Analysis
- max time kernel
148s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
23/07/2024, 12:20
General
- Target NUEVO ORDEN_202407238454854.pdf.exe
- Size 558KB
- Sample240723-phrlvsscpe
- SHA256 ba6b404291eeee5e3a7f92f8debfd1af684035664d95fcfdb7ea8fef1b2da40e
Malware Config
Extracted
-
formbook
-
4.1
-
rn94
-
st68v.xyz
-
conciergenotary.net
-
qwechaotk.top
-
rtpdonatoto29.xyz
-
8ad.xyz
-
powermove.top
-
cameras-30514.bond
-
vanguardcoffee.shop
-
umoe53fxc1bsujv.buzz
-
consultoriamax.net
-
hplxx.com
-
ndu.wtf
-
yzh478c.xyz
-
bigbrown999.site
-
xiake07.asia
-
resdai.xyz
-
the35678.shop
-
ba6rf.rest
-
ceo688.com
-
phimxhot.xyz
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 4 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NUEVO ORDEN_202407238454854.pdf.exe"C:\Users\Admin\AppData\Local\Temp\NUEVO ORDEN_202407238454854.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NUEVO ORDEN_202407238454854.pdf.exe"C:\Users\Admin\AppData\Local\Temp\NUEVO ORDEN_202407238454854.pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\NUEVO ORDEN_202407238454854.pdf.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1352-12-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1352-18-0x0000000000D20000-0x0000000000D35000-memory.dmp
memory/1352-17-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1352-15-0x00000000012F0000-0x000000000163A000-memory.dmp
memory/3492-36-0x00000000084D0000-0x0000000008632000-memory.dmp
memory/3492-33-0x00000000084D0000-0x0000000008632000-memory.dmp
memory/3492-32-0x00000000084D0000-0x0000000008632000-memory.dmp
memory/3492-30-0x0000000002750000-0x000000000282E000-memory.dmp
memory/3492-19-0x0000000002750000-0x000000000282E000-memory.dmp
memory/4240-7-0x00000000053A0000-0x000000000543C000-memory.dmp
memory/4240-4-0x0000000005120000-0x00000000051B2000-memory.dmp
memory/4240-11-0x0000000006640000-0x00000000066B6000-memory.dmp
memory/4240-9-0x00000000050F0000-0x0000000005100000-memory.dmp
memory/4240-14-0x0000000074DF0000-0x00000000755A0000-memory.dmp
memory/4240-8-0x0000000005440000-0x00000000054C8000-memory.dmp
memory/4240-0-0x0000000074DFE000-0x0000000074DFF000-memory.dmp
memory/4240-6-0x0000000074DF0000-0x00000000755A0000-memory.dmp
memory/4240-5-0x00000000050B0000-0x00000000050BA000-memory.dmp
memory/4240-10-0x0000000005100000-0x000000000510E000-memory.dmp
memory/4240-1-0x0000000000700000-0x0000000000790000-memory.dmp
memory/4240-2-0x00000000055B0000-0x0000000005ADC000-memory.dmp
memory/4240-3-0x0000000006090000-0x0000000006634000-memory.dmp
memory/4816-20-0x0000000000CA0000-0x0000000000CB2000-memory.dmp
memory/4816-27-0x0000000000820000-0x000000000084F000-memory.dmp
memory/4816-28-0x0000000002600000-0x0000000002694000-memory.dmp
memory/4816-26-0x00000000027D0000-0x0000000002B1A000-memory.dmp
memory/4816-25-0x0000000000820000-0x000000000084F000-memory.dmp
memory/4816-22-0x0000000000CA0000-0x0000000000CB2000-memory.dmp
memory/4816-24-0x0000000000CA0000-0x0000000000CB2000-memory.dmp