Analysis
-
max time kernel
146s -
max time network
144s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
26-02-2021 08:18
Static task
static1
Behavioral task
behavioral1
Sample
Request for Quotation.exe
Resource
win7v20201028
General
-
Target
Request for Quotation.exe
-
Size
500KB
-
MD5
1d9fd84bc6eaa80b160bd313750f6ff5
-
SHA1
011e1975d6cb6a567ad3fed83d59310728bd9227
-
SHA256
1df6109d033a42d97b34133e69afc0da679586b85b6614b034ebfd9343062d20
-
SHA512
d66d0a83284f6f21e711c3d62bcd280042d6a50125dc410b4c79d6f6dba7be5b6bd628fb21e6491b2bb291770f6d1c3951257e948dcbbb587e397fc75296a8da
Malware Config
Extracted
formbook
http://www.fptableau.com/u3q/
wingenomics.com
malwaredeepdive.com
uvdxkup.icu
safeweb-url624.com
lighthousetan.com
liumeilin.com
thaiexpressnyc.com
primedperspective.com
georgekwalker.com
purelife-gt.com
theboseproject.com
moralalaska.icu
anthonysoflittleitaly.com
talahadavi.com
waterbrooksacademy.com
aluneaproaieauayauwpalaua.com
mytshirtforlife.com
penerbitlayung.com
chainslugs.com
bhbgsc.com
blessux.com
jacqueselegantbling.jewelry
nautradio.com
taolife365.com
dreamteammortage.com
starboardvalueac.com
konstantiuk.com
plataformamultireweb-1bn.xyz
prime-deliveries19.com
articulationcrew.com
xdtee.com
collegeadmissions.xyz
diabetesdirective.com
rgyabogadas.com
getxpro.com
hydrogrowlife.com
confirmacionesrfea.com
caleighsmacarons.com
swiftnearby.com
timliadiwasi.com
odonyenicoleboutique.com
mydomainaccounts.com
dietanutricional.com
agilecoaching30.com
carbeloy.com
coinflip259.com
jsinekovo.com
carazone.com
huaweilabs.com
bestsonomahomesearch.com
myproductteam.com
amct-tony.com
thecleanstones.com
gunrangesonline.com
njywy.com
aboutourwellness.com
futebolpleyhd.com
devotedfootwear.com
parkpatent.com
pqlon.com
commercialinsuranceclaims.guru
conjureandcharm.com
greenracksolar.com
gwtguardwell.com
Signatures
-
Beds Protector Packer 1 IoCs
Detects Beds Protector packer used to load .NET malware.
Processes:
resource yara_rule behavioral2/memory/4644-5-0x00000000051D0000-0x000000000522E000-memory.dmp beds_protector -
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4200-12-0x000000000041EB70-mapping.dmp formbook behavioral2/memory/4200-11-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3388-21-0x0000000002ED0000-0x0000000002EFE000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Request for Quotation.exeRequest for Quotation.execolorcpl.exedescription pid process target process PID 4644 set thread context of 4200 4644 Request for Quotation.exe Request for Quotation.exe PID 4200 set thread context of 3108 4200 Request for Quotation.exe Explorer.EXE PID 4200 set thread context of 3108 4200 Request for Quotation.exe Explorer.EXE PID 3388 set thread context of 3108 3388 colorcpl.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
Request for Quotation.execolorcpl.exepid process 4200 Request for Quotation.exe 4200 Request for Quotation.exe 4200 Request for Quotation.exe 4200 Request for Quotation.exe 4200 Request for Quotation.exe 4200 Request for Quotation.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe 3388 colorcpl.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Request for Quotation.execolorcpl.exepid process 4200 Request for Quotation.exe 4200 Request for Quotation.exe 4200 Request for Quotation.exe 4200 Request for Quotation.exe 3388 colorcpl.exe 3388 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
