Overview
overview
10Static
static
3Soboce.zip
windows7-x64
1Soboce.zip
windows10-2004-x64
1e6b82e1c-a...6d.eml
windows7-x64
5e6b82e1c-a...6d.eml
windows10-2004-x64
3Solicitud ...DF.rar
windows7-x64
3Solicitud ...DF.rar
windows10-2004-x64
3Formulario...DF.exe
windows7-x64
10Formulario...DF.exe
windows10-2004-x64
10email-html-2.html
windows7-x64
1email-html-2.html
windows10-2004-x64
1email-plain-1.txt
windows7-x64
1email-plain-1.txt
windows10-2004-x64
1image001.png
windows7-x64
3image001.png
windows10-2004-x64
3Analysis
-
max time kernel
147s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
18-07-2024 13:18
Static task
static1
Behavioral task
behavioral1
Sample
Soboce.zip
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Soboce.zip
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
e6b82e1c-ac44-4023-8042-08dca5e19c90/4a7406b5-aea0-3461-afa2-c5f3f9b9a06d.eml
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
e6b82e1c-ac44-4023-8042-08dca5e19c90/4a7406b5-aea0-3461-afa2-c5f3f9b9a06d.eml
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Solicitud de Pedido SP N° 17850_16 07 2024 Soboce S.A_PDF.rar
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Solicitud de Pedido SP N° 17850_16 07 2024 Soboce S.A_PDF.rar
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
email-html-2.html
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
email-html-2.html
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
email-plain-1.txt
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
email-plain-1.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
image001.png
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
image001.png
Resource
win10v2004-20240709-en
General
-
Target
Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe
-
Size
829KB
-
MD5
59188cacdad5d6c8e3a0dae4b4a6680d
-
SHA1
82dc5ba9a229e30d96b1eedd05c404a5b4d49288
-
SHA256
4a3155f670006fb3500ca917e16b710f06f2a5f0d1345fb5824f732ec9d34c37
-
SHA512
0e0e43544ec5f21f941b041bcef31bd4372f525c05f8c4c1d91a695b85baecf06c4f62c59be1bce2e374dc7dc672df91678f59cb36c4ffcb6839874a1acc7ad2
-
SSDEEP
24576:fXRv6ZaOmXiJx7E6rSyT6Oiq/sIwieBjsq9Nn:PJ1OGiXoOnTHIVieBjj9Nn
Malware Config
Extracted
formbook
4.1
pz12
paucanyes.com
autonwheels.com
cowboysandcaviarbar.com
fitnessengineeredworkouts.com
nuevobajonfavorito.com
dflx8.com
rothability.com
sxybet88.com
onesource.live
brenjitu1904.com
airdrop-zero1labs.com
guangdongqiangzhetc.com
apartments-for-rent-72254.bond
ombak99.lol
qqfoodsolutions.com
kyyzz.com
thepicklematch.com
ainth.com
missorris.com
gabbygomez.com
aromacuppa.com
kaskusbagus.com
zoox1.asia
hemophilia-treatment-41433.bond
meidupro.com
shrisona.com
sekanse.com
marcocostasax.com
loyalbahis356.com
mzmz97.com
ma-google.com
xiangadvanced.site
tuotalogis.com
xcxocef.shop
fidgetbottles.com
shuaninvolved.site
ambientelatino.com
98980901.com
singhbrothersframes.com
pureamyl.com
hgs0713.net
surejobzapp.com
slotgame99.bet
datalakeflow.com
ebehemin.com
vanessasmobilespa.com
317wb.com
motchillssss.top
huesch.net
salesgymshark.shop
mejorcompra99.com
tacubashop.com
jessicaxsimmons.com
roar-stores.com
chalkandthimble.com
84556.vip
luyutuwen.com
siliconcollege.icu
marvowhite.com
gjxuh82y0u3h6.top
e2taop5.top
businessbroadway.com
cripmz.xyz
4hu259.com
jnhdh8827.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral7/memory/2348-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral7/memory/2348-18-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral7/memory/2904-20-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2632 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exeFormulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exemsdt.exedescription pid process target process PID 2932 set thread context of 2348 2932 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe PID 2348 set thread context of 1196 2348 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe Explorer.EXE PID 2904 set thread context of 1196 2904 msdt.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exeFormulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exepowershell.exemsdt.exepid process 2932 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe 2932 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe 2348 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe 2348 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe 1480 powershell.exe 2904 msdt.exe 2904 msdt.exe 2904 msdt.exe 2904 msdt.exe 2904 msdt.exe 2904 msdt.exe 2904 msdt.exe 2904 msdt.exe 2904 msdt.exe 2904 msdt.exe 2904 msdt.exe 2904 msdt.exe 2904 msdt.exe 2904 msdt.exe 2904 msdt.exe 2904 msdt.exe 2904 msdt.exe 2904 msdt.exe 2904 msdt.exe 2904 msdt.exe 2904 msdt.exe 2904 msdt.exe 2904 msdt.exe 2904 msdt.exe 2904 msdt.exe 2904 msdt.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exemsdt.exepid process 2348 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe 2348 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe 2348 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe 2904 msdt.exe 2904 msdt.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exeFormulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exepowershell.exemsdt.exedescription pid process Token: SeDebugPrivilege 2932 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe Token: SeDebugPrivilege 2348 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe Token: SeDebugPrivilege 1480 powershell.exe Token: SeDebugPrivilege 2904 msdt.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exeExplorer.EXEmsdt.exedescription pid process target process PID 2932 wrote to memory of 1480 2932 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe powershell.exe PID 2932 wrote to memory of 1480 2932 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe powershell.exe PID 2932 wrote to memory of 1480 2932 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe powershell.exe PID 2932 wrote to memory of 1480 2932 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe powershell.exe PID 2932 wrote to memory of 1420 2932 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe PID 2932 wrote to memory of 1420 2932 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe PID 2932 wrote to memory of 1420 2932 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe PID 2932 wrote to memory of 1420 2932 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe PID 2932 wrote to memory of 2348 2932 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe PID 2932 wrote to memory of 2348 2932 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe PID 2932 wrote to memory of 2348 2932 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe PID 2932 wrote to memory of 2348 2932 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe PID 2932 wrote to memory of 2348 2932 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe PID 2932 wrote to memory of 2348 2932 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe PID 2932 wrote to memory of 2348 2932 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe PID 1196 wrote to memory of 2904 1196 Explorer.EXE msdt.exe PID 1196 wrote to memory of 2904 1196 Explorer.EXE msdt.exe PID 1196 wrote to memory of 2904 1196 Explorer.EXE msdt.exe PID 1196 wrote to memory of 2904 1196 Explorer.EXE msdt.exe PID 2904 wrote to memory of 2632 2904 msdt.exe cmd.exe PID 2904 wrote to memory of 2632 2904 msdt.exe cmd.exe PID 2904 wrote to memory of 2632 2904 msdt.exe cmd.exe PID 2904 wrote to memory of 2632 2904 msdt.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe"C:\Users\Admin\AppData\Local\Temp\Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe"C:\Users\Admin\AppData\Local\Temp\Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe"3⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe"C:\Users\Admin\AppData\Local\Temp\Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2348 -
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe"3⤵
- Deletes itself
PID:2632