Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
26-02-2021 06:53
Static task
static1
Behavioral task
behavioral1
Sample
Request for Quotation.exe
Resource
win7v20201028
General
-
Target
Request for Quotation.exe
-
Size
500KB
-
MD5
1d9fd84bc6eaa80b160bd313750f6ff5
-
SHA1
011e1975d6cb6a567ad3fed83d59310728bd9227
-
SHA256
1df6109d033a42d97b34133e69afc0da679586b85b6614b034ebfd9343062d20
-
SHA512
d66d0a83284f6f21e711c3d62bcd280042d6a50125dc410b4c79d6f6dba7be5b6bd628fb21e6491b2bb291770f6d1c3951257e948dcbbb587e397fc75296a8da
Malware Config
Extracted
formbook
http://www.fptableau.com/u3q/
wingenomics.com
malwaredeepdive.com
uvdxkup.icu
safeweb-url624.com
lighthousetan.com
liumeilin.com
thaiexpressnyc.com
primedperspective.com
georgekwalker.com
purelife-gt.com
theboseproject.com
moralalaska.icu
anthonysoflittleitaly.com
talahadavi.com
waterbrooksacademy.com
aluneaproaieauayauwpalaua.com
mytshirtforlife.com
penerbitlayung.com
chainslugs.com
bhbgsc.com
blessux.com
jacqueselegantbling.jewelry
nautradio.com
taolife365.com
dreamteammortage.com
starboardvalueac.com
konstantiuk.com
plataformamultireweb-1bn.xyz
prime-deliveries19.com
articulationcrew.com
xdtee.com
collegeadmissions.xyz
diabetesdirective.com
rgyabogadas.com
getxpro.com
hydrogrowlife.com
confirmacionesrfea.com
caleighsmacarons.com
swiftnearby.com
timliadiwasi.com
odonyenicoleboutique.com
mydomainaccounts.com
dietanutricional.com
agilecoaching30.com
carbeloy.com
coinflip259.com
jsinekovo.com
carazone.com
huaweilabs.com
bestsonomahomesearch.com
myproductteam.com
amct-tony.com
thecleanstones.com
gunrangesonline.com
njywy.com
aboutourwellness.com
futebolpleyhd.com
devotedfootwear.com
parkpatent.com
pqlon.com
commercialinsuranceclaims.guru
conjureandcharm.com
greenracksolar.com
gwtguardwell.com
Signatures
-
Beds Protector Packer 1 IoCs
Detects Beds Protector packer used to load .NET malware.
Processes:
resource yara_rule behavioral2/memory/576-6-0x0000000002920000-0x000000000297E000-memory.dmp beds_protector -
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3608-11-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3608-12-0x000000000041EB70-mapping.dmp formbook behavioral2/memory/4088-19-0x0000000002F30000-0x0000000002F5E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Request for Quotation.exeRequest for Quotation.execmmon32.exedescription pid process target process PID 576 set thread context of 3608 576 Request for Quotation.exe Request for Quotation.exe PID 3608 set thread context of 3032 3608 Request for Quotation.exe Explorer.EXE PID 4088 set thread context of 3032 4088 cmmon32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
Request for Quotation.exeRequest for Quotation.execmmon32.exepid process 576 Request for Quotation.exe 576 Request for Quotation.exe 3608 Request for Quotation.exe 3608 Request for Quotation.exe 3608 Request for Quotation.exe 3608 Request for Quotation.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe 4088 cmmon32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Request for Quotation.execmmon32.exepid process 3608 Request for Quotation.exe 3608 Request for Quotation.exe 3608 Request for Quotation.exe 4088 cmmon32.exe 4088 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
Request for Quotation.exeRequest for Quotation.execmmon32.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 576 Request for Quotation.exe Token: SeDebugPrivilege 3608 Request for Quotation.exe Token: SeDebugPrivilege 4088 cmmon32.exe Token: SeShutdownPrivilege 3032 Explorer.EXE Token: SeCreatePagefilePrivilege 3032 Explorer.EXE Token: SeShutdownPrivilege 3032 Explorer.EXE Token: SeCreatePagefilePrivilege 3032 Explorer.EXE Token: SeShutdownPrivilege 3032 Explorer.EXE Token: SeCreatePagefilePrivilege 3032 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Request for Quotation.exeExplorer.EXEcmmon32.exedescription pid process target process PID 576 wrote to memory of 2268 576 Request for Quotation.exe Request for Quotation.exe PID 576 wrote to memory of 2268 576 Request for Quotation.exe Request for Quotation.exe PID 576 wrote to memory of 2268 576 Request for Quotation.exe Request for Quotation.exe PID 576 wrote to memory of 3608 576 Request for Quotation.exe Request for Quotation.exe PID 576 wrote to memory of 3608 576 Request for Quotation.exe Request for Quotation.exe PID 576 wrote to memory of 3608 576 Request for Quotation.exe Request for Quotation.exe PID 576 wrote to memory of 3608 576 Request for Quotation.exe Request for Quotation.exe PID 576 wrote to memory of 3608 576 Request for Quotation.exe Request for Quotation.exe PID 576 wrote to memory of 3608 576 Request for Quotation.exe Request for Quotation.exe PID 3032 wrote to memory of 4088 3032 Explorer.EXE cmmon32.exe PID 3032 wrote to memory of 4088 3032 Explorer.EXE cmmon32.exe PID 3032 wrote to memory of 4088 3032 Explorer.EXE cmmon32.exe PID 4088 wrote to memory of 932 4088 cmmon32.exe cmd.exe PID 4088 wrote to memory of 932 4088 cmmon32.exe cmd.exe PID 4088 wrote to memory of 932 4088 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"3⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3608 -
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"3⤵PID:932
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/576-3-0x00000000004D0000-0x00000000004D1000-memory.dmpFilesize
4KB
-
memory/576-5-0x0000000004F90000-0x0000000004F91000-memory.dmpFilesize
4KB
-
memory/576-6-0x0000000002920000-0x000000000297E000-memory.dmpFilesize
376KB
-
memory/576-7-0x0000000004E80000-0x0000000004E81000-memory.dmpFilesize
4KB
-
memory/576-8-0x00000000054A0000-0x00000000054A1000-memory.dmpFilesize
4KB
-
memory/576-9-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/576-10-0x0000000004E10000-0x0000000004E1F000-memory.dmpFilesize
60KB
-
memory/576-2-0x0000000073560000-0x0000000073C4E000-memory.dmpFilesize
6.9MB
-
memory/932-20-0x0000000000000000-mapping.dmp
-
memory/3032-16-0x0000000005050000-0x00000000051C4000-memory.dmpFilesize
1.5MB
-
memory/3032-23-0x0000000002A00000-0x0000000002A99000-memory.dmpFilesize
612KB
-
memory/3608-14-0x0000000001A30000-0x0000000001D50000-memory.dmpFilesize
3.1MB
-
memory/3608-15-0x00000000019F0000-0x0000000001A04000-memory.dmpFilesize
80KB
-
memory/3608-12-0x000000000041EB70-mapping.dmp
-
memory/3608-11-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/4088-17-0x0000000000000000-mapping.dmp
-
memory/4088-19-0x0000000002F30000-0x0000000002F5E000-memory.dmpFilesize
184KB
-
memory/4088-18-0x0000000000E30000-0x0000000000E3C000-memory.dmpFilesize
48KB
-
memory/4088-21-0x0000000004FA0000-0x00000000052C0000-memory.dmpFilesize
3.1MB
-
memory/4088-22-0x0000000004EA0000-0x0000000004F33000-memory.dmpFilesize
588KB