Overview
overview
10Static
static
30143896638...df.exe
windows7-x64
100143896638...df.exe
windows10-2004-x64
10$APPDATA/v...60.dll
windows7-x64
1$APPDATA/v...60.dll
windows10-2004-x64
1$APPDATA/v...60.dll
windows7-x64
1$APPDATA/v...60.dll
windows10-2004-x64
1$APPDATA/v...pc.exe
windows7-x64
1$APPDATA/v...pc.exe
windows10-2004-x64
1$APPDATA/v...tp.dll
windows7-x64
1$APPDATA/v...tp.dll
windows10-2004-x64
1$APPDATA/v...en.dll
windows7-x64
1$APPDATA/v...en.dll
windows10-2004-x64
1$TEMP/AnaMetaphor.dll
windows7-x64
1$TEMP/AnaMetaphor.dll
windows10-2004-x64
1$TEMP/dev6...60.dll
windows7-x64
1$TEMP/dev6...60.dll
windows10-2004-x64
1$TEMP/dev6...ib.dll
windows7-x64
1$TEMP/dev6...ib.dll
windows10-2004-x64
1$TEMP/dev6...MA.dll
windows7-x64
1$TEMP/dev6...MA.dll
windows10-2004-x64
1$TEMP/dev6...lp.dll
windows7-x64
1$TEMP/dev6...lp.dll
windows10-2004-x64
1Analysis
-
max time kernel
11s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 06:46
Static task
static1
Behavioral task
behavioral1
Sample
01438966382020_pdf.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
01438966382020_pdf.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$APPDATA/vehicletestdrive/_tmp/18.opends60.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$APPDATA/vehicletestdrive/_tmp/18.opends60.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$APPDATA/vehicletestdrive/_tmp/62.opends60.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
$APPDATA/vehicletestdrive/_tmp/62.opends60.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$APPDATA/vehicletestdrive/_tmp/cert2spc.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$APPDATA/vehicletestdrive/_tmp/cert2spc.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
$APPDATA/vehicletestdrive/_tmp/contextp.dll
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
$APPDATA/vehicletestdrive/_tmp/contextp.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$APPDATA/vehicletestdrive/_tmp/crtowordsen.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
$APPDATA/vehicletestdrive/_tmp/crtowordsen.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
$TEMP/AnaMetaphor.dll
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
$TEMP/AnaMetaphor.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$TEMP/dev60cgi/36.opends60.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$TEMP/dev60cgi/36.opends60.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
$TEMP/dev60cgi/CrystalKeyCodeLib.dll
Resource
win7-20240419-en
Behavioral task
behavioral18
Sample
$TEMP/dev60cgi/CrystalKeyCodeLib.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
$TEMP/dev60cgi/DesktopDMA.dll
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
$TEMP/dev60cgi/DesktopDMA.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
$TEMP/dev60cgi/MicrosoftVisualStudioVSHelp.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
$TEMP/dev60cgi/MicrosoftVisualStudioVSHelp.dll
Resource
win10v2004-20240426-en
General
-
Target
01438966382020_pdf.exe
-
Size
370KB
-
MD5
abfb06139a39dec1e276b04cb62ec985
-
SHA1
422cf21107f9ce0e2cb0e20398afde711f4374fc
-
SHA256
7af08bbd907a68770548426050115d6b0aeba599e0c3bd03c03f5ef8268ceb11
-
SHA512
2c3fee56e8e59a0b07cf9db17127013be4ae8b3be47dab5099d25247320fe81cfe696057c76541e567cb8cef2942a6e3b97b7b1f8584cd3363fbb5d6ce687190
-
SSDEEP
6144:rPCganNbXQ0tyqc95+FXffzBvekHyq9s28WeC2X8cESMj+W9blvcZ97B+OeVnF:ZanG0C95+5fzHDOlWeWPN9blEHBJeVF
Malware Config
Extracted
formbook
3.9
gm1
802477.com
