Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 22:15
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATIO.exe
Resource
win7-20220414-en
General
-
Target
QUOTATIO.exe
-
Size
548KB
-
MD5
f47260278fdefc14190e08fea301753b
-
SHA1
28ddee1b6b033c57e8ce033db930fd7a403acdf2
-
SHA256
6f9973f8abd9e5fb811ccb04db4fc7063fb01623edd3f53e9a8a20e352ffa8ba
-
SHA512
3d6e37816c77c86c9137fe1d5d38155d8882d85bedb6dddf49ed64235fae9485a5b0c0e3ad75dbd62b621d1f67b0c26805202afd51f5c7f867a8ecefafb21579
Malware Config
Extracted
formbook
4.1
dmn
sadelwatterson.com
iwanttodesignforlitmus.com
familytelco.com
underphone.com
tongyouqu.com
measureuplive.com
550754.top
habermanforcongress.com
elevateyourexit.live
megapolitique.com
annelegrand.design
geotourconsult.com
dahanhg.com
lailaisong.com
selcenkocak.com
jcvsq.com
jhn2.com
mimo103.com
baytownbounce.com
justanothercritic.com
liuhe093.com
managementpartner.net
juventudfronterizarecuerda.com
heavennailsstudio.com
charlesmultimedia.com
798726.com
stephanielysebrennan.com
returnofthegadgets.com
download-ap.com
lorenzocoscarelli.com
downloadoe.com
44brcl.biz
hopesouthsafaris.net
thelearningboost.com
electronicsurgery.ltd
jlwwj.com
firstmilecare.com
takemap.com
dope.support
harlowandeverett.com
iccmembers.com
pbcalendar.com
lisalakinky.com
aichonghome.com
blueeyesbeauty.info
zanzibaricuisine.com
dagym4.info
eminemlak.net
buildwithsequence.com
wordpress-hosting-123.com
onestopteespot.com
seosueengine.party
www006345.com
jd9545.com
urbanpantherfinancial.com
lygj8899.com
quanqiugangs.com
toneri.online
hbxyyl8.com
northwoodmgt.com
heipigo.com
fatihcinaremlak.com
koreagim.net
webcheckq.com
lonxer.com
Signatures
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/520-62-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/520-63-0x000000000041ED20-mapping.dmp formbook behavioral1/memory/520-65-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1968-72-0x00000000000C0000-0x00000000000EE000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
QUOTATIO.exeQUOTATIO.exeraserver.exedescription pid process target process PID 1032 set thread context of 520 1032 QUOTATIO.exe QUOTATIO.exe PID 520 set thread context of 1208 520 QUOTATIO.exe Explorer.EXE PID 1968 set thread context of 1208 1968 raserver.exe Explorer.EXE -
Processes:
raserver.exedescription ioc process Key created \Registry\User\S-1-5-21-790309383-526510583-3802439154-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 raserver.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
QUOTATIO.exeraserver.exepid process 520 QUOTATIO.exe 520 QUOTATIO.exe 1968 raserver.exe 1968 raserver.exe 1968 raserver.exe 1968 raserver.exe 1968 raserver.exe 1968 raserver.exe 1968 raserver.exe 1968 raserver.exe 1968 raserver.exe 1968 raserver.exe 1968 raserver.exe 1968 raserver.exe 1968 raserver.exe 1968 raserver.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
QUOTATIO.exeraserver.exepid process 520 QUOTATIO.exe 520 QUOTATIO.exe 520 QUOTATIO.exe 1968 raserver.exe 1968 raserver.exe 1968 raserver.exe 1968 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
QUOTATIO.exeraserver.exedescription pid process Token: SeDebugPrivilege 520 QUOTATIO.exe Token: SeDebugPrivilege 1968 raserver.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
