Analysis
-
max time kernel
184s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 22:15
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATIO.exe
Resource
win7-20220414-en
General
-
Target
QUOTATIO.exe
-
Size
548KB
-
MD5
f47260278fdefc14190e08fea301753b
-
SHA1
28ddee1b6b033c57e8ce033db930fd7a403acdf2
-
SHA256
6f9973f8abd9e5fb811ccb04db4fc7063fb01623edd3f53e9a8a20e352ffa8ba
-
SHA512
3d6e37816c77c86c9137fe1d5d38155d8882d85bedb6dddf49ed64235fae9485a5b0c0e3ad75dbd62b621d1f67b0c26805202afd51f5c7f867a8ecefafb21579
Malware Config
Extracted
formbook
4.1
dmn
sadelwatterson.com
iwanttodesignforlitmus.com
familytelco.com
underphone.com
tongyouqu.com
measureuplive.com
550754.top
habermanforcongress.com
elevateyourexit.live
megapolitique.com
annelegrand.design
geotourconsult.com
dahanhg.com
lailaisong.com
selcenkocak.com
jcvsq.com
jhn2.com
mimo103.com
baytownbounce.com
justanothercritic.com
liuhe093.com
managementpartner.net
juventudfronterizarecuerda.com
heavennailsstudio.com
charlesmultimedia.com
798726.com
stephanielysebrennan.com
returnofthegadgets.com
download-ap.com
lorenzocoscarelli.com
downloadoe.com
44brcl.biz
hopesouthsafaris.net
thelearningboost.com
electronicsurgery.ltd
jlwwj.com
firstmilecare.com
takemap.com
dope.support
harlowandeverett.com
iccmembers.com
pbcalendar.com
lisalakinky.com
aichonghome.com
blueeyesbeauty.info
zanzibaricuisine.com
dagym4.info
eminemlak.net
buildwithsequence.com
wordpress-hosting-123.com
onestopteespot.com
seosueengine.party
www006345.com
jd9545.com
urbanpantherfinancial.com
lygj8899.com
quanqiugangs.com
toneri.online
hbxyyl8.com
northwoodmgt.com
heipigo.com
fatihcinaremlak.com
koreagim.net
webcheckq.com
lonxer.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3200-137-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3200-139-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2092-145-0x0000000000690000-0x00000000006BE000-memory.dmp formbook -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
QUOTATIO.exeQUOTATIO.exechkdsk.exedescription pid process target process PID 4308 set thread context of 3200 4308 QUOTATIO.exe QUOTATIO.exe PID 3200 set thread context of 1064 3200 QUOTATIO.exe Explorer.EXE PID 2092 set thread context of 1064 2092 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Processes:
chkdsk.exedescription ioc process Key created \Registry\User\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 39 IoCs
Processes:
QUOTATIO.exeQUOTATIO.exechkdsk.exepid process 4308 QUOTATIO.exe 3200 QUOTATIO.exe 3200 QUOTATIO.exe 3200 QUOTATIO.exe 3200 QUOTATIO.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1064 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
QUOTATIO.exechkdsk.exepid process 3200 QUOTATIO.exe 3200 QUOTATIO.exe 3200 QUOTATIO.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe 2092 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
QUOTATIO.exeQUOTATIO.exechkdsk.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4308 QUOTATIO.exe Token: SeDebugPrivilege 3200 QUOTATIO.exe Token: SeDebugPrivilege 2092 chkdsk.exe Token: SeShutdownPrivilege 1064 Explorer.EXE Token: SeCreatePagefilePrivilege 1064 Explorer.EXE Token: SeShutdownPrivilege 1064 Explorer.EXE Token: SeCreatePagefilePrivilege 1064 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
