Overview
overview
10Static
static
319979.exe
windows7-x64
1019979.exe
windows10-2004-x64
10Factura_855.pdf.exe
windows7-x64
10Factura_855.pdf.exe
windows10-2004-x64
7qfmjhb.exe
windows7-x64
3qfmjhb.exe
windows10-2004-x64
3Fattura_855.pdf.exe
windows7-x64
10Fattura_855.pdf.exe
windows10-2004-x64
7gocbcx.exe
windows7-x64
3gocbcx.exe
windows10-2004-x64
3IoC/MIL000...0.xlsm
windows7-x64
3IoC/MIL000...0.xlsm
windows10-2004-x64
1IoC/PO.xlsx
windows7-x64
8IoC/PO.xlsx
windows10-2004-x64
1PO_2022-04-33981.exe
windows7-x64
3PO_2022-04-33981.exe
windows10-2004-x64
10IoC/Pagamento.xlsx
windows7-x64
8IoC/Pagamento.xlsx
windows10-2004-x64
1IoC/SHIPPI...TS.rtf
windows7-x64
8IoC/SHIPPI...TS.rtf
windows10-2004-x64
3SMK_29082022.exe
windows7-x64
10SMK_29082022.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
-
max time kernel
146s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 20:05
Static task
static1
Behavioral task
behavioral1
Sample
19979.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
19979.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Factura_855.pdf.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Factura_855.pdf.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
qfmjhb.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
qfmjhb.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Fattura_855.pdf.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Fattura_855.pdf.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
gocbcx.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
gocbcx.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
IoC/MIL0000640730.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
IoC/MIL0000640730.xlsm
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
IoC/PO.xlsx
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
IoC/PO.xlsx
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
PO_2022-04-33981.exe
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
PO_2022-04-33981.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
IoC/Pagamento.xlsx
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
IoC/Pagamento.xlsx
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
IoC/SHIPPING DOCUMENTS.rtf
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
IoC/SHIPPING DOCUMENTS.rtf
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
SMK_29082022.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
SMK_29082022.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
Factura_855.pdf.exe
-
Size
214KB
-
MD5
fbcc50e49a03f6b2469352851fcc0800
-
SHA1
63f99919354e58010819251556f5ace361b7c390
-
SHA256
498cbaa02846904c60c9a349f49bc72a046d1cd686d858286f33cfcf39716215
-
SHA512
d7080f1d75a1f88d56d24da1f8d132625236a6057f5d0571bcac387afa27c2a294983d3df952bea8592812415d4210f4136f5a367b4cf81883e3d487c580b7f7
-
SSDEEP
6144:HNeZmOQDVfP9e6oAzSI/2Cou2L2YlOPrYbihN:HNlOQZP9e6RzS5c2LZcUU
Malware Config
Extracted
formbook
4.1
m0r9
neekoluldao.com
pandolam.com
homestore.website
inthemoart.com
plubmingcny.com
tsandjsdjproductions.com
bangkok-bars.com
theroganexperience.com
cisneros.media
cxaerfa.xyz
dalafea.online
eppsallen.com
kksm1.com
navega.site
coloradonews.info
rnhues3j.xyz
languageslibrary.com
metapharmacyphuket.net
invisiblelady.com
suculentaycactaceo3d.com
pupilo.xyz
daccake.com
lastgayconservative.com
enspireideas.com
marysaysmeh.com
socialconsultant.xyz
evansapartmentsinlagrangega.com
drillernewsupdate.com
myvegan.restaurant
voyagewithscottmonty.com
openproductize.club
cinemagicmovie.com
nftunick.com
velabonita.com
email-testingmavens.net
xiaoshuhao.com
cryptosong.xyz
coloradocompetition.com
composite.international
carrinhourbano.com
answer2017.com
xucug.com
toursmargaretriver.global
amicuscare.life
mpqbridalshowcase.com
loversondisplay.com
julie-agency.com
icloud-xn1.site
yofing.site
biygi.com
midiaestetic.com
mwykmm.icu
digitalprojects.site
dagreats.com
myhapocun.xyz
beritasejagat.com
37c24a3158dc6f1a.com
