Analysis
-
max time kernel
151s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 00:52
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7-20220414-en
General
-
Target
Quotation.exe
-
Size
378KB
-
MD5
f3cf72f1ae6aa14ad0da0ee454e42bfb
-
SHA1
93c3d771808d2c5a4ad34e9cebe3fab5da335069
-
SHA256
3837dc32928e8556207e8dafb872968279682dc4a848d09f73823818d2fb7dff
-
SHA512
4a52b43f19bdfbb4614ae510c0e1aea414d676ce7d5b0120c66e14c791498d9ee9e458aafe74885f7b62e355139bacb46541f92eddc6b85836dcb4dc36cb984a
Malware Config
Extracted
formbook
3.9
m6x
990939.top
dhluxuryconsulting.com
muapnvnsfr.com
homder.com
valveiran.com
alkhaleejtrading.net
jekweiss.com
kevinklasmanmusic.com
buyilovebacon.com
nq227.com
cryptrproject.com
medicine.mba
nufilter.info
highway99restorations.com
phytohealthkits.com
accentuatephotography.com
tradeclimber.com
yasseralm.com
ito-agri.com
divandaman.com
raihtn.site
solyetrfademven.com
tepire.net
cointicket.online
johnhevank.com
pxskin.com
528jr.net
kovachnation.com
marstroy.info
1xsort.com
ugrowvancouverisland.com
sprintstats.com
furkankarakus.com
seo-caen.net
yclm1051.com
floydcountybaseball.com
privewin5.com
donaldjtrumpjr.chat
coloral.biz
xj9x.com
stichtingkind.com
tv16429.info
forgatheredhealth.com
waldheim-heslach.com
huimin26.com
mxfbyym.com
goveritas.com
newexpertise.biz
qqfyt.com
invictussociety.com
mmgan19.com
meileefu.com
profitpk.com
koolkitchendezigns.com
tubesluitmachine.com
mypussy.online
land8531.com
zhekou115.com
greenlandeventsntours.com
sydneycohn.net
bibs-bobs.com
zghz6688.com
wujing.group
motoucai.com
hearxy.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1964-57-0x0000000000C70000-0x0000000000C9A000-memory.dmp formbook behavioral1/memory/1384-66-0x0000000000080000-0x00000000000AA000-memory.dmp formbook -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LPXXV = "C:\\Program Files (x86)\\Bd6qlwvr\\igfxrhlh0.exe" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run explorer.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1260 cmd.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Quotation.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Quotation.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 Quotation.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Quotation.exeexplorer.exedescription pid process target process PID 1964 set thread context of 1272 1964 Quotation.exe Explorer.EXE PID 1384 set thread context of 1272 1384 explorer.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Program Files (x86)\Bd6qlwvr\igfxrhlh0.exe explorer.exe -
Processes:
explorer.exedescription ioc process Key created \Registry\User\S-1-5-21-790309383-526510583-3802439154-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 explorer.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
Quotation.exeexplorer.exepid process 1964 Quotation.exe 1964 Quotation.exe 1384 explorer.exe 1384 explorer.exe 1384 explorer.exe 1384 explorer.exe 1384 explorer.exe 1384 explorer.exe 1384 explorer.exe 1384 explorer.exe 1384 explorer.exe 1384 explorer.exe 1384 explorer.exe 1384 explorer.exe 1384 explorer.exe 1384 explorer.exe 1384 explorer.exe 1384 explorer.exe 1384 explorer.exe 1384 explorer.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Quotation.exeexplorer.exepid process 1964 Quotation.exe 1964 Quotation.exe 1964 Quotation.exe 1384 explorer.exe 1384 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Quotation.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1964 Quotation.exe Token: SeDebugPrivilege 1384 explorer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Explorer.EXEexplorer.exedescription pid process target process PID 1272 wrote to memory of 1384 1272 Explorer.EXE explorer.exe PID 1272 wrote to memory of 1384 1272 Explorer.EXE explorer.exe PID 1272 wrote to memory of 1384 1272 Explorer.EXE explorer.exe PID 1272 wrote to memory of 1384 1272 Explorer.EXE explorer.exe PID 1384 wrote to memory of 1260 1384 explorer.exe cmd.exe PID 1384 wrote to memory of 1260 1384 explorer.exe cmd.exe PID 1384 wrote to memory of 1260 1384 explorer.exe cmd.exe PID 1384 wrote to memory of 1260 1384 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\N98A4CAW\N98logim.jpegFilesize
63KB
MD59abf6d069a3729c2e53e45bb65ce5ad6
SHA1669b31e1ad5265c2076a64d5ead370590d1177d0
SHA25631a40a60f865037ef83fa03fe0388db16e37a6e0bf78ee48199ca81317951f87
SHA512b607e8387addeb7b1d53c47db9cc9d12ac9d2b61b07fd0a0d5abeb7af53d6bf31a9cb0a0d2b40a8e2140ae5bf0004d8d18cc128d684d358d676033cb1f252fd5
-
C:\Users\Admin\AppData\Roaming\N98A4CAW\N98logri.iniFilesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\N98A4CAW\N98logrv.iniFilesize
40B
MD5ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf
-
memory/1260-64-0x0000000000000000-mapping.dmp
-
memory/1272-60-0x0000000006020000-0x000000000614C000-memory.dmpFilesize
1.2MB
-
memory/1272-69-0x0000000007190000-0x00000000072C7000-memory.dmpFilesize
1.2MB
-
memory/1384-66-0x0000000000080000-0x00000000000AA000-memory.dmpFilesize
168KB
-
memory/1384-61-0x0000000000000000-mapping.dmp
-
memory/1384-62-0x00000000756E1000-0x00000000756E3000-memory.dmpFilesize
8KB
-
memory/1384-63-0x0000000073F91000-0x0000000073F93000-memory.dmpFilesize
8KB
-
memory/1384-65-0x0000000000640000-0x00000000008C1000-memory.dmpFilesize
2.5MB
-
memory/1384-67-0x0000000002480000-0x0000000002783000-memory.dmpFilesize
3.0MB
-
memory/1384-68-0x00000000021B0000-0x0000000002243000-memory.dmpFilesize
588KB
-
memory/1964-59-0x0000000000DA0000-0x0000000000DB4000-memory.dmpFilesize
80KB
-
memory/1964-54-0x0000000000EF0000-0x0000000000F54000-memory.dmpFilesize
400KB
-
memory/1964-58-0x0000000005470000-0x0000000005773000-memory.dmpFilesize
3.0MB
-
memory/1964-57-0x0000000000C70000-0x0000000000C9A000-memory.dmpFilesize
168KB
-
memory/1964-56-0x00000000007E0000-0x0000000000814000-memory.dmpFilesize
208KB
-
memory/1964-55-0x00000000007A0000-0x00000000007E4000-memory.dmpFilesize
272KB