QUOTATIO.exeExplorer.EXEraserver.exedescription pid process target process PID 1032 wrote to memory of 520 1032 QUOTATIO.exe QUOTATIO.exe PID 1032 wrote to memory of 520 1032 QUOTATIO.exe QUOTATIO.exe PID 1032 wrote to memory of 520 1032 QUOTATIO.exe QUOTATIO.exe PID 1032 wrote to memory of 520 1032 QUOTATIO.exe QUOTATIO.exe PID 1032 wrote to memory of 520 1032 QUOTATIO.exe QUOTATIO.exe PID 1032 wrote to memory of 520 1032 QUOTATIO.exe QUOTATIO.exe PID 1032 wrote to memory of 520 1032 QUOTATIO.exe QUOTATIO.exe PID 1208 wrote to memory of 1968 1208 Explorer.EXE raserver.exe PID 1208 wrote to memory of 1968 1208 Explorer.EXE raserver.exe PID 1208 wrote to memory of 1968 1208 Explorer.EXE raserver.exe PID 1208 wrote to memory of 1968 1208 Explorer.EXE raserver.exe PID 1968 wrote to memory of 972 1968 raserver.exe Firefox.exe PID 1968 wrote to memory of 972 1968 raserver.exe Firefox.exe PID 1968 wrote to memory of 972 1968 raserver.exe Firefox.exe PID 1968 wrote to memory of 972 1968 raserver.exe Firefox.exe PID 1968 wrote to memory of 972 1968 raserver.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\QUOTATIO.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATIO.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\QUOTATIO.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATIO.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:520 -
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:972
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\4KO83O42\4KOlogim.jpegFilesize
64KB
MD507af11b11c956f760920125f4eb1d4b9
SHA169d47ea481cb2392a23efd892cafc09d5079a5ab
SHA256ba66cb159f4bf8266b3cf5ffd39ca12c143065305edb451a457836e6038e65d8
SHA512f0c115d7e831ec8d6199573109402ed5ea43c79cc3eda41674108fe894e96f3055c9cb2b1c945bcd566005f0357b4ddfd4f2f91b4938794aec1d014e7dd16ae0
-
C:\Users\Admin\AppData\Roaming\4KO83O42\4KOlogrf.iniFilesize
40B
MD52f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
C:\Users\Admin\AppData\Roaming\4KO83O42\4KOlogri.iniFilesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\4KO83O42\4KOlogrv.iniFilesize
40B
MD5ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf
-
memory/520-67-0x0000000000360000-0x0000000000374000-memory.dmpFilesize
80KB
-
memory/520-66-0x0000000000870000-0x0000000000B73000-memory.dmpFilesize
3.0MB
-
memory/520-60-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/520-62-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/520-63-0x000000000041ED20-mapping.dmp
-
memory/520-65-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/520-59-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1032-54-0x0000000000C10000-0x0000000000CA0000-memory.dmpFilesize
576KB
-
memory/1032-55-0x00000000758D1000-0x00000000758D3000-memory.dmpFilesize
8KB
-
memory/1032-56-0x0000000000300000-0x0000000000308000-memory.dmpFilesize
32KB
-
memory/1032-57-0x0000000002280000-0x00000000022F0000-memory.dmpFilesize
448KB
-
memory/1032-58-0x0000000000980000-0x00000000009C4000-memory.dmpFilesize
272KB
-
memory/1208-75-0x0000000004550000-0x000000000461E000-memory.dmpFilesize
824KB
-
memory/1208-68-0x0000000004080000-0x000000000413E000-memory.dmpFilesize
760KB
-
memory/1968-69-0x0000000000000000-mapping.dmp
-
memory/1968-74-0x00000000008E0000-0x0000000000973000-memory.dmpFilesize
588KB
-
memory/1968-73-0x0000000002150000-0x0000000002453000-memory.dmpFilesize
3.0MB
-
memory/1968-72-0x00000000000C0000-0x00000000000EE000-memory.dmpFilesize
184KB
-
memory/1968-71-0x0000000000D30000-0x0000000000D4C000-memory.dmpFilesize
112KB