theclippersofficial.com
mysticadventuresails.com
joshkaeding.com
www4915a.com
nicolasdumasxiii.com
transbagasputra.com
motherdaughter.date
truflorawellness.com
ff1q.com
elettronicasmart.com
obtes.com
pfamkyr.com
9ycpbr.info
gtitdunproductions.com
mashreviews.com
methvenonthemove.com
jinshavip38.com
theedgebizconnect.com
jessandalextietheknot.com
vallleylnd.net
w.mom
formacionparaelexito.com
robinruhmel.com
annualtransmission.technology
nazitube.com
executiveliontamer.com
411hotwire.com
sendoba.com
xnyppw.com
un4mo.com
pepper.guide
novaeramotoboysportoalegre.com
limper.net
cloudyans.com
atomicyou.com
jentang.com
hylg6.com
laperamordidablog.com
mannionexpertseniorcare.com
009cb.com
azasianow.com
intera-canada.com
bladexpo.com
affinityhomeinspectionpro.com
purrfectlynoble.com
3lmktgsvc.com
babooneh.net
sholarshyp.com
startboostcapital.com
pamhomedaycare.com
homecoralgables.com
q83pfq.biz
100fwq.com
incmint.com
k-pagador.com
stoxcrypto.com
sketchgecko.com
myweddingbeautiful.com
playgroundcareer.com
suite5digital.com
fristcreditunion.com
astonfly.info
www750456.com
glamotd.com
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3676-31-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/3676-34-0x0000000000400000-0x000000000042A000-memory.dmp formbook -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Users\Admin\AppData\Local\Temp\01438966382020_pdf.exe"C:\Users\Admin\AppData\Local\Temp\01438966382020_pdf.exe"1⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe AnaMetaphor,Pretor2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"1⤵
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AnaMetaphor.DLLFilesize
19KB
MD5eca4d3581bfee01fbbdfab46e73b8afb
SHA138b63ea322bd5f9b5ca14046a42f7ee25cf357d1
SHA2562d4b4f73706eb3753f57ecf1e83e4ae68b8c07c72fe64a2aa2b0d80e5f64b7b3
SHA512ef2f552f5216775aae85ac0835a7eb34498825e64961eb614a6728f76eaaef3e4ae36a847d0f7cfc30cce1b5c03e1521de93e1801db0a171dafbfbd73be66c20
-
C:\Users\Admin\AppData\Local\Temp\ChairFilesize
256KB
MD52ec9f2b086bfcbd1d55e4c4a99b9fa7a
SHA11a07c44f54767d173645e17d499e0887d7305a39
SHA256150a8af0387c3e34eeb24aa0ddda27dd3e811ba83f79c157fa9eeb3c736fee54
SHA5124ce0c97e443c2c046e29d255c1a2453f87300daf4e7a1b6f134a1ba71c633dae3aa07420681d3808eea9fe221e732d8497c7a56cf0f95b715a14e90c13765754
-
C:\Users\Admin\AppData\Local\Temp\DB1Filesize
46KB
MD58f5942354d3809f865f9767eddf51314
SHA120be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
-
C:\Users\Admin\AppData\Roaming\-K2PO3U9\-K2logrv.iniFilesize
872B
MD5bbc41c78bae6c71e63cb544a6a284d94
SHA133f2c1d9fa0e9c99b80bc2500621e95af38b1f9a
SHA256ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb
SHA5120aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4
-
memory/2616-29-0x00000000748C0000-0x0000000074988000-memory.dmpFilesize
800KB
-
memory/2616-26-0x00000000748C0000-0x0000000074988000-memory.dmpFilesize
800KB
-
memory/2616-27-0x00000000774C0000-0x0000000077523000-memory.dmpFilesize
396KB
-
memory/2616-25-0x0000000000780000-0x0000000000782000-memory.dmpFilesize
8KB
-
memory/2656-33-0x0000000000630000-0x000000000068A000-memory.dmpFilesize
360KB
-
memory/2656-35-0x0000000000630000-0x000000000068A000-memory.dmpFilesize
360KB
-
memory/3464-37-0x0000000007480000-0x000000000754B000-memory.dmpFilesize
812KB
-
memory/3676-28-0x0000000000FA0000-0x0000000000FA6000-memory.dmpFilesize
24KB
-
memory/3676-31-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/3676-34-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB