Analysis
-
max time kernel
148s -
max time network
144s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
26-02-2021 08:18
Static task
static1
Behavioral task
behavioral1
Sample
Request for Quotation.exe
Resource
win7v20201028
General
-
Target
Request for Quotation.exe
-
Size
500KB
-
MD5
1d9fd84bc6eaa80b160bd313750f6ff5
-
SHA1
011e1975d6cb6a567ad3fed83d59310728bd9227
-
SHA256
1df6109d033a42d97b34133e69afc0da679586b85b6614b034ebfd9343062d20
-
SHA512
d66d0a83284f6f21e711c3d62bcd280042d6a50125dc410b4c79d6f6dba7be5b6bd628fb21e6491b2bb291770f6d1c3951257e948dcbbb587e397fc75296a8da
Malware Config
Extracted
formbook
http://www.fptableau.com/u3q/
wingenomics.com
malwaredeepdive.com
uvdxkup.icu
safeweb-url624.com
lighthousetan.com
liumeilin.com
thaiexpressnyc.com
primedperspective.com
georgekwalker.com
purelife-gt.com
theboseproject.com
moralalaska.icu
anthonysoflittleitaly.com
talahadavi.com
waterbrooksacademy.com
aluneaproaieauayauwpalaua.com
mytshirtforlife.com
penerbitlayung.com
chainslugs.com
bhbgsc.com
blessux.com
jacqueselegantbling.jewelry
nautradio.com
taolife365.com
dreamteammortage.com
starboardvalueac.com
konstantiuk.com
plataformamultireweb-1bn.xyz
prime-deliveries19.com
articulationcrew.com
xdtee.com
collegeadmissions.xyz
diabetesdirective.com
rgyabogadas.com
getxpro.com
hydrogrowlife.com
confirmacionesrfea.com
caleighsmacarons.com
swiftnearby.com
timliadiwasi.com
odonyenicoleboutique.com
mydomainaccounts.com
dietanutricional.com
agilecoaching30.com
carbeloy.com
coinflip259.com
jsinekovo.com
carazone.com
huaweilabs.com
bestsonomahomesearch.com
myproductteam.com
amct-tony.com
thecleanstones.com
gunrangesonline.com
njywy.com
aboutourwellness.com
futebolpleyhd.com
devotedfootwear.com
parkpatent.com
pqlon.com
commercialinsuranceclaims.guru
conjureandcharm.com
greenracksolar.com
gwtguardwell.com
Signatures
-
Beds Protector Packer 1 IoCs
Detects Beds Protector packer used to load .NET malware.
Processes:
resource yara_rule behavioral1/memory/2008-6-0x00000000006C0000-0x000000000071E000-memory.dmp beds_protector -
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1980-9-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1980-10-0x000000000041EB70-mapping.dmp formbook behavioral1/memory/1608-20-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1900 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Request for Quotation.exeRequest for Quotation.exewininit.exedescription pid process target process PID 2008 set thread context of 1980 2008 Request for Quotation.exe Request for Quotation.exe PID 1980 set thread context of 1248 1980 Request for Quotation.exe Explorer.EXE PID 1980 set thread context of 1248 1980 Request for Quotation.exe Explorer.EXE PID 1608 set thread context of 1248 1608 wininit.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
Request for Quotation.exewininit.exepid process 1980 Request for Quotation.exe 1980 Request for Quotation.exe 1980 Request for Quotation.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe 1608 wininit.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Request for Quotation.exewininit.exepid process 1980 Request for Quotation.exe 1980 Request for Quotation.exe 1980 Request for Quotation.exe 1980 Request for Quotation.exe 1608 wininit.exe 1608 wininit.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Request for Quotation.exewininit.exedescription pid process Token: SeDebugPrivilege 1980 Request for Quotation.exe Token: SeDebugPrivilege 1608 wininit.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Request for Quotation.exeExplorer.EXEwininit.exedescription pid process target process PID 2008 wrote to memory of 1980 2008 Request for Quotation.exe Request for Quotation.exe PID 2008 wrote to memory of 1980 2008 Request for Quotation.exe Request for Quotation.exe PID 2008 wrote to memory of 1980 2008 Request for Quotation.exe Request for Quotation.exe PID 2008 wrote to memory of 1980 2008 Request for Quotation.exe Request for Quotation.exe PID 2008 wrote to memory of 1980 2008 Request for Quotation.exe Request for Quotation.exe PID 2008 wrote to memory of 1980 2008 Request for Quotation.exe Request for Quotation.exe PID 2008 wrote to memory of 1980 2008 Request for Quotation.exe Request for Quotation.exe PID 1248 wrote to memory of 1608 1248 Explorer.EXE wininit.exe PID 1248 wrote to memory of 1608 1248 Explorer.EXE wininit.exe PID 1248 wrote to memory of 1608 1248 Explorer.EXE wininit.exe PID 1248 wrote to memory of 1608 1248 Explorer.EXE wininit.exe PID 1608 wrote to memory of 1900 1608 wininit.exe cmd.exe PID 1608 wrote to memory of 1900 1608 wininit.exe cmd.exe PID 1608 wrote to memory of 1900 1608 wininit.exe cmd.exe PID 1608 wrote to memory of 1900 1608 wininit.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1248-14-0x0000000004F30000-0x000000000509C000-memory.dmpFilesize
1.4MB
-
memory/1248-23-0x0000000007FA0000-0x0000000008133000-memory.dmpFilesize
1.6MB
-
memory/1248-16-0x0000000007220000-0x00000000073B8000-memory.dmpFilesize
1.6MB
-
memory/1608-20-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/1608-17-0x0000000000000000-mapping.dmp
-
memory/1608-22-0x0000000001D70000-0x0000000001E03000-memory.dmpFilesize
588KB
-
memory/1608-19-0x0000000000720000-0x000000000073A000-memory.dmpFilesize
104KB
-
memory/1608-21-0x0000000001E60000-0x0000000002163000-memory.dmpFilesize
3.0MB
-
memory/1900-18-0x0000000000000000-mapping.dmp
-
memory/1980-12-0x0000000000930000-0x0000000000C33000-memory.dmpFilesize
3.0MB
-
memory/1980-15-0x00000000003E0000-0x00000000003F4000-memory.dmpFilesize
80KB
-
memory/1980-13-0x0000000000170000-0x0000000000184000-memory.dmpFilesize
80KB
-
memory/1980-10-0x000000000041EB70-mapping.dmp
-
memory/1980-9-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2008-6-0x00000000006C0000-0x000000000071E000-memory.dmpFilesize
376KB
-
memory/2008-5-0x0000000076641000-0x0000000076643000-memory.dmpFilesize
8KB
-
memory/2008-7-0x00000000044D0000-0x00000000044D1000-memory.dmpFilesize
4KB
-
memory/2008-2-0x0000000074BA0000-0x000000007528E000-memory.dmpFilesize
6.9MB
-
memory/2008-8-0x0000000000500000-0x000000000050F000-memory.dmpFilesize
60KB
-
memory/2008-3-0x00000000008A0000-0x00000000008A1000-memory.dmpFilesize
4KB