Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:15
Static task
static1
Behavioral task
behavioral1
Sample
quote108.exe
Resource
win7-20220414-en
General
-
Target
quote108.exe
-
Size
1.3MB
-
MD5
da64fb838cf3e807f83bedc61659574a
-
SHA1
dace8b92ed4181ea1959aa42edb94d11e71fe47a
-
SHA256
f17cee91692c671592aa451fea1c86090f9ff613dfad84a5e7f17c18fe939e1e
-
SHA512
d73e152e30b2b64fd25de87cee3f8baa4df42f19c2a71b6c51e21a9d4c95e2b4e8cbb119b7921702e1b0746bf88cfdfbe79b24c87913d0815562677afb3d2aeb
Malware Config
Extracted
formbook
4.1
vcd
lacittauniversitaria.com
godsdigger.info
stxfwj.com
sing-uk.com
crazyedu.com
sunchermical.com
cocaparis2024.com
ahazm.com
li021.com
bizzspire.com
jb-o8y.com
ssconlineadmitcard.com
merkled.net
nesaraconstruction.com
viba.ltd
rasshoferconsulting.com
slingersdlbrbhjs.download
higgins-plastering.com
prostickusa.com
szryyl.com
crfmail.com
758elpintadord.com
things4dogs.com
skyhub.solutions
casavillaesperanza.com
xulynuocthainhiemdau.com
danarebecca.net
tongren119.com
k-908.com
zedbloggeronline.com
loqiri.com
fhjej.info
weihuimao.com
biokinemetrics.info
thevistatoledo.com
b2btechemail.com
duhe.ltd
artgarfunkelbooks.com
lessentielstudio.com
sdoubote.com
perfectdiveform.com
hanguoxuebingguanwang.com
readlies.com
xn--fiqa07aw9y6mlc3hiqb4w5k.net
sabkimaggi.com
keyways-lnt.com
xn--snapcht-bxa.com
whatsthebestfrench.com
saddamakhtar.net
tpscrtcnsltng.com
ysiemprendes.com
abcconcours.info
lienvision.com
97ping.com
canthihocduong.info
shjdfc.com
yinghuatianyi.com
fincasyvecinos.com
thefoodieboo.com
leafworkdna.com
ads-strong.com
juhao.site
thsavingsbankohio.com
matthewjgardner.com
godhep.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1552-137-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/1552-139-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/4068-145-0x00000000009D0000-0x00000000009FD000-memory.dmp formbook -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\FLNHHTBP8DZ = "C:\\Program Files (x86)\\Hslddvl\\9r96lh.exe" msiexec.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
quote108.exequote108.exemsiexec.exedescription pid process target process PID 4828 set thread context of 1552 4828 quote108.exe quote108.exe PID 1552 set thread context of 2608 1552 quote108.exe Explorer.EXE PID 4068 set thread context of 2608 4068 msiexec.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Program Files (x86)\Hslddvl\9r96lh.exe msiexec.exe -
Processes:
msiexec.exedescription ioc process Key created \Registry\User\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
quote108.exequote108.exemsiexec.exepid process 4828 quote108.exe 4828 quote108.exe 4828 quote108.exe 1552 quote108.exe 1552 quote108.exe 1552 quote108.exe 1552 quote108.exe 4068 msiexec.exe 4068 msiexec.exe 4068 msiexec.exe 4068 msiexec.exe 4068 msiexec.exe 4068 msiexec.exe 4068 msiexec.exe 4068 msiexec.exe 4068 msiexec.exe 4068 msiexec.exe 4068 msiexec.exe 4068 msiexec.exe 4068 msiexec.exe 4068 msiexec.exe 4068 msiexec.exe 4068 msiexec.exe 4068 msiexec.exe 4068 msiexec.exe 4068 msiexec.exe 4068 msiexec.exe 4068 msiexec.exe 4068 msiexec.exe 4068 msiexec.exe 4068 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2608 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
quote108.exemsiexec.exepid process 1552 quote108.exe 1552 quote108.exe 1552 quote108.exe 4068 msiexec.exe 4068 msiexec.exe 4068 msiexec.exe 4068 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
