Analysis
- max time kernel
148s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
19/08/2024, 07:36
General
- Target Befehl.pdf.exe
- Size 397KB
- Sample240819-jfc3ssvdrn
- SHA256 1259432f41bd872ef92450755035a516b40fcae624473c3dbd64efe7d89987b1
Malware Config
Extracted
-
formbook
-
4.1
-
rn10
-
kedai168et.com
-
mental-olympics.com
-
pussybuildsstrongbones.net
-
857691.shop
-
hisellers.net
-
exposurecophotography.com
-
beaded-boutique.net
-
wednesdayholdings.com
-
plesacv.xyz
-
manonlineros.com
-
a0204.shop
-
333689g.com
-
dyprl716h.xyz
-
pulseirabet.com
-
fnet.work
-
bo-2024-001-v1-d1.xyz
-
ongaurdsecurity.com
-
giulianacristini.com
-
miladamani.com
-
magicalrealmshopkeeper.online
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 40 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Befehl.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Befehl.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Befehl.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Befehl.pdf.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Befehl.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Befehl.pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Befehl.pdf.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/668-16-0x0000000000400000-0x000000000042F000-memory.dmp
memory/668-21-0x0000000000400000-0x000000000042F000-memory.dmp
memory/668-22-0x0000000001340000-0x0000000001354000-memory.dmp
memory/668-19-0x0000000001960000-0x0000000001CAA000-memory.dmp
memory/3508-35-0x0000000008F30000-0x0000000009071000-memory.dmp
memory/3508-33-0x0000000008F30000-0x0000000009071000-memory.dmp
memory/3508-32-0x0000000008F30000-0x0000000009071000-memory.dmp
memory/3508-28-0x0000000008B20000-0x0000000008BE1000-memory.dmp
memory/3508-23-0x0000000008B20000-0x0000000008BE1000-memory.dmp
memory/4436-15-0x00000000750C0000-0x0000000075870000-memory.dmp
memory/4436-8-0x000000000F7F0000-0x000000000FD94000-memory.dmp
memory/4436-12-0x00000000750C0000-0x0000000075870000-memory.dmp
memory/4436-13-0x0000000008840000-0x000000000885A000-memory.dmp
memory/4436-14-0x0000000009B70000-0x0000000009B76000-memory.dmp
memory/4436-0-0x00000000750CE000-0x00000000750CF000-memory.dmp
memory/4436-10-0x0000000005C10000-0x0000000005C1A000-memory.dmp
memory/4436-18-0x00000000750C0000-0x0000000075870000-memory.dmp
memory/4436-9-0x0000000005C90000-0x0000000005D22000-memory.dmp
memory/4436-11-0x0000000005D60000-0x0000000005D66000-memory.dmp
memory/4436-7-0x00000000098B0000-0x0000000009B72000-memory.dmp
memory/4436-5-0x00000000750C0000-0x0000000075870000-memory.dmp
memory/4436-1-0x0000000000CC0000-0x0000000000D2A000-memory.dmp
memory/4436-2-0x00000000051B0000-0x000000000524C000-memory.dmp
memory/4436-3-0x00000000750C0000-0x0000000075870000-memory.dmp
memory/4436-4-0x00000000750CE000-0x00000000750CF000-memory.dmp
memory/4880-27-0x0000000000590000-0x00000000005BF000-memory.dmp
memory/4880-26-0x0000000000B30000-0x0000000000C0C000-memory.dmp
memory/4880-24-0x0000000000B30000-0x0000000000C0C000-memory.dmp