Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
06-05-2021 07:19
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7v20210410
General
-
Target
Quotation.exe
-
Size
955KB
-
MD5
9246a29da060479960879de3db2f1374
-
SHA1
fecbed5c0e6cce40444994c85caf7cb838b35df7
-
SHA256
49a4412c27e5eafc4c4365a2b2aeb962d6bf25849ab58d4e7eeb25fcfb934dcd
-
SHA512
d463a62e867e1b64e1a0fa22583840f6198b8af9e7cafbf6608da726fb94d66184c5abf172c150513a48ea09711633847e429b50bd3d0df09f5168799c640d7f
Malware Config
Extracted
formbook
4.1
http://www.bluesmartsockets.com/mgl/
credittipswebinar.com
pewpewlab.com
teamcreativconsultanting.com
bsf.xyz
youthwork.support
fmoues.com
ourcardoctor.com
wwwmoticarshub.net
bellevuedogroomer.com
vorazshop.com
sorteo.gratis
shalinihome.xyz
myschoolmgt.net
we73theunityprojectband.com
xn--n8jx07hkhe20b9k751g.com
gregrunnebaum.com
asnomayritys.com
iremgulmez.com
the1099guy.com
reviewscandy.net
reliableservicing.net
flowerscarpet.com
farmacyaustralia.com
chaytel.com
tslcreativearts.com
leather-metal.com
nella2matteo.com
amazingcoffee.club
rideonrenlo.com
pgmbin.com
handymanfromusa.com
medicalproductanimator.com
slmgtq.com
leamuratingles.com
funservicesfl.com
hyundaipartsdealsucks.com
edsportin.com
squeaser.com
freshdogsfood.com
myladylavish.com
redsofa.info
a5cdags-b.com
wrkan.com
globalindocctv.com
teacherdooley.com
chenzhixue.com
rupyamall.com
511hao.com
doncoolgadget.com
patientconnectmd.com
genupath.com
addarmy.com
ethanandmaddie2020.com
growthmediampn.com
thesocialgreen.com
mannersflaps.store
younisvisa.com
84483667.com
ironcountryllc.com
organbuy.com
superbmanshop.com
ultimatewellnesspro.com
iishon07.com
radkidsco.com
Signatures
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2124-124-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2124-125-0x000000000041EB20-mapping.dmp formbook behavioral2/memory/2124-128-0x0000000001100000-0x00000000011AE000-memory.dmp formbook behavioral2/memory/3828-133-0x0000000002D60000-0x0000000002D8E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Quotation.exeQuotation.exesvchost.exedescription pid process target process PID 3380 set thread context of 2124 3380 Quotation.exe Quotation.exe PID 2124 set thread context of 388 2124 Quotation.exe Explorer.EXE PID 3828 set thread context of 388 3828 svchost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 51 IoCs
Processes:
Quotation.exeQuotation.exesvchost.exepid process 3380 Quotation.exe 3380 Quotation.exe 3380 Quotation.exe 2124 Quotation.exe 2124 Quotation.exe 2124 Quotation.exe 2124 Quotation.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe 3828 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 388 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Quotation.exesvchost.exepid process 2124 Quotation.exe 2124 Quotation.exe 2124 Quotation.exe 3828 svchost.exe 3828 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Quotation.exeQuotation.exesvchost.exedescription pid process Token: SeDebugPrivilege 3380 Quotation.exe Token: SeDebugPrivilege 2124 Quotation.exe Token: SeDebugPrivilege 3828 svchost.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 388 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Quotation.exeExplorer.EXEsvchost.exedescription pid process target process PID 3380 wrote to memory of 2124 3380 Quotation.exe Quotation.exe PID 3380 wrote to memory of 2124 3380 Quotation.exe Quotation.exe PID 3380 wrote to memory of 2124 3380 Quotation.exe Quotation.exe PID 3380 wrote to memory of 2124 3380 Quotation.exe Quotation.exe PID 3380 wrote to memory of 2124 3380 Quotation.exe Quotation.exe PID 3380 wrote to memory of 2124 3380 Quotation.exe Quotation.exe PID 388 wrote to memory of 3828 388 Explorer.EXE svchost.exe PID 388 wrote to memory of 3828 388 Explorer.EXE svchost.exe PID 388 wrote to memory of 3828 388 Explorer.EXE svchost.exe PID 3828 wrote to memory of 780 3828 svchost.exe cmd.exe PID 3828 wrote to memory of 780 3828 svchost.exe cmd.exe PID 3828 wrote to memory of 780 3828 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/388-129-0x00000000058B0000-0x00000000059B3000-memory.dmpFilesize
1.0MB
-
memory/388-136-0x0000000005FE0000-0x0000000006139000-memory.dmpFilesize
1.3MB
-
memory/780-131-0x0000000000000000-mapping.dmp
-
memory/2124-125-0x000000000041EB20-mapping.dmp
-
memory/2124-124-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2124-128-0x0000000001100000-0x00000000011AE000-memory.dmpFilesize
696KB
-
memory/2124-127-0x0000000001700000-0x0000000001A20000-memory.dmpFilesize
3.1MB
-
memory/3380-123-0x00000000056D0000-0x000000000571A000-memory.dmpFilesize
296KB
-
memory/3380-116-0x0000000007A40000-0x0000000007A41000-memory.dmpFilesize
4KB
-
memory/3380-122-0x0000000005030000-0x00000000050C8000-memory.dmpFilesize
608KB
-
memory/3380-114-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/3380-121-0x0000000004790000-0x000000000479E000-memory.dmpFilesize
56KB
-
memory/3380-120-0x00000000090E0000-0x00000000090E1000-memory.dmpFilesize
4KB
-
memory/3380-118-0x0000000007330000-0x0000000007331000-memory.dmpFilesize
4KB
-
memory/3380-119-0x0000000007570000-0x0000000007571000-memory.dmpFilesize
4KB
-
memory/3380-117-0x00000000075E0000-0x00000000075E1000-memory.dmpFilesize
4KB
-
memory/3828-130-0x0000000000000000-mapping.dmp
-
memory/3828-134-0x0000000003000000-0x000000000314A000-memory.dmpFilesize
1.3MB
-
memory/3828-133-0x0000000002D60000-0x0000000002D8E000-memory.dmpFilesize
184KB
-
memory/3828-135-0x0000000003480000-0x0000000003513000-memory.dmpFilesize
588KB
-
memory/3828-132-0x0000000000070000-0x000000000007C000-memory.dmpFilesize
48KB