Analysis
- max time kernel
146s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
13/09/2024, 12:34
Static task
static1
Behavioral task
behavioral1
Sample
101 2043 5770 pdf.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
- Target 101 2043 5770 pdf.exe
- Size 2.1MB
- Sample240913-prrm8a1ckp
- SHA256 619785d76ee2055a1aca904e2a3e7fb2db9682b99602f7537ab8cd8ade9551da
- MD5 347c2e55b52480f82e8f45344fd2a7f8
- SHA1 9818c55d04a25dc17f43fe0371a73a1261aefcdf
- SHA512 47a5715c9cc343521e8081f5b26ef6755e026aafdfdd09048f1932b63f0b9bbf85e7e989d68240fc6025426442b5ff8f389d9bc625f22ef085d5d0b261a6bcad
- SSDEEP 49152:IuAEE6l/kZzz3uBytwA6cYAyhEvFB4W1edYWW2SMO5:XuzUE2W
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
n7ak
Decoy
-
wise-transfer.info
-
jam-nins.com
-
thebestsocialcrm.com
-
majomeow222.com
-
ancientshadowguilt.space
-
gentleman-china.com
-
parquemermoz.store
-
taxuw.com
-
sharqiyapaints.com
-
libraryofkath.com
-
1949wan.com
-
synqr.net
-
bitchessgirls.com
-
btonu.cfd
-
coding-bootcamps-16314.com
-
leadership22-tdh.site
-
maximsboutique.com
-
irishsummertruffles.com
-
sdnaqianchuan.com
-
uyews.xyz
-
mostvisitors.com
-
prembug.com
-
lebondtrip.com
-
villavouno.com
-
solanosotostudio.com
-
pbx1.website
-
littleeturtle.com
-
supremeajock.biz
-
turborings.run
-
parkpeninsula.online
-
goodstuff.tv
-
17qld.com
-
thehandycrewcompany.com
-
alwaystuesdaytacos.com
-
entribeworks.com
-
susanboyleinfo.com
-
volkovastyu.com
-
tradingmoja.com
-
germancompany-eg.com
-
gameofgem.com
-
hbdpcq.com
-
budsdesigns.com
-
sistemrizal.xyz
-
395boulderbrookdr.com
-
forounlock.com
-
cp2967.com
-
creatividadymedia.com
-
marocquadchallenge.com
-
tuktukwines.com
-
tripskorea.com
-
eyvonnesewingshop.com
-
1690.biz
-
perfectkick.website
-
jreengineering.tech
-
lilmeow.store
-
ttjsdispatchingllc.com
-
carltonellis.com
-
redantholdings.com
-
luxuryworkingfarms.com
-
appsecintelligence.com
-
studmate.online
-
imogenbot.store
-
netheerlandart.com
-
bikelegalkentucky.com
-
playdoapp.online
Signatures
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/1524-0-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1524-3-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3276-8-0x0000000000830000-0x000000000085F000-memory.dmp formbook - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4380 set thread context of 1524 4380 101 2043 5770 pdf.exe 84 PID 1524 set thread context of 3476 1524 ngen.exe 56 PID 3276 set thread context of 3476 3276 cmstp.exe 56 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmstp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmstp.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 1524 ngen.exe 1524 ngen.exe 1524 ngen.exe 1524 ngen.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1524 ngen.exe 1524 ngen.exe 1524 ngen.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe 3276 cmstp.exe - Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 4380 101 2043 5770 pdf.exe Token: SeDebugPrivilege 1524 ngen.exe Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeDebugPrivilege 3276 cmstp.exe Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3476 Explorer.EXE 3476 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3476 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4380 wrote to memory of 1524 4380 101 2043 5770 pdf.exe 84 PID 4380 wrote to memory of 1524 4380 101 2043 5770 pdf.exe 84 PID 4380 wrote to memory of 1524 4380 101 2043 5770 pdf.exe 84 PID 4380 wrote to memory of 1524 4380 101 2043 5770 pdf.exe 84 PID 4380 wrote to memory of 1524 4380 101 2043 5770 pdf.exe 84 PID 4380 wrote to memory of 1524 4380 101 2043 5770 pdf.exe 84 PID 3476 wrote to memory of 3276 3476 Explorer.EXE 87 PID 3476 wrote to memory of 3276 3476 Explorer.EXE 87 PID 3476 wrote to memory of 3276 3476 Explorer.EXE 87 PID 3276 wrote to memory of 4016 3276 cmstp.exe 94 PID 3276 wrote to memory of 4016 3276 cmstp.exe 94 PID 3276 wrote to memory of 4016 3276 cmstp.exe 94 PID 3276 wrote to memory of 4184 3276 cmstp.exe 99 PID 3276 wrote to memory of 4184 3276 cmstp.exe 99 PID 3276 wrote to memory of 4184 3276 cmstp.exe 99
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\101 2043 5770 pdf.exe"C:\Users\Admin\AppData\Local\Temp\101 2043 5770 pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1524
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
- System Location Discovery: System Language Discovery
PID:4016
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:4184
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\DB1
- Size 40KB
- SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
- MD5 a182561a527f929489bf4b8f74f65cd7
- SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
- SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558
- SSDEEP 48:2DcnBA+IIBoCVEq8Ma0D0HOlf/6ykwpLf/EUwMHZq10bvJKLkw8s8LKvUf9KVyJJ:uSQCn8MouB6w9f/8iZqmvJKLPeymwil
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\94O2R65S\94Ologim.jpeg
- Size 83KB
- SHA256 3fcd99eab6f986d15aa24ecae594f6ad82adb4f4dde692791b565222271fcf0d
- MD5 65a6a0ffebb57fb3890fe7d179c8d971
- SHA1 b30a52882e80f32915b2b812f9f1ff089787b31f
- SHA512 25f5f6ffd37d39f4f36738dbcce340457e10619e0ae6951751267fdd738c4011bc02fabf65d8bcaff1f287cbdd4d3534895db1236b5484a8b85d755013de4a6b
- SSDEEP 1536:sCzAZ1PlR6O9o1WPbBCbExPv/i2vHtfRbx+R2qq00TUGqKJrJFippp22SD:kRT9o1P8/dvNf2R2qqbT7qc8l+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\94O2R65S\94Ologrf.ini
- Size 40B
- SHA256 1662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
- MD5 2f245469795b865bdd1b956c23d7893d
- SHA1 6ad80b974d3808f5a20ea1e766c7d2f88b9e5895
- SHA512 909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\94O2R65S\94Ologrg.ini
- Size 38B
- SHA256 75034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56
- MD5 4aadf49fed30e4c9b3fe4a3dd6445ebe
- SHA1 1e332822167c6f351b99615eada2c30a538ff037
- SHA512 eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\94O2R65S\94Ologri.ini
- Size 40B
- SHA256 eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
- MD5 d63a82e5d81e02e399090af26db0b9cb
- SHA1 91d0014c8f54743bba141fd60c9d963f869d76c9
- SHA512 38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\94O2R65S\94Ologrv.ini
- Size 872B
- SHA256 ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb
- MD5 bbc41c78bae6c71e63cb544a6a284d94
- SHA1 33f2c1d9fa0e9c99b80bc2500621e95af38b1f9a
- SHA512 0aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4
- MD5 SHA1 SHA512