Analysis
- max time kernel
157s - max time network
164s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
22/10/2023, 07:41
General
- Target Quote Request.exe
- Size 593KB
- Sample231022-jh57csec2w
- SHA256 ccd3d1ec6d5b5723225b7d0c6488de099b2b22c5b70bc1c521c148160f5997cc
Malware Config
Extracted
-
formbook
-
4.1
-
5nd2
-
soulalchemyhub.com
-
geisa24.online
-
1c0v9.xyz
-
marcomarzadori-shop.com
-
yarn360.net
-
coding-bootcamps-57448.bond
-
kjtrhtsd.top
-
83b52.com
-
xiaomadou8.com
-
d4rk23.com
-
abdg1.com
-
clientunlimited.com
-
29981e.shop
-
scshuixie.fun
-
erxbet171.com
-
yiyageshafa.com
-
salju4d5.com
-
valentinpfaffenwimmer.com
-
profitecnicaingenieria.com
-
dohafintech.net
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 4 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quote Request.exe"C:\Users\Admin\AppData\Local\Temp\Quote Request.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quote Request.exe"C:\Users\Admin\AppData\Local\Temp\Quote Request.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Quote Request.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1992-12-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1992-18-0x00000000010F0000-0x0000000001105000-memory.dmp
memory/1992-17-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1992-15-0x0000000001110000-0x000000000145A000-memory.dmp
memory/3144-31-0x00000000087E0000-0x0000000008939000-memory.dmp
memory/3144-30-0x00000000087E0000-0x0000000008939000-memory.dmp
memory/3144-29-0x00000000087E0000-0x0000000008939000-memory.dmp
memory/3144-26-0x00000000081B0000-0x000000000828D000-memory.dmp
memory/3144-19-0x00000000081B0000-0x000000000828D000-memory.dmp
memory/4628-24-0x0000000002C50000-0x0000000002F9A000-memory.dmp
memory/4628-25-0x0000000000970000-0x000000000099F000-memory.dmp
memory/4628-28-0x0000000002A30000-0x0000000002AC4000-memory.dmp
memory/4628-23-0x0000000000970000-0x000000000099F000-memory.dmp
memory/4628-22-0x0000000000D80000-0x0000000000D9F000-memory.dmp
memory/4628-20-0x0000000000D80000-0x0000000000D9F000-memory.dmp
memory/4664-0-0x0000000074690000-0x0000000074E40000-memory.dmp
memory/4664-6-0x0000000074690000-0x0000000074E40000-memory.dmp
memory/4664-5-0x0000000004E20000-0x0000000004E2A000-memory.dmp
memory/4664-8-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
memory/4664-14-0x0000000074690000-0x0000000074E40000-memory.dmp
memory/4664-9-0x0000000007C00000-0x0000000007C10000-memory.dmp
memory/4664-7-0x0000000006560000-0x0000000006572000-memory.dmp
memory/4664-10-0x0000000007E90000-0x0000000007EFE000-memory.dmp
memory/4664-4-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
memory/4664-11-0x000000000A640000-0x000000000A6DC000-memory.dmp
memory/4664-3-0x0000000004C90000-0x0000000004D22000-memory.dmp
memory/4664-2-0x0000000005240000-0x00000000057E4000-memory.dmp
memory/4664-1-0x0000000000220000-0x00000000002BA000-memory.dmp