Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-07-2021 20:20
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION.exe
Resource
win7v20210408
General
-
Target
QUOTATION.exe
-
Size
739KB
-
MD5
f6b430cda92dd026e96e7d304d20db43
-
SHA1
701f788e29b0a9640e53c826cd871f3f9fdd3160
-
SHA256
e1f620a49978341460d102aefd71b13a0f3d36aaf8dfa042844984ad6dcfaa7c
-
SHA512
a7e82ac7e136a03e03665e4ed108ab14296726867413c464a25c5b9e28280721fec639c6a4825733c18934ad17e3840d72ab7a1ef36a4912b043e960c095c582
Malware Config
Extracted
formbook
4.1
http://www.jzmbgjj.com/j7e/
cefuoficial.com
luxmusicclub.com
getridofmyed.xyz
sports-plaza.com
peteropsomer.com
kemendi.com
divinciresolve.com
readtogrowup.com
hidex-corp.com
aladininternational.com
snesait.art
ezzpick.net
saveashow.com
eazyprintsplus.com
usadatesclub.com
rafaelraf.com
themiamadison.com
regarta.com
aiocitys.net
ahorn-invest.com
anajoiasrj.com
rozamail.com
mauriciosagastegui.com
cohorsetrails.com
alboxshop.com
jrqualityautodetailing.com
americanroofingnow.com
scszwl.com
poicol.xyz
primarybillserv.com
smallfinancials.com
rahpilates.info
workflowxray.com
clothapparels.com
cathycre8.co.uk
familiesstores.com
printbonn.com
manismas.com
krispykremesweetpeek.com
redgtc.com
uixsv.com
superiorvillage.com
fdgrenewables.com
appments.com
shanscorp.com
modelleftcoast.com
lookitlook.com
inijuslem.com
bjtqbxg.com
ontariolitigationlawyers.com
certificationroundtable.com
levelup-edu.com
muahangonl.com
lexingtonclarke.com
brapscallions.com
elti-stables.com
nivxros.com
diversifiededhospitality.com
lnstagramappealform.com
anushwirasinha.net
shopalife.xyz
mycryptotrading.net
gxsmrtwtch.icu
williamandholland.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3144-117-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3144-118-0x000000000041EA80-mapping.dmp formbook behavioral2/memory/3532-127-0x0000000000A00000-0x0000000000A2E000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
QUOTATION.exeQUOTATION.exesvchost.exedescription pid process target process PID 3924 set thread context of 3144 3924 QUOTATION.exe QUOTATION.exe PID 3144 set thread context of 3036 3144 QUOTATION.exe Explorer.EXE PID 3144 set thread context of 3036 3144 QUOTATION.exe Explorer.EXE PID 3532 set thread context of 3036 3532 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
QUOTATION.exesvchost.exepid process 3144 QUOTATION.exe 3144 QUOTATION.exe 3144 QUOTATION.exe 3144 QUOTATION.exe 3144 QUOTATION.exe 3144 QUOTATION.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe 3532 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3036 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
QUOTATION.exesvchost.exepid process 3144 QUOTATION.exe 3144 QUOTATION.exe 3144 QUOTATION.exe 3144 QUOTATION.exe 3532 svchost.exe 3532 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
QUOTATION.exesvchost.exedescription pid process Token: SeDebugPrivilege 3144 QUOTATION.exe Token: SeDebugPrivilege 3532 svchost.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3036 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
QUOTATION.exeExplorer.EXEsvchost.exedescription pid process target process PID 3924 wrote to memory of 744 3924 QUOTATION.exe schtasks.exe PID 3924 wrote to memory of 744 3924 QUOTATION.exe schtasks.exe PID 3924 wrote to memory of 744 3924 QUOTATION.exe schtasks.exe PID 3924 wrote to memory of 3144 3924 QUOTATION.exe QUOTATION.exe PID 3924 wrote to memory of 3144 3924 QUOTATION.exe QUOTATION.exe PID 3924 wrote to memory of 3144 3924 QUOTATION.exe QUOTATION.exe PID 3924 wrote to memory of 3144 3924 QUOTATION.exe QUOTATION.exe PID 3924 wrote to memory of 3144 3924 QUOTATION.exe QUOTATION.exe PID 3924 wrote to memory of 3144 3924 QUOTATION.exe QUOTATION.exe PID 3036 wrote to memory of 3532 3036 Explorer.EXE svchost.exe PID 3036 wrote to memory of 3532 3036 Explorer.EXE svchost.exe PID 3036 wrote to memory of 3532 3036 Explorer.EXE svchost.exe PID 3532 wrote to memory of 3392 3532 svchost.exe cmd.exe PID 3532 wrote to memory of 3392 3532 svchost.exe cmd.exe PID 3532 wrote to memory of 3392 3532 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KpABAQIVyVKx" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCD96.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpCD96.tmpMD5
40f639166b10f101b1109d9091b64342
SHA11d02033ca879fbfcb235be714021c6d0eb53efff
SHA25616fec0b32976baa0ec26e34936d0c056d4337a81b8f27ab8e0b47e31ce7ad80a
SHA512c05d6cff7716e823a40922199aebbd5e8f204f7e8ebf772a16bb6c0c996984c0f89a92cbe79071e05e7ca75ee933e47a73868e91d97ade42f53ac85c742a3d84
-
memory/744-115-0x0000000000000000-mapping.dmp
-
memory/3036-121-0x0000000005A30000-0x0000000005B4F000-memory.dmpFilesize
1.1MB
-
memory/3036-130-0x0000000004AE0000-0x0000000004C4B000-memory.dmpFilesize
1.4MB
-
memory/3036-123-0x0000000005F20000-0x00000000060C3000-memory.dmpFilesize
1.6MB
-
memory/3144-118-0x000000000041EA80-mapping.dmp
-
memory/3144-120-0x00000000018B0000-0x00000000018C4000-memory.dmpFilesize
80KB
-
memory/3144-119-0x0000000001970000-0x0000000001C90000-memory.dmpFilesize
3.1MB
-
memory/3144-122-0x0000000001900000-0x0000000001914000-memory.dmpFilesize
80KB
-
memory/3144-117-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3392-125-0x0000000000000000-mapping.dmp
-
memory/3532-124-0x0000000000000000-mapping.dmp
-
memory/3532-127-0x0000000000A00000-0x0000000000A2E000-memory.dmpFilesize
184KB
-
memory/3532-126-0x0000000000EA0000-0x0000000000EAC000-memory.dmpFilesize
48KB
-
memory/3532-128-0x0000000003620000-0x0000000003940000-memory.dmpFilesize
3.1MB
-
memory/3532-129-0x0000000003120000-0x00000000031B3000-memory.dmpFilesize
588KB
-
memory/3924-114-0x00000000014F0000-0x00000000014F1000-memory.dmpFilesize
4KB