Request for Quotation.execolorcpl.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4200 Request for Quotation.exe Token: SeDebugPrivilege 3388 colorcpl.exe Token: SeShutdownPrivilege 3108 Explorer.EXE Token: SeCreatePagefilePrivilege 3108 Explorer.EXE Token: SeShutdownPrivilege 3108 Explorer.EXE Token: SeCreatePagefilePrivilege 3108 Explorer.EXE Token: SeShutdownPrivilege 3108 Explorer.EXE Token: SeCreatePagefilePrivilege 3108 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3108 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Request for Quotation.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 4644 wrote to memory of 4200 4644 Request for Quotation.exe Request for Quotation.exe PID 4644 wrote to memory of 4200 4644 Request for Quotation.exe Request for Quotation.exe PID 4644 wrote to memory of 4200 4644 Request for Quotation.exe Request for Quotation.exe PID 4644 wrote to memory of 4200 4644 Request for Quotation.exe Request for Quotation.exe PID 4644 wrote to memory of 4200 4644 Request for Quotation.exe Request for Quotation.exe PID 4644 wrote to memory of 4200 4644 Request for Quotation.exe Request for Quotation.exe PID 3108 wrote to memory of 3388 3108 Explorer.EXE colorcpl.exe PID 3108 wrote to memory of 3388 3108 Explorer.EXE colorcpl.exe PID 3108 wrote to memory of 3388 3108 Explorer.EXE colorcpl.exe PID 3388 wrote to memory of 3532 3388 colorcpl.exe cmd.exe PID 3388 wrote to memory of 3532 3388 colorcpl.exe cmd.exe PID 3388 wrote to memory of 3532 3388 colorcpl.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3108-16-0x00000000058D0000-0x00000000059BA000-memory.dmpFilesize
936KB
-
memory/3108-25-0x0000000005AB0000-0x0000000005BAD000-memory.dmpFilesize
1012KB
-
memory/3108-18-0x00000000059C0000-0x0000000005AA9000-memory.dmpFilesize
932KB
-
memory/3388-24-0x0000000004520000-0x00000000045B3000-memory.dmpFilesize
588KB
-
memory/3388-23-0x0000000004620000-0x0000000004940000-memory.dmpFilesize
3.1MB
-
memory/3388-20-0x0000000000A90000-0x0000000000AA9000-memory.dmpFilesize
100KB
-
memory/3388-21-0x0000000002ED0000-0x0000000002EFE000-memory.dmpFilesize
184KB
-
memory/3388-19-0x0000000000000000-mapping.dmp
-
memory/3532-22-0x0000000000000000-mapping.dmp
-
memory/4200-15-0x00000000012F0000-0x0000000001304000-memory.dmpFilesize
80KB
-
memory/4200-11-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/4200-14-0x0000000000E90000-0x00000000011B0000-memory.dmpFilesize
3.1MB
-
memory/4200-12-0x000000000041EB70-mapping.dmp
-
memory/4200-17-0x0000000002BE0000-0x0000000002BF4000-memory.dmpFilesize
80KB
-
memory/4644-2-0x0000000073E30000-0x000000007451E000-memory.dmpFilesize
6.9MB
-
memory/4644-10-0x0000000005140000-0x000000000514F000-memory.dmpFilesize
60KB
-
memory/4644-9-0x00000000053F0000-0x00000000053F1000-memory.dmpFilesize
4KB
-
memory/4644-8-0x00000000052A0000-0x00000000052A1000-memory.dmpFilesize
4KB
-
memory/4644-7-0x00000000058F0000-0x00000000058F1000-memory.dmpFilesize
4KB
-
memory/4644-6-0x0000000005350000-0x0000000005351000-memory.dmpFilesize
4KB
-
memory/4644-5-0x00000000051D0000-0x000000000522E000-memory.dmpFilesize
376KB
-
memory/4644-3-0x0000000000920000-0x0000000000921000-memory.dmpFilesize
4KB