quote108.exequote108.exemsiexec.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4828 quote108.exe Token: SeDebugPrivilege 1552 quote108.exe Token: SeDebugPrivilege 4068 msiexec.exe Token: SeShutdownPrivilege 2608 Explorer.EXE Token: SeCreatePagefilePrivilege 2608 Explorer.EXE Token: SeShutdownPrivilege 2608 Explorer.EXE Token: SeCreatePagefilePrivilege 2608 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
quote108.exeExplorer.EXEmsiexec.exedescription pid process target process PID 4828 wrote to memory of 1552 4828 quote108.exe quote108.exe PID 4828 wrote to memory of 1552 4828 quote108.exe quote108.exe PID 4828 wrote to memory of 1552 4828 quote108.exe quote108.exe PID 4828 wrote to memory of 1552 4828 quote108.exe quote108.exe PID 4828 wrote to memory of 1552 4828 quote108.exe quote108.exe PID 4828 wrote to memory of 1552 4828 quote108.exe quote108.exe PID 2608 wrote to memory of 4068 2608 Explorer.EXE msiexec.exe PID 2608 wrote to memory of 4068 2608 Explorer.EXE msiexec.exe PID 2608 wrote to memory of 4068 2608 Explorer.EXE msiexec.exe PID 4068 wrote to memory of 3676 4068 msiexec.exe cmd.exe PID 4068 wrote to memory of 3676 4068 msiexec.exe cmd.exe PID 4068 wrote to memory of 3676 4068 msiexec.exe cmd.exe PID 4068 wrote to memory of 4092 4068 msiexec.exe cmd.exe PID 4068 wrote to memory of 4092 4068 msiexec.exe cmd.exe PID 4068 wrote to memory of 4092 4068 msiexec.exe cmd.exe PID 4068 wrote to memory of 2748 4068 msiexec.exe Firefox.exe PID 4068 wrote to memory of 2748 4068 msiexec.exe Firefox.exe PID 4068 wrote to memory of 2748 4068 msiexec.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\quote108.exe"C:\Users\Admin\AppData\Local\Temp\quote108.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\quote108.exe"C:\Users\Admin\AppData\Local\Temp\quote108.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\quote108.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DB1Filesize
40KB
MD5b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
memory/1552-140-0x00000000010D0000-0x000000000141A000-memory.dmpFilesize
3.3MB
-
memory/1552-141-0x0000000001030000-0x0000000001044000-memory.dmpFilesize
80KB
-
memory/1552-136-0x0000000000000000-mapping.dmp
-
memory/1552-137-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1552-139-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2608-149-0x0000000008690000-0x000000000879B000-memory.dmpFilesize
1.0MB
-
memory/2608-142-0x00000000084A0000-0x00000000085F2000-memory.dmpFilesize
1.3MB
-
memory/3676-147-0x0000000000000000-mapping.dmp
-
memory/4068-146-0x0000000002A90000-0x0000000002DDA000-memory.dmpFilesize
3.3MB
-
memory/4068-143-0x0000000000000000-mapping.dmp
-
memory/4068-144-0x0000000000D90000-0x0000000000DA2000-memory.dmpFilesize
72KB
-
memory/4068-145-0x00000000009D0000-0x00000000009FD000-memory.dmpFilesize
180KB
-
memory/4068-148-0x0000000002DE0000-0x0000000002E73000-memory.dmpFilesize
588KB
-
memory/4092-150-0x0000000000000000-mapping.dmp
-
memory/4828-135-0x00000000078B0000-0x0000000007906000-memory.dmpFilesize
344KB
-
memory/4828-134-0x0000000007560000-0x000000000756A000-memory.dmpFilesize
40KB
-
memory/4828-130-0x0000000000220000-0x0000000000368000-memory.dmpFilesize
1.3MB
-
memory/4828-133-0x0000000007660000-0x00000000076F2000-memory.dmpFilesize
584KB
-
memory/4828-132-0x0000000007C10000-0x00000000081B4000-memory.dmpFilesize
5.6MB
-
memory/4828-131-0x00000000075C0000-0x000000000765C000-memory.dmpFilesize
624KB