Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
17-07-2024 11:24
Static task
static1
Behavioral task
behavioral1
Sample
PO-2024151-pdf.exe
Resource
win7-20240705-en
General
-
Target
PO-2024151-pdf.exe
-
Size
519KB
-
MD5
a7350ccb586d53c4f28bdc8db696b6a9
-
SHA1
c8cd7d3c0aa6233109b92c3976bb8a9a680b7397
-
SHA256
a94ee8ea98674e1714740123c2564eeac148992b5a1596972ace096bc8d9aa4a
-
SHA512
b29d7c9a0a24bfd2ecbe21efe7a8594fdb5a757e666b43deae0d68130eb10143c55e6fe9306a55a44e7aa24c03b914a87e651aa65bdda309c358931cdf5fbe44
-
SSDEEP
6144:OCent7w+F+HhCsLQcS7xI4KhwoGrC+skf8vKutKpfCLJHT6c:OCS9w+F+HgfHKhwoG2EEvK9ELJHT6c
Malware Config
Extracted
formbook
4.1
mu94
thenextamendment.net
automatiza.xyz
psikologhazelgungor.com
90857.net
robertoblondetrealtor.site
rv0awy.rest
74657.ooo
adigidea.com
world-healing.online
health4world.com
shyan.fun
anviltotable.com
vinger.online
juizltd.com
twmk.asia
cakescrushbyruby.com
listxtreme.com
00050026.xyz
finessedesignhouse.com
jsmm-27.xyz
privet128.band
wyhl668.top
crystalcornerdesignn.com
kameltoe2024.xyz
mwquas.xyz
bt365860.com
c2r2h.xyz
bregylzj.xyz
dxlhu.asia
mythandbody.com
7y-sorte.net
gameogem.com
yourhug.xyz
reviewfreak.net
langitwin.lol
jkku2.rest
het789.com
cn00417984.shop
ry5ls1e02ai.top
cathedrals.shop
kaaatooni.com
ctventure.net
50732650.com
699519f.xyz
sailors.solutions
couples-therapy-39471.bond
eco-liga.com
youngtv.net
31hum.com
cocaincoutre.com
kzliw.xyz
online-business-70709.bond
cleliasfamilychildcare.com
commonhype.dev
tufabricadefiestas.com
playstayaussie.com
best-precious.com
kbk99.fun
cprcertificationcoach.com
mysleepfriend.shop
bt365437.com
rajasusu.pics
youtuberjumpstart.com
bfgj46578456454.vip
dmvdrivingpermit.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3440-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3440-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1692-23-0x0000000000AA0000-0x0000000000ACF000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
cmstp.exeflow pid process 80 1692 cmstp.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO-2024151-pdf.exeMSBuild.execmstp.exedescription pid process target process PID 3512 set thread context of 3440 3512 PO-2024151-pdf.exe MSBuild.exe PID 3440 set thread context of 3528 3440 MSBuild.exe Explorer.EXE PID 1692 set thread context of 3528 1692 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
MSBuild.execmstp.exepid process 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe 1692 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
MSBuild.execmstp.exepid process 3440 MSBuild.exe 3440 MSBuild.exe 3440 MSBuild.exe 1692 cmstp.exe 1692 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
MSBuild.exeExplorer.EXEcmstp.exedescription pid process Token: SeDebugPrivilege 3440 MSBuild.exe Token: SeShutdownPrivilege 3528 Explorer.EXE Token: SeCreatePagefilePrivilege 3528 Explorer.EXE Token: SeDebugPrivilege 1692 cmstp.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3528 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PO-2024151-pdf.exeExplorer.EXEcmstp.exedescription pid process target process PID 3512 wrote to memory of 3440 3512 PO-2024151-pdf.exe MSBuild.exe PID 3512 wrote to memory of 3440 3512 PO-2024151-pdf.exe MSBuild.exe PID 3512 wrote to memory of 3440 3512 PO-2024151-pdf.exe MSBuild.exe PID 3512 wrote to memory of 3440 3512 PO-2024151-pdf.exe MSBuild.exe PID 3512 wrote to memory of 3440 3512 PO-2024151-pdf.exe MSBuild.exe PID 3512 wrote to memory of 3440 3512 PO-2024151-pdf.exe MSBuild.exe PID 3528 wrote to memory of 1692 3528 Explorer.EXE cmstp.exe PID 3528 wrote to memory of 1692 3528 Explorer.EXE cmstp.exe PID 3528 wrote to memory of 1692 3528 Explorer.EXE cmstp.exe PID 1692 wrote to memory of 3168 1692 cmstp.exe cmd.exe PID 1692 wrote to memory of 3168 1692 cmstp.exe cmd.exe PID 1692 wrote to memory of 3168 1692 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\PO-2024151-pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO-2024151-pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3440 -
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵PID:3168