Analysis
-
max time kernel
147s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 11:06
Static task
static1
Behavioral task
behavioral1
Sample
PDFSLP232.exe
Resource
win7-20240611-en
General
-
Target
PDFSLP232.exe
-
Size
686KB
-
MD5
9cabc06c47b82704fd1b7f2bc179a3a8
-
SHA1
83fe695a745fe1a0f81cf1ec71cde74a9d4b424d
-
SHA256
cb1b1d99cbf6d7bb1a30ec1c7ee31c36b8e19230751046688ad1a14b2fec4758
-
SHA512
f45e4bf071298f3ad5e007db4c5ed9ffd723c50f34efa771d37a1b484bcc09fbe77a20c59dc72a40a0c96837afc12c67258ace11e04e1d397dca64fdf821d043
-
SSDEEP
12288:dl0++rKR6dSkULoqZ/b+sVUaGMUgdiSMa4Nk:dl0RrW6qtbuc4Nk
Malware Config
Extracted
formbook
4.0
3iw
cepbank-direkt.com
lieoga.com
officialbetterbeardclub.com
media0702.com
safariflorist.com
vipinternationalinc.com
bitechanalytics.com
employeewage.com
truckingtag.com
priyaladiestailor.com
highlanderpiping.com
enargiapetroleum.com
vermilionranch.com
focusopgeld.com
kalem-euy.net
disypen.com
fairpayva.com
davidguner.com
idreferensi.com
dytt889.com
schuada.com
minimalistvineyards.com
qduola.com
creditoefectivo.info
healthynaturalbirthcontrol.com
work-from-home-today.com
xn--p5t311d5zvmga.com
ex1x.com
onsitelogistics123.net
yilingshenghuo.net
cddlmixer.com
libero-networks.net
hillsidesunshine.com
whanaruabayholidaypark.com
pfog.ltd
thelifewaykefir.com
italotranslations.com
zhaojianhua.net
coralkw.com
e-learning-studios.com
technicalworld.online
raiseyourcross.com
fromwheretohere.com
ducati-world24.com
tag.loans
fast-bank.com
njssnt.com
crypto-exch.com
178416.com
glorybeegarden.com
whistleblowerchasealayne.com
hikmetamca.com
cjnexgift.com
simorghcard.com
thebestofsecrets.com
803manbetx.com
valodokan.com
sacpropertysale.com
paintwithdrink.com
ikidpass.com
setappointments.online
keymatic-eg.com
lookappdev.com
starbuckranchtx.com
regulars6.com
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2508-11-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/2508-15-0x0000000000400000-0x000000000042D000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2476 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PDFSLP232.exePDFSLP232.execontrol.exedescription pid process target process PID 3048 set thread context of 2508 3048 PDFSLP232.exe PDFSLP232.exe PID 2508 set thread context of 1252 2508 PDFSLP232.exe Explorer.EXE PID 3008 set thread context of 1252 3008 control.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
PDFSLP232.exePDFSLP232.execontrol.exepid process 3048 PDFSLP232.exe 3048 PDFSLP232.exe 3048 PDFSLP232.exe 2508 PDFSLP232.exe 2508 PDFSLP232.exe 3008 control.exe 3008 control.exe 3008 control.exe 3008 control.exe 3008 control.exe 3008 control.exe 3008 control.exe 3008 control.exe 3008 control.exe 3008 control.exe 3008 control.exe 3008 control.exe 3008 control.exe 3008 control.exe 3008 control.exe 3008 control.exe 3008 control.exe 3008 control.exe 3008 control.exe 3008 control.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PDFSLP232.execontrol.exepid process 2508 PDFSLP232.exe 2508 PDFSLP232.exe 2508 PDFSLP232.exe 3008 control.exe 3008 control.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PDFSLP232.exePDFSLP232.execontrol.exedescription pid process Token: SeDebugPrivilege 3048 PDFSLP232.exe Token: SeDebugPrivilege 2508 PDFSLP232.exe Token: SeDebugPrivilege 3008 control.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
PDFSLP232.exeExplorer.EXEcontrol.exedescription pid process target process PID 3048 wrote to memory of 2508 3048 PDFSLP232.exe PDFSLP232.exe PID 3048 wrote to memory of 2508 3048 PDFSLP232.exe PDFSLP232.exe PID 3048 wrote to memory of 2508 3048 PDFSLP232.exe PDFSLP232.exe PID 3048 wrote to memory of 2508 3048 PDFSLP232.exe PDFSLP232.exe PID 3048 wrote to memory of 2508 3048 PDFSLP232.exe PDFSLP232.exe PID 3048 wrote to memory of 2508 3048 PDFSLP232.exe PDFSLP232.exe PID 3048 wrote to memory of 2508 3048 PDFSLP232.exe PDFSLP232.exe PID 1252 wrote to memory of 3008 1252 Explorer.EXE control.exe PID 1252 wrote to memory of 3008 1252 Explorer.EXE control.exe PID 1252 wrote to memory of 3008 1252 Explorer.EXE control.exe PID 1252 wrote to memory of 3008 1252 Explorer.EXE control.exe PID 3008 wrote to memory of 2476 3008 control.exe cmd.exe PID 3008 wrote to memory of 2476 3008 control.exe cmd.exe PID 3008 wrote to memory of 2476 3008 control.exe cmd.exe PID 3008 wrote to memory of 2476 3008 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PDFSLP232.exe"C:\Users\Admin\AppData\Local\Temp\PDFSLP232.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PDFSLP232.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PDFSLP232.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1252-17-0x00000000038F0000-0x00000000039F0000-memory.dmpFilesize
1024KB
-
memory/1252-23-0x0000000004AB0000-0x0000000004BAA000-memory.dmpFilesize
1000KB
-
memory/1252-18-0x0000000004AB0000-0x0000000004BAA000-memory.dmpFilesize
1000KB
-
memory/2508-11-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2508-13-0x0000000000830000-0x0000000000B33000-memory.dmpFilesize
3.0MB
-
memory/2508-15-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2508-16-0x0000000000290000-0x00000000002A4000-memory.dmpFilesize
80KB
-
memory/2508-8-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2508-7-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2508-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/3008-19-0x0000000000620000-0x000000000063F000-memory.dmpFilesize
124KB
-
memory/3008-20-0x0000000000620000-0x000000000063F000-memory.dmpFilesize
124KB
-
memory/3048-0-0x00000000748BE000-0x00000000748BF000-memory.dmpFilesize
4KB
-
memory/3048-12-0x00000000748B0000-0x0000000074F9E000-memory.dmpFilesize
6.9MB
-
memory/3048-4-0x00000000748B0000-0x0000000074F9E000-memory.dmpFilesize
6.9MB
-
memory/3048-6-0x00000000020F0000-0x0000000002138000-memory.dmpFilesize
288KB
-
memory/3048-5-0x0000000004400000-0x0000000004460000-memory.dmpFilesize
384KB
-
memory/3048-3-0x00000000748BE000-0x00000000748BF000-memory.dmpFilesize
4KB
-
memory/3048-2-0x0000000000340000-0x0000000000352000-memory.dmpFilesize
72KB
-
memory/3048-1-0x00000000000E0000-0x0000000000190000-memory.dmpFilesize
704KB