Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:15
Static task
static1
Behavioral task
behavioral1
Sample
quote108.exe
Resource
win7-20220414-en
General
-
Target
quote108.exe
-
Size
1.3MB
-
MD5
da64fb838cf3e807f83bedc61659574a
-
SHA1
dace8b92ed4181ea1959aa42edb94d11e71fe47a
-
SHA256
f17cee91692c671592aa451fea1c86090f9ff613dfad84a5e7f17c18fe939e1e
-
SHA512
d73e152e30b2b64fd25de87cee3f8baa4df42f19c2a71b6c51e21a9d4c95e2b4e8cbb119b7921702e1b0746bf88cfdfbe79b24c87913d0815562677afb3d2aeb
Malware Config
Extracted
formbook
4.1
vcd
lacittauniversitaria.com
godsdigger.info
stxfwj.com
sing-uk.com
crazyedu.com
sunchermical.com
cocaparis2024.com
ahazm.com
li021.com
bizzspire.com
jb-o8y.com
ssconlineadmitcard.com
merkled.net
nesaraconstruction.com
viba.ltd
rasshoferconsulting.com
slingersdlbrbhjs.download
higgins-plastering.com
prostickusa.com
szryyl.com
crfmail.com
758elpintadord.com
things4dogs.com
skyhub.solutions
casavillaesperanza.com
xulynuocthainhiemdau.com
danarebecca.net
tongren119.com
k-908.com
zedbloggeronline.com
loqiri.com
fhjej.info
weihuimao.com
biokinemetrics.info
thevistatoledo.com
b2btechemail.com
duhe.ltd
artgarfunkelbooks.com
lessentielstudio.com
sdoubote.com
perfectdiveform.com
hanguoxuebingguanwang.com
readlies.com
xn--fiqa07aw9y6mlc3hiqb4w5k.net
sabkimaggi.com
keyways-lnt.com
xn--snapcht-bxa.com
whatsthebestfrench.com
saddamakhtar.net
tpscrtcnsltng.com
ysiemprendes.com
abcconcours.info
lienvision.com
97ping.com
canthihocduong.info
shjdfc.com
yinghuatianyi.com
fincasyvecinos.com
thefoodieboo.com
leafworkdna.com
ads-strong.com
juhao.site
thsavingsbankohio.com
matthewjgardner.com
godhep.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1732-63-0x000000000041E270-mapping.dmp formbook behavioral1/memory/1732-62-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/1732-65-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/320-72-0x0000000000080000-0x00000000000AD000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 472 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
control.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run control.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JPALGHXX0L = "C:\\Program Files (x86)\\Vzv1pnz\\systray0bex.exe" control.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
quote108.exequote108.execontrol.exedescription pid process target process PID 960 set thread context of 1732 960 quote108.exe quote108.exe PID 1732 set thread context of 1368 1732 quote108.exe Explorer.EXE PID 320 set thread context of 1368 320 control.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
control.exedescription ioc process File opened for modification C:\Program Files (x86)\Vzv1pnz\systray0bex.exe control.exe -
Processes:
control.exedescription ioc process Key created \Registry\User\S-1-5-21-1819626980-2277161760-1023733287-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 control.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
quote108.exequote108.execontrol.exepid process 960 quote108.exe 960 quote108.exe 1732 quote108.exe 1732 quote108.exe 320 control.exe 320 control.exe 320 control.exe 320 control.exe 320 control.exe 320 control.exe 320 control.exe 320 control.exe 320 control.exe 320 control.exe 320 control.exe 320 control.exe 320 control.exe 320 control.exe 320 control.exe 320 control.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
quote108.execontrol.exepid process 1732 quote108.exe 1732 quote108.exe 1732 quote108.exe 320 control.exe 320 control.exe 320 control.exe 320 control.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
quote108.exequote108.execontrol.exedescription pid process Token: SeDebugPrivilege 960 quote108.exe Token: SeDebugPrivilege 1732 quote108.exe Token: SeDebugPrivilege 320 control.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1368 Explorer.EXE 1368 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1368 Explorer.EXE 1368 Explorer.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
