Analysis
- max time kernel
147s - max time network
145s - platform
windows10_x64 - resource
win10v200722 - submitted
17/08/2020, 13:57
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION_DOC_DOCX_PDF.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target QUOTATION_DOC_DOCX_PDF.exe
- Size 96KB
- Sample200817-6pg51c2tve
- SHA256 d4be4226b685156a19f30ba35099d97c9608c08053992fc0d158b8f6b2bb7712
- MD5 e7e24dc3a53ea2ae2a518ae5d743d100
- SHA1 840b21eb96719e91e063448d53eee6334c7f656a
- SHA512 996f910dbb5cb4eabddf60e64f600aba69ef64b7dea3c0bde1b55a8c918399e8e054f238819214f69f69250008cb89d9ce9bc9266188c6468a19709fb205ed54
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.sandrxy.com/yby/
Decoy
-
coffeeidc.com
-
astrologysisters.com
-
setasleek.com
-
raisingindiatoday.com
-
oshaip.info
-
xiaoyaffawai.com
-
baguettebistro.net
-
overseasvoyages.com
-
derrilinplants.com
-
thewanderingyogi.net
-
lnjcosmetics.com
-
argosmultilingual.online
-
lolakarimova.biz
-
bendnotbroken.com
-
autocrawler.net
-
naturetourbattambang.com
-
deniztarsus.com
-
xvcbe.com
-
aladinvoyages.com
-
mltko.com
-
panwaskabpati.com
-
liuzenan.com
-
artedefiber.com
-
squadx.biz
-
directsalesdeals.com
-
theultimatechatzone.com
-
thehunmersas.com
-
pdxez.info
-
eivissa.rocks
-
professionalhookers.com
-
codeandcakes.com
-
greggindustries.com
-
anotherway.one
-
oknuav.win
-
homelessshepherd.com
-
craftykidstime.com
-
chillis-restaurant.com
-
mattressmanchester.com
-
shanhuoshop.com
-
raiderknight.com
-
greatfibc.com
-
buystellarlumens.info
-
inlonly.com
-
edgepolisher.net
-
freelelectric.info
-
aalji.com
-
aewah.com
-
1scoin.com
-
hanmisoga.com
-
klever.life
-
21dayflatbellyfixreviews.com
-
913uhj.info
-
dchomedecor.com
-
babyoflondon.com
-
zureo.online
-
ouheinfo.com
-
pzcklife.net
-
tsrvhnjs.com
-
soccerguards.com
-
empreenderaotopo.com
-
conciliacionalcala.com
-
funny-f.com
-
hasmzcy.com
-
cevizbahceden.com
Signatures
- Formbook Payload 1 IoCs
resource yara_rule behavioral2/memory/1240-10-0x0000000000000000-mapping.dmp formbook - Executes dropped EXE 1 IoCs
pid Process 2436 respondencies.exe - Loads dropped DLL 1 IoCs
pid Process 628 respondencies.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce QUOTATION_DOC_DOCX_PDF.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\HAES = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Misseated3\\respondencies.vbs" QUOTATION_DOC_DOCX_PDF.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce respondencies.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\HAES = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Misseated3\\respondencies.vbs" respondencies.exe Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BL1L0HEPMR = "C:\\Program Files (x86)\\Dwta\\khoptnlmnwp.exe" wscript.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 3908 QUOTATION_DOC_DOCX_PDF.exe 3188 QUOTATION_DOC_DOCX_PDF.exe 2436 respondencies.exe 628 respondencies.exe 628 respondencies.exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3908 set thread context of 3188 3908 QUOTATION_DOC_DOCX_PDF.exe 66 PID 2436 set thread context of 628 2436 respondencies.exe 68 PID 628 set thread context of 2984 628 respondencies.exe 56 PID 1240 set thread context of 2984 1240 wscript.exe 56 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Dwta\khoptnlmnwp.exe wscript.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1400429095-533421673-2598934218-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wscript.exe - Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 628 respondencies.exe 628 respondencies.exe 628 respondencies.exe 628 respondencies.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe - Suspicious behavior: MapViewOfSection 9 IoCs
pid Process 3908 QUOTATION_DOC_DOCX_PDF.exe 2436 respondencies.exe 628 respondencies.exe 628 respondencies.exe 628 respondencies.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe 1240 wscript.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 628 respondencies.exe Token: SeDebugPrivilege 1240 wscript.exe Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2984 Explorer.EXE - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2984 Explorer.EXE - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3908 QUOTATION_DOC_DOCX_PDF.exe 2436 respondencies.exe - Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 3908 wrote to memory of 3188 3908 QUOTATION_DOC_DOCX_PDF.exe 66 PID 3908 wrote to memory of 3188 3908 QUOTATION_DOC_DOCX_PDF.exe 66 PID 3908 wrote to memory of 3188 3908 QUOTATION_DOC_DOCX_PDF.exe 66 PID 3908 wrote to memory of 3188 3908 QUOTATION_DOC_DOCX_PDF.exe 66 PID 3188 wrote to memory of 2436 3188 QUOTATION_DOC_DOCX_PDF.exe 67 PID 3188 wrote to memory of 2436 3188 QUOTATION_DOC_DOCX_PDF.exe 67 PID 3188 wrote to memory of 2436 3188 QUOTATION_DOC_DOCX_PDF.exe 67 PID 2436 wrote to memory of 628 2436 respondencies.exe 68 PID 2436 wrote to memory of 628 2436 respondencies.exe 68 PID 2436 wrote to memory of 628 2436 respondencies.exe 68 PID 2436 wrote to memory of 628 2436 respondencies.exe 68 PID 2984 wrote to memory of 1240 2984 Explorer.EXE 69 PID 2984 wrote to memory of 1240 2984 Explorer.EXE 69 PID 2984 wrote to memory of 1240 2984 Explorer.EXE 69 PID 1240 wrote to memory of 1368 1240 wscript.exe 70 PID 1240 wrote to memory of 1368 1240 wscript.exe 70 PID 1240 wrote to memory of 1368 1240 wscript.exe 70 PID 1240 wrote to memory of 3196 1240 wscript.exe 78 PID 1240 wrote to memory of 3196 1240 wscript.exe 78 PID 1240 wrote to memory of 3196 1240 wscript.exe 78 PID 1240 wrote to memory of 3336 1240 wscript.exe 80 PID 1240 wrote to memory of 3336 1240 wscript.exe 80 PID 1240 wrote to memory of 3336 1240 wscript.exe 80
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\QUOTATION_DOC_DOCX_PDF.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION_DOC_DOCX_PDF.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\QUOTATION_DOC_DOCX_PDF.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION_DOC_DOCX_PDF.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\Misseated3\respondencies.exe"C:\Users\Admin\AppData\Local\Temp\Misseated3\respondencies.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\Misseated3\respondencies.exe"C:\Users\Admin\AppData\Local\Temp\Misseated3\respondencies.exe"5⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:628
-
-
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Misseated3\respondencies.exe"3⤵PID:1368
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3196
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3336
-
-