croninstarlight.com
wu6bqyjf7tvzs.xyz
catjo6.mobi
paarl.xyz
platinumoffres.store
letreensemble.com
shaatshop.com
greensborotattoo.com
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral3/memory/2544-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral3/memory/2544-18-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral3/memory/2264-24-0x0000000000110000-0x000000000013F000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
pid Process 772 qfmjhb.exe 2544 qfmjhb.exe -
Loads dropped DLL 3 IoCs
pid Process 3044 Factura_855.pdf.exe 3044 Factura_855.pdf.exe 772 qfmjhb.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 772 set thread context of 2544 772 qfmjhb.exe 32 PID 2544 set thread context of 1200 2544 qfmjhb.exe 21 PID 2264 set thread context of 1200 2264 chkdsk.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Factura_855.pdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qfmjhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chkdsk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2544 qfmjhb.exe 2544 qfmjhb.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe 2264 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2544 qfmjhb.exe 2544 qfmjhb.exe 2544 qfmjhb.exe 2264 chkdsk.exe 2264 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2544 qfmjhb.exe Token: SeDebugPrivilege 2264 chkdsk.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3044 wrote to memory of 772 3044 Factura_855.pdf.exe 30 PID 3044 wrote to memory of 772 3044 Factura_855.pdf.exe 30 PID 3044 wrote to memory of 772 3044 Factura_855.pdf.exe 30 PID 3044 wrote to memory of 772 3044 Factura_855.pdf.exe 30 PID 772 wrote to memory of 2544 772 qfmjhb.exe 32 PID 772 wrote to memory of 2544 772 qfmjhb.exe 32 PID 772 wrote to memory of 2544 772 qfmjhb.exe 32 PID 772 wrote to memory of 2544 772 qfmjhb.exe 32 PID 772 wrote to memory of 2544 772 qfmjhb.exe 32 PID 772 wrote to memory of 2544 772 qfmjhb.exe 32 PID 772 wrote to memory of 2544 772 qfmjhb.exe 32 PID 1200 wrote to memory of 2264 1200 Explorer.EXE 33 PID 1200 wrote to memory of 2264 1200 Explorer.EXE 33 PID 1200 wrote to memory of 2264 1200 Explorer.EXE 33 PID 1200 wrote to memory of 2264 1200 Explorer.EXE 33 PID 2264 wrote to memory of 2860 2264 chkdsk.exe 34 PID 2264 wrote to memory of 2860 2264 chkdsk.exe 34 PID 2264 wrote to memory of 2860 2264 chkdsk.exe 34 PID 2264 wrote to memory of 2860 2264 chkdsk.exe 34
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\Factura_855.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Factura_855.pdf.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\qfmjhb.exeC:\Users\Admin\AppData\Local\Temp\qfmjhb.exe C:\Users\Admin\AppData\Local\Temp\yqmxitinks3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\qfmjhb.exeC:\Users\Admin\AppData\Local\Temp\qfmjhb.exe C:\Users\Admin\AppData\Local\Temp\yqmxitinks4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\qfmjhb.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2860
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
MD5d55278f3c9ddd6df247d043d0f4d334e
SHA12aa2b417aa8897935f5cc77ab8a7617ef8d75861
SHA256d9f4d5de73452115d9acdccda02398bc5c5a2b4b99d6dc5d8feea4584856cf53
SHA5121bf4175795d93a4d0c6dc7a7acefb15204558087d9f918ddb3de2caaf2d67fd63785bee2f7a6f3aafa025f7ccafeb4043403dc18728633fd1abab27b6820e732
-
Filesize
5KB
MD57c7487f9e5f0a2b42c974896825d06e5
SHA1d29382ebaae67bf9de891ad00adb795963ef8967
SHA256dd31e7b319d3acfe238866035e0dfe514fc55efe7343e1e13421dd32d20b8f80
SHA512913039ce08f36b0664657bcf70b77238656810e96154f890f42daeff7b60cc304751a457b98cf2adacbe701eee27e358487a7be6c4d723c7e39d51bc43fdae9f
-
Filesize
5KB
MD5d93c0902c13f3f17012c2778fd24b009
SHA17ad3d53210ce587d2195545115c9086457a14623
SHA2560487ed5d2a046ee552e410b5c9b3cf27eb0c3b369fecff3132c58e57eb1c0ad8
SHA5124cb2d5beb7ed5532819bd96c92000c9e12f145d37cdd2ad4dec3f67ce74107c4a00fb850700015168ef6c2620277c237de3a2c279a99150ed46a3d0b5905fc3a