QUOTATIO.exeExplorer.EXEchkdsk.exedescription pid process target process PID 4308 wrote to memory of 3200 4308 QUOTATIO.exe QUOTATIO.exe PID 4308 wrote to memory of 3200 4308 QUOTATIO.exe QUOTATIO.exe PID 4308 wrote to memory of 3200 4308 QUOTATIO.exe QUOTATIO.exe PID 4308 wrote to memory of 3200 4308 QUOTATIO.exe QUOTATIO.exe PID 4308 wrote to memory of 3200 4308 QUOTATIO.exe QUOTATIO.exe PID 4308 wrote to memory of 3200 4308 QUOTATIO.exe QUOTATIO.exe PID 1064 wrote to memory of 2092 1064 Explorer.EXE chkdsk.exe PID 1064 wrote to memory of 2092 1064 Explorer.EXE chkdsk.exe PID 1064 wrote to memory of 2092 1064 Explorer.EXE chkdsk.exe PID 2092 wrote to memory of 4492 2092 chkdsk.exe cmd.exe PID 2092 wrote to memory of 4492 2092 chkdsk.exe cmd.exe PID 2092 wrote to memory of 4492 2092 chkdsk.exe cmd.exe PID 2092 wrote to memory of 5100 2092 chkdsk.exe Firefox.exe PID 2092 wrote to memory of 5100 2092 chkdsk.exe Firefox.exe PID 2092 wrote to memory of 5100 2092 chkdsk.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\QUOTATIO.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATIO.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\QUOTATIO.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATIO.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3200 -
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:4492
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:5100
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DB1Filesize
40KB
MD5b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
C:\Users\Admin\AppData\Roaming\4KO83O42\4KOlogim.jpegFilesize
79KB
MD5c11da29063337116d9f226ed69aa6a58
SHA1bfc7b7f00ac6b40afc790c064d8674bd520dc77e
SHA2568cc34987a2c1173b9b397f64076cc1babe9b28133b8c4d0adbc7c5cb959ec18c
SHA512043d3092e081c4f0caa376c164fb74dfff44fe8e1c9045370215c73d2f61dac8d32db17f4611c501d3ca496271aaff2f5d4c87919120231f521cbe1d44feb35a
-
C:\Users\Admin\AppData\Roaming\4KO83O42\4KOlogrf.iniFilesize
40B
MD52f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
C:\Users\Admin\AppData\Roaming\4KO83O42\4KOlogrg.iniFilesize
38B
MD54aadf49fed30e4c9b3fe4a3dd6445ebe
SHA11e332822167c6f351b99615eada2c30a538ff037
SHA25675034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56
SHA512eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945
-
C:\Users\Admin\AppData\Roaming\4KO83O42\4KOlogri.iniFilesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\4KO83O42\4KOlogrv.iniFilesize
872B
MD5bbc41c78bae6c71e63cb544a6a284d94
SHA133f2c1d9fa0e9c99b80bc2500621e95af38b1f9a
SHA256ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb
SHA5120aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4
-
memory/1064-142-0x00000000071C0000-0x0000000007363000-memory.dmpFilesize
1.6MB
-
memory/1064-150-0x00000000081E0000-0x0000000008366000-memory.dmpFilesize
1.5MB
-
memory/2092-149-0x0000000000C80000-0x0000000000D13000-memory.dmpFilesize
588KB
-
memory/2092-144-0x0000000000090000-0x000000000009A000-memory.dmpFilesize
40KB
-
memory/2092-146-0x0000000000FE0000-0x000000000132A000-memory.dmpFilesize
3.3MB
-
memory/2092-145-0x0000000000690000-0x00000000006BE000-memory.dmpFilesize
184KB
-
memory/2092-143-0x0000000000000000-mapping.dmp
-
memory/3200-137-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3200-139-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3200-141-0x00000000012A0000-0x00000000012B4000-memory.dmpFilesize
80KB
-
memory/3200-140-0x0000000001740000-0x0000000001A8A000-memory.dmpFilesize
3.3MB
-
memory/3200-136-0x0000000000000000-mapping.dmp
-
memory/4308-130-0x0000000000B50000-0x0000000000BE0000-memory.dmpFilesize
576KB
-
memory/4308-135-0x00000000058C0000-0x0000000005916000-memory.dmpFilesize
344KB
-
memory/4308-134-0x0000000005580000-0x000000000558A000-memory.dmpFilesize
40KB
-
memory/4308-133-0x0000000005680000-0x0000000005712000-memory.dmpFilesize
584KB
-
memory/4308-132-0x0000000005C30000-0x00000000061D4000-memory.dmpFilesize
5.6MB
-
memory/4308-131-0x00000000055E0000-0x000000000567C000-memory.dmpFilesize
624KB
-
memory/4492-147-0x0000000000000000-mapping.dmp