 2788 cscript.exe 2788 cscript.exe 2788 cscript.exe 2788 cscript.exe 2788 cscript.exe 2788 cscript.exe 2788 cscript.exe 2788 cscript.exe 2788 cscript.exe 2788 cscript.exe 2788 cscript.exe 2788 cscript.exe 2788 cscript.exe 2788 cscript.exe 2788 cscript.exe 2788 cscript.exe 2788 cscript.exe 2788 cscript.exe 2788 cscript.exe 2788 cscript.exe 2788 cscript.exe 2788 cscript.exe 2788 cscript.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
rundll32.execmd.execscript.exepid process 2728 rundll32.exe 2688 cmd.exe 2688 cmd.exe 2688 cmd.exe 2788 cscript.exe 2788 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
cmd.execscript.exedescription pid process Token: SeDebugPrivilege 2688 cmd.exe Token: SeDebugPrivilege 2788 cscript.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
01438966382020_pdf.exerundll32.exeExplorer.EXEcscript.exedescription pid process target process PID 1340 wrote to memory of 2728 1340 01438966382020_pdf.exe rundll32.exe PID 1340 wrote to memory of 2728 1340 01438966382020_pdf.exe rundll32.exe PID 1340 wrote to memory of 2728 1340 01438966382020_pdf.exe rundll32.exe PID 1340 wrote to memory of 2728 1340 01438966382020_pdf.exe rundll32.exe PID 1340 wrote to memory of 2728 1340 01438966382020_pdf.exe rundll32.exe PID 1340 wrote to memory of 2728 1340 01438966382020_pdf.exe rundll32.exe PID 1340 wrote to memory of 2728 1340 01438966382020_pdf.exe rundll32.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 2728 wrote to memory of 2688 2728 rundll32.exe cmd.exe PID 1208 wrote to memory of 2788 1208 Explorer.EXE cscript.exe PID 1208 wrote to memory of 2788 1208 Explorer.EXE cscript.exe PID 1208 wrote to memory of 2788 1208 Explorer.EXE cscript.exe PID 1208 wrote to memory of 2788 1208 Explorer.EXE cscript.exe PID 2788 wrote to memory of 2196 2788 cscript.exe cmd.exe PID 2788 wrote to memory of 2196 2788 cscript.exe cmd.exe PID 2788 wrote to memory of 2196 2788 cscript.exe cmd.exe PID 2788 wrote to memory of 2196 2788 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\01438966382020_pdf.exe"C:\Users\Admin\AppData\Local\Temp\01438966382020_pdf.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe AnaMetaphor,Pretor3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AnaMetaphor.DLLFilesize
19KB
MD5eca4d3581bfee01fbbdfab46e73b8afb
SHA138b63ea322bd5f9b5ca14046a42f7ee25cf357d1
SHA2562d4b4f73706eb3753f57ecf1e83e4ae68b8c07c72fe64a2aa2b0d80e5f64b7b3
SHA512ef2f552f5216775aae85ac0835a7eb34498825e64961eb614a6728f76eaaef3e4ae36a847d0f7cfc30cce1b5c03e1521de93e1801db0a171dafbfbd73be66c20
-
C:\Users\Admin\AppData\Local\Temp\ChairFilesize
256KB
MD52ec9f2b086bfcbd1d55e4c4a99b9fa7a
SHA11a07c44f54767d173645e17d499e0887d7305a39
SHA256150a8af0387c3e34eeb24aa0ddda27dd3e811ba83f79c157fa9eeb3c736fee54
SHA5124ce0c97e443c2c046e29d255c1a2453f87300daf4e7a1b6f134a1ba71c633dae3aa07420681d3808eea9fe221e732d8497c7a56cf0f95b715a14e90c13765754
-
memory/1208-42-0x0000000004C70000-0x0000000004DA5000-memory.dmpFilesize
1.2MB
-
memory/1208-37-0x0000000004C70000-0x0000000004DA5000-memory.dmpFilesize
1.2MB
-
memory/1208-34-0x0000000000010000-0x0000000000020000-memory.dmpFilesize
64KB
-
memory/2688-32-0x00000000020F0000-0x00000000023F3000-memory.dmpFilesize
3.0MB
-
memory/2688-31-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2688-28-0x00000000000D0000-0x00000000000D6000-memory.dmpFilesize
24KB
-
memory/2688-35-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2688-36-0x0000000000340000-0x0000000000354000-memory.dmpFilesize
80KB
-
memory/2728-29-0x0000000074EB0000-0x0000000074F08000-memory.dmpFilesize
352KB
-
memory/2728-27-0x0000000076170000-0x00000000761A5000-memory.dmpFilesize
212KB
-
memory/2728-25-0x0000000074EB0000-0x0000000074F08000-memory.dmpFilesize
352KB
-
memory/2728-26-0x00000000000C0000-0x00000000000C2000-memory.dmpFilesize
8KB
-
memory/2788-39-0x0000000000CF0000-0x0000000000D12000-memory.dmpFilesize
136KB
-
memory/2788-38-0x0000000000CF0000-0x0000000000D12000-memory.dmpFilesize
136KB