quote108.exeExplorer.EXEcontrol.exedescription pid process target process PID 960 wrote to memory of 1732 960 quote108.exe quote108.exe PID 960 wrote to memory of 1732 960 quote108.exe quote108.exe PID 960 wrote to memory of 1732 960 quote108.exe quote108.exe PID 960 wrote to memory of 1732 960 quote108.exe quote108.exe PID 960 wrote to memory of 1732 960 quote108.exe quote108.exe PID 960 wrote to memory of 1732 960 quote108.exe quote108.exe PID 960 wrote to memory of 1732 960 quote108.exe quote108.exe PID 1368 wrote to memory of 320 1368 Explorer.EXE control.exe PID 1368 wrote to memory of 320 1368 Explorer.EXE control.exe PID 1368 wrote to memory of 320 1368 Explorer.EXE control.exe PID 1368 wrote to memory of 320 1368 Explorer.EXE control.exe PID 320 wrote to memory of 472 320 control.exe cmd.exe PID 320 wrote to memory of 472 320 control.exe cmd.exe PID 320 wrote to memory of 472 320 control.exe cmd.exe PID 320 wrote to memory of 472 320 control.exe cmd.exe PID 320 wrote to memory of 1188 320 control.exe Firefox.exe PID 320 wrote to memory of 1188 320 control.exe Firefox.exe PID 320 wrote to memory of 1188 320 control.exe Firefox.exe PID 320 wrote to memory of 1188 320 control.exe Firefox.exe PID 320 wrote to memory of 1188 320 control.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\quote108.exe"C:\Users\Admin\AppData\Local\Temp\quote108.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\quote108.exe"C:\Users\Admin\AppData\Local\Temp\quote108.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\quote108.exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\NKM3CD90\NKMlogim.jpegFilesize
72KB
MD5e897b3ddc239b5206387dfcd3f664055
SHA159da1529dd3e83e6c58100261457f76d392650cf
SHA256b3f189c57970a778b2c2d806928c028db7afdbcd9ae82afeb6fede57de033d8c
SHA512bb29730e92a003dcad1dd33aef2e88209e8f1b0dfe0d01659df13ee7dfe99aaaee5722d60ae60eb717169701b1120b56b5cd36422b18ca22ff6c15e90870c3b4
-
C:\Users\Admin\AppData\Roaming\NKM3CD90\NKMlogrf.iniFilesize
40B
MD52f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
C:\Users\Admin\AppData\Roaming\NKM3CD90\NKMlogri.iniFilesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\NKM3CD90\NKMlogrv.iniFilesize
40B
MD5ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf
-
memory/320-75-0x00000000004D0000-0x0000000000563000-memory.dmpFilesize
588KB
-
memory/320-72-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/320-74-0x0000000002040000-0x0000000002343000-memory.dmpFilesize
3.0MB
-
memory/320-69-0x0000000000000000-mapping.dmp
-
memory/320-71-0x0000000000900000-0x000000000091F000-memory.dmpFilesize
124KB
-
memory/472-73-0x0000000000000000-mapping.dmp
-
memory/960-58-0x0000000000770000-0x00000000007A4000-memory.dmpFilesize
208KB
-
memory/960-57-0x00000000008A0000-0x00000000008EE000-memory.dmpFilesize
312KB
-
memory/960-56-0x00000000001E0000-0x00000000001EA000-memory.dmpFilesize
40KB
-
memory/960-55-0x0000000076571000-0x0000000076573000-memory.dmpFilesize
8KB
-
memory/960-54-0x0000000000990000-0x0000000000AD8000-memory.dmpFilesize
1.3MB
-
memory/1368-68-0x0000000006A60000-0x0000000006C0C000-memory.dmpFilesize
1.7MB
-
memory/1368-76-0x0000000006480000-0x00000000065CC000-memory.dmpFilesize
1.3MB
-
memory/1732-67-0x0000000000180000-0x0000000000194000-memory.dmpFilesize
80KB
-
memory/1732-66-0x0000000000C70000-0x0000000000F73000-memory.dmpFilesize
3.0MB
-
memory/1732-65-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1732-62-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1732-63-0x000000000041E270-mapping.dmp
-
memory/1732-60-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1732-59-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB