Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-07-2021 06:47
Static task
static1
Behavioral task
behavioral1
Sample
RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe
Resource
win7v20210410
General
-
Target
RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe
-
Size
1.1MB
-
MD5
32a7f5eccb743dc2645f642cf109690a
-
SHA1
d73a4e4f6b5560cd1f21978a40265d480ef24259
-
SHA256
4cb3b507b091eafd3faf47a7ebb23e597d92b1cd4ad1655f6a0a9330768a60e5
-
SHA512
f590c392efe24e998aa5604bc8e03de3aafd69173e5b378612b561311c5c38620c0895811aff71320f98cc543cfe6d8643e67920822838b4fabed2c9b404f546
Malware Config
Extracted
formbook
4.1
http://www.sunderstudios.com/blo/
introducingsadieann.com
batterrydaddy.com
restaurantechoytac.digital
toriox.tech
cursosonline.pro
onegreenmother.com
canyonpark-home.com
charleserick9.com
coldavis-81720-1634.com
deliandgyros.com
darrenjmajor.com
chekax.com
twinsepower.com
welinkautollc.com
kimlmontgomery.com
ligature.net
bllbirdcrk.com
happilyeverfi.com
hahdigitalmarketinghelp.com
onecomcall.com
createanewyoucoaching.com
nocoky.com
saibamaisweboficial.com
ashtondrakr.com
fronteracater.com
outridermtb.com
wahinehealth.net
viksfitflow.com
redakgroup.com
tpabgd.com
chtc100.com
homeedgestore.com
proxyshops.com
nasakefashions.com
adindia.online
ryanleek.com
thecantonmentcookhouse.com
staszic.xyz
hondaandacuracollision.com
flzyzh.com
lakewoodluxury.com
lisetteperez.media
ronandmarie.com
karlhagan.com
peterrobinson.online
swfjobs.net
stylediaryavenue.com
gallayo.com
mon-test-qi.com
dominandoseuinstrumento.com
translationserviceguide.com
studiosettanta.com
view-millc.com
tadzkirah.com
virtual3devents.com
babehou.com
bbwsboutique.com
resurrectiondesignco.net
kitsmake.com
curiousparty.com
yugen-us.menu
melaninmagicthings.com
nudemburadatatlim.com
browntravelingnotary.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/812-125-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/812-126-0x000000000041EB40-mapping.dmp formbook behavioral2/memory/396-133-0x0000000003210000-0x000000000323E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exeRFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exeraserver.exedescription pid process target process PID 4796 set thread context of 812 4796 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe PID 812 set thread context of 2900 812 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe Explorer.EXE PID 396 set thread context of 2900 396 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exeraserver.exepid process 812 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe 812 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe 812 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe 812 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe 396 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2900 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exeraserver.exepid process 812 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe 812 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe 812 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe 396 raserver.exe 396 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exeraserver.exedescription pid process Token: SeDebugPrivilege 812 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe Token: SeDebugPrivilege 396 raserver.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exeExplorer.EXEraserver.exedescription pid process target process PID 4796 wrote to memory of 812 4796 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe PID 4796 wrote to memory of 812 4796 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe PID 4796 wrote to memory of 812 4796 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe PID 4796 wrote to memory of 812 4796 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe PID 4796 wrote to memory of 812 4796 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe PID 4796 wrote to memory of 812 4796 RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe PID 2900 wrote to memory of 396 2900 Explorer.EXE raserver.exe PID 2900 wrote to memory of 396 2900 Explorer.EXE raserver.exe PID 2900 wrote to memory of 396 2900 Explorer.EXE raserver.exe PID 396 wrote to memory of 1056 396 raserver.exe cmd.exe PID 396 wrote to memory of 1056 396 raserver.exe cmd.exe PID 396 wrote to memory of 1056 396 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe"C:\Users\Admin\AppData\Local\Temp\RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe"C:\Users\Admin\AppData\Local\Temp\RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ-BHI-PP-IN-301 PROJECT MaterialsEquipements Request for Quotation_HMD PJT.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/396-130-0x0000000000000000-mapping.dmp
-
memory/396-135-0x0000000004D30000-0x0000000004DC3000-memory.dmpFilesize
588KB
-
memory/396-134-0x0000000004EA0000-0x00000000051C0000-memory.dmpFilesize
3.1MB
-
memory/396-132-0x0000000000A20000-0x0000000000A3F000-memory.dmpFilesize
124KB
-
memory/396-133-0x0000000003210000-0x000000000323E000-memory.dmpFilesize
184KB
-
memory/812-125-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/812-127-0x0000000001AF0000-0x0000000001E10000-memory.dmpFilesize
3.1MB
-
memory/812-128-0x0000000001580000-0x00000000016CA000-memory.dmpFilesize
1.3MB
-
memory/812-126-0x000000000041EB40-mapping.dmp
-
memory/1056-131-0x0000000000000000-mapping.dmp
-
memory/2900-136-0x0000000006890000-0x00000000069D2000-memory.dmpFilesize
1.3MB
-
memory/2900-129-0x0000000006420000-0x00000000065BC000-memory.dmpFilesize
1.6MB
-
memory/4796-114-0x0000000000F10000-0x0000000000F11000-memory.dmpFilesize
4KB
-
memory/4796-121-0x00000000062D0000-0x00000000062D1000-memory.dmpFilesize
4KB
-
memory/4796-124-0x00000000017E0000-0x000000000183C000-memory.dmpFilesize
368KB
-
memory/4796-120-0x0000000005B60000-0x0000000005B61000-memory.dmpFilesize
4KB
-
memory/4796-123-0x0000000005BC0000-0x0000000005BC4000-memory.dmpFilesize
16KB
-
memory/4796-119-0x00000000058E0000-0x00000000058E1000-memory.dmpFilesize
4KB
-
memory/4796-118-0x0000000005970000-0x0000000005971000-memory.dmpFilesize
4KB
-
memory/4796-117-0x0000000005DD0000-0x0000000005DD1000-memory.dmpFilesize
4KB
-
memory/4796-116-0x0000000005830000-0x0000000005831000-memory.dmpFilesize
4KB
-
memory/4796-122-0x00000000058D0000-0x0000000005DCE000-memory.dmpFilesize
5.0MB