Analysis
- max time kernel
149s - max time network
145s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:08
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION_#5.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target QUOTATION_#5.exe
- Size 376KB
- Sample201109-clb3msj8zx
- SHA256 e2e86de59b03cd68c6795d391938d75dac7fa0fe0d5bf497a075402686eba01d
- MD5 03db6a5b5fcddd3568895d9212b1c69c
- SHA1 7b3686f122ff9852988bec23b9370e02105f1901
- SHA512 21b7a53e0bad643033a4026ac6108205da8ad03f90b34c6083b94c0984a091ea878a42abf5fc9ec4bf7472cb0415fa4154a359e173ec4762237ea0576ed5584b
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.govaj.com/bd2/
Decoy
-
coffeeflyer.com
-
joy-cars.com
-
excp0st.com
-
pancakesandprotein.com
-
teenboys.info
-
theperfectgiftshop.net
-
maomao2017.com
-
musiclabtacoma.com
-
taskrit.com
-
pthjxx.com
-
114man.com
-
worldsjsj.com
-
rjpmuztrygwn.online
-
casinotoponlineplay.technology
-
tm88z.com
-
navnoorkang.com
-
lazydogkennels.net
-
yisilv.com
-
usasubels.com
-
desperatehouse-lives.com
-
brianbertini.info
-
sag4bd.com
-
zahnarzt-rosenheim.info
-
newspies.com
-
thefinalexpensegroup.com
-
wwwjinsha784.com
-
128hao.com
-
abesdjc.com
-
majportfolio.com
-
travelfoodmustafa.com
-
indo-mart.com
-
funlick.net
-
howstevedidthat.com
-
katspropertymanagement.com
-
hzsonata.com
-
believers.expert
-
littleapple-vo.com
-
jmdyljuf.win
-
exerzonegymgt.com
-
huichengsl.com
-
keithdeanjr.com
-
ybntest699.com
-
allmandbros.com
-
maftfw.com
-
online-attestation.com
-
fmbzzpx.download
-
staramway.com
-
mugzshideout.net
-
12usy.com
-
immuno-naturo.com
-
tractoferguson.com
-
rjconstrucoesse.com
-
johnscharrett.business
-
1517toparis.movie
-
redpingwinful.net
-
o31y7g.download
-
greenwebapps.com
-
6pinbahis.com
-
shouyou168.com
-
globalvalueshopping.com
-
lfhyblm.com
-
maisbrasilpublicidade.com
-
alixzwane.com
-
pubwild.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/3484-3-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/3484-4-0x000000000041B660-mapping.dmp formbook behavioral2/memory/3740-5-0x0000000000000000-mapping.dmp formbook - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run mstsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WZ7H0VOXNNX = "C:\\Program Files (x86)\\Avjfdkt\\mshzp4an.exe" mstsc.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3980 set thread context of 3484 3980 QUOTATION_#5.exe 77 PID 3484 set thread context of 2092 3484 QUOTATION_#5.exe 57 PID 3740 set thread context of 2092 3740 mstsc.exe 57 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Avjfdkt\mshzp4an.exe mstsc.exe -
description ioc Process Key created \Registry\User\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 mstsc.exe - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3980 QUOTATION_#5.exe 3980 QUOTATION_#5.exe 3484 QUOTATION_#5.exe 3484 QUOTATION_#5.exe 3484 QUOTATION_#5.exe 3484 QUOTATION_#5.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe 3740 mstsc.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3484 QUOTATION_#5.exe 3484 QUOTATION_#5.exe 3484 QUOTATION_#5.exe 3740 mstsc.exe 3740 mstsc.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 3980 QUOTATION_#5.exe Token: SeDebugPrivilege 3484 QUOTATION_#5.exe Token: SeDebugPrivilege 3740 mstsc.exe Token: SeShutdownPrivilege 2092 Explorer.EXE Token: SeCreatePagefilePrivilege 2092 Explorer.EXE Token: SeShutdownPrivilege 2092 Explorer.EXE Token: SeCreatePagefilePrivilege 2092 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2092 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3980 wrote to memory of 2816 3980 QUOTATION_#5.exe 76 PID 3980 wrote to memory of 2816 3980 QUOTATION_#5.exe 76 PID 3980 wrote to memory of 2816 3980 QUOTATION_#5.exe 76 PID 3980 wrote to memory of 3484 3980 QUOTATION_#5.exe 77 PID 3980 wrote to memory of 3484 3980 QUOTATION_#5.exe 77 PID 3980 wrote to memory of 3484 3980 QUOTATION_#5.exe 77 PID 3980 wrote to memory of 3484 3980 QUOTATION_#5.exe 77 PID 3980 wrote to memory of 3484 3980 QUOTATION_#5.exe 77 PID 3980 wrote to memory of 3484 3980 QUOTATION_#5.exe 77 PID 2092 wrote to memory of 3740 2092 Explorer.EXE 78 PID 2092 wrote to memory of 3740 2092 Explorer.EXE 78 PID 2092 wrote to memory of 3740 2092 Explorer.EXE 78 PID 3740 wrote to memory of 2500 3740 mstsc.exe 82 PID 3740 wrote to memory of 2500 3740 mstsc.exe 82 PID 3740 wrote to memory of 2500 3740 mstsc.exe 82
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\QUOTATION_#5.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION_#5.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\QUOTATION_#5.exe"{path}"3⤵PID:2816
-
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION_#5.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3484
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\QUOTATION_#5.exe"3⤵PID:2500
-
-