Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
06-05-2021 07:19
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7v20210410
General
-
Target
Quotation.exe
-
Size
955KB
-
MD5
9246a29da060479960879de3db2f1374
-
SHA1
fecbed5c0e6cce40444994c85caf7cb838b35df7
-
SHA256
49a4412c27e5eafc4c4365a2b2aeb962d6bf25849ab58d4e7eeb25fcfb934dcd
-
SHA512
d463a62e867e1b64e1a0fa22583840f6198b8af9e7cafbf6608da726fb94d66184c5abf172c150513a48ea09711633847e429b50bd3d0df09f5168799c640d7f
Malware Config
Extracted
formbook
4.1
http://www.bluesmartsockets.com/mgl/
credittipswebinar.com
pewpewlab.com
teamcreativconsultanting.com
bsf.xyz
youthwork.support
fmoues.com
ourcardoctor.com
wwwmoticarshub.net
bellevuedogroomer.com
vorazshop.com
sorteo.gratis
shalinihome.xyz
myschoolmgt.net
we73theunityprojectband.com
xn--n8jx07hkhe20b9k751g.com
gregrunnebaum.com
asnomayritys.com
iremgulmez.com
the1099guy.com
reviewscandy.net
reliableservicing.net
flowerscarpet.com
farmacyaustralia.com
chaytel.com
tslcreativearts.com
leather-metal.com
nella2matteo.com
amazingcoffee.club
rideonrenlo.com
pgmbin.com
handymanfromusa.com
medicalproductanimator.com
slmgtq.com
leamuratingles.com
funservicesfl.com
hyundaipartsdealsucks.com
edsportin.com
squeaser.com
freshdogsfood.com
myladylavish.com
redsofa.info
a5cdags-b.com
wrkan.com
globalindocctv.com
teacherdooley.com
chenzhixue.com
rupyamall.com
511hao.com
doncoolgadget.com
patientconnectmd.com
genupath.com
addarmy.com
ethanandmaddie2020.com
growthmediampn.com
thesocialgreen.com
mannersflaps.store
younisvisa.com
84483667.com
ironcountryllc.com
organbuy.com
superbmanshop.com
ultimatewellnesspro.com
iishon07.com
radkidsco.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/432-65-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/432-66-0x000000000041EB20-mapping.dmp formbook behavioral1/memory/556-74-0x0000000000070000-0x000000000009E000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 436 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Quotation.exeQuotation.exewscript.exedescription pid process target process PID 1688 set thread context of 432 1688 Quotation.exe Quotation.exe PID 432 set thread context of 1208 432 Quotation.exe Explorer.EXE PID 556 set thread context of 1208 556 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
Quotation.exeQuotation.exewscript.exepid process 1688 Quotation.exe 1688 Quotation.exe 1688 Quotation.exe 1688 Quotation.exe 1688 Quotation.exe 432 Quotation.exe 432 Quotation.exe 556 wscript.exe 556 wscript.exe 556 wscript.exe 556 wscript.exe 556 wscript.exe 556 wscript.exe 556 wscript.exe 556 wscript.exe 556 wscript.exe 556 wscript.exe 556 wscript.exe 556 wscript.exe 556 wscript.exe 556 wscript.exe 556 wscript.exe 556 wscript.exe 556 wscript.exe 556 wscript.exe 556 wscript.exe 556 wscript.exe 556 wscript.exe 556 wscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Quotation.exewscript.exepid process 432 Quotation.exe 432 Quotation.exe 432 Quotation.exe 556 wscript.exe 556 wscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Quotation.exeQuotation.exewscript.exedescription pid process Token: SeDebugPrivilege 1688 Quotation.exe Token: SeDebugPrivilege 432 Quotation.exe Token: SeDebugPrivilege 556 wscript.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
Quotation.exeExplorer.EXEwscript.exedescription pid process target process PID 1688 wrote to memory of 1632 1688 Quotation.exe Quotation.exe PID 1688 wrote to memory of 1632 1688 Quotation.exe Quotation.exe PID 1688 wrote to memory of 1632 1688 Quotation.exe Quotation.exe PID 1688 wrote to memory of 1632 1688 Quotation.exe Quotation.exe PID 1688 wrote to memory of 432 1688 Quotation.exe Quotation.exe PID 1688 wrote to memory of 432 1688 Quotation.exe Quotation.exe PID 1688 wrote to memory of 432 1688 Quotation.exe Quotation.exe PID 1688 wrote to memory of 432 1688 Quotation.exe Quotation.exe PID 1688 wrote to memory of 432 1688 Quotation.exe Quotation.exe PID 1688 wrote to memory of 432 1688 Quotation.exe Quotation.exe PID 1688 wrote to memory of 432 1688 Quotation.exe Quotation.exe PID 1208 wrote to memory of 556 1208 Explorer.EXE wscript.exe PID 1208 wrote to memory of 556 1208 Explorer.EXE wscript.exe PID 1208 wrote to memory of 556 1208 Explorer.EXE wscript.exe PID 1208 wrote to memory of 556 1208 Explorer.EXE wscript.exe PID 556 wrote to memory of 436 556 wscript.exe cmd.exe PID 556 wrote to memory of 436 556 wscript.exe cmd.exe PID 556 wrote to memory of 436 556 wscript.exe cmd.exe PID 556 wrote to memory of 436 556 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/432-65-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/432-69-0x0000000000340000-0x0000000000354000-memory.dmpFilesize
80KB
-
memory/432-68-0x00000000008A0000-0x0000000000BA3000-memory.dmpFilesize
3.0MB
-
memory/432-66-0x000000000041EB20-mapping.dmp
-
memory/436-72-0x0000000000000000-mapping.dmp
-
memory/556-74-0x0000000000070000-0x000000000009E000-memory.dmpFilesize
184KB
-
memory/556-71-0x0000000000000000-mapping.dmp
-
memory/556-75-0x0000000002040000-0x0000000002343000-memory.dmpFilesize
3.0MB
-
memory/556-73-0x0000000000A80000-0x0000000000AA6000-memory.dmpFilesize
152KB
-
memory/556-76-0x00000000003A0000-0x0000000000433000-memory.dmpFilesize
588KB
-
memory/1208-70-0x0000000004CC0000-0x0000000004E13000-memory.dmpFilesize
1.3MB
-
memory/1208-77-0x0000000004F00000-0x0000000004FB4000-memory.dmpFilesize
720KB
-
memory/1688-64-0x0000000000990000-0x00000000009DA000-memory.dmpFilesize
296KB
-
memory/1688-63-0x00000000051E0000-0x0000000005278000-memory.dmpFilesize
608KB
-
memory/1688-62-0x00000000004F0000-0x00000000004FE000-memory.dmpFilesize
56KB
-
memory/1688-61-0x0000000004C80000-0x0000000004C81000-memory.dmpFilesize
4KB
-
memory/1688-59-0x0000000000EB0000-0x0000000000EB1000-memory.dmpFilesize
4KB