Analysis
-
max time kernel
300s -
max time network
294s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-09-2024 06:50
Behavioral task
behavioral1
Sample
Quotation #10091.exe
Resource
win7-20240903-en
General
-
Target
Quotation #10091.exe
-
Size
758KB
-
MD5
6e39ee33f6527364cac3cc4bbf276f26
-
SHA1
a7c12eef84ae778ce5158327d419508eb5b199c8
-
SHA256
1a52416bc054c0f2a46f2fd215d73d3285334fcdacf02ed449935bd93fb70863
-
SHA512
d06164091fe866df2626377b2d2589d9da291c73aff55b40db1844e32290c1f5e37b1ba8155ee02a351366df5a8862ce0b2e5b28a9b14b65cd568064cde28a78
-
SSDEEP
12288:v6Wq4aaE6KwyF5L0Y2D1PqLVRX3OyQsAhJYUVTx6AflSeqz2jqPB88bYVUCYH5g:tthEVaPqL7nvQlhJYATxDYeHjqPB88ZO
Malware Config
Extracted
formbook
4.1
c89p
ftersaleb.top
dcustomdesgins.net
ostbet2024.live
rhgtrdjdjytkyhretrdjfytd.buzz
atauniversity.tech
idoctor365.net
x-design-courses-29670.bond
ellowold-pc.top
ransportationmmsytpro.top
areerfest.xyz
artiresbah-in.today
ijie.pro
torehousestudio.info
69-11-luxury-watches.shop
earing-tests-44243.bond
hits.shop
hzl9.bond
lood-test-jp-1.bond
livialiving.online
usymomsmakingmoney.online
olar-systems-panels-61747.bond
hinawinner.top
oldensky10.xyz
oginsuperking777.click
oviepicker.net
partment-rental05.online
ldkp.net
sofaerb.shop
ydh5.beauty
aston-saaaa.buzz
acuum-cleaner-84018.bond
usiness-printer-37559.bond
dindadisini12.click
j7zd12m.xyz
plesacv.xyz
trustcapital247.online
asapembuatanpatung.online
ent-all.xyz
r64mh1.vip
aser-cap-hair-growth.today
amattva.company
herightfits.top
uickautoquote.net
ctu36ojboz6w2cl.asia
oursmile.vip
astysavor.website
iam-saaab.buzz
igmoto.info
itchellcohen.net
un-sea.fun
steticavonixx.shop
arklife.shop
bsboffchatrussummsa.online
iuxing.asia
okenexchange.art
llhealthreview.online
refabricated-homes-53685.bond
atercraze.net
osmits.net
rail.cruises
utanginamo.sbs
hapanda.fun
arehouse-inventory-29693.bond
innivip.bio
aycare-service-99683.bond
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/2960-4-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2960-9-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2784-16-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2140-6-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2140 set thread context of 2960 2140 Quotation #10091.exe 30 PID 2960 set thread context of 1220 2960 svchost.exe 21 PID 2784 set thread context of 1220 2784 help.exe 21 -
resource yara_rule behavioral1/memory/2140-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2140-6-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Quotation #10091.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language help.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 59 IoCs
pid Process 2960 svchost.exe 2960 svchost.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe 2784 help.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2140 Quotation #10091.exe 2960 svchost.exe 2960 svchost.exe 2960 svchost.exe 2784 help.exe 2784 help.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2960 svchost.exe Token: SeDebugPrivilege 2784 help.exe Token: SeShutdownPrivilege 1220 Explorer.EXE -
Suspicious use of FindShellTrayWindow 13 IoCs
pid Process 2140 Quotation #10091.exe 2140 Quotation #10091.exe 2140 Quotation #10091.exe 2140 Quotation #10091.exe 2140 Quotation #10091.exe 2140 Quotation #10091.exe 2140 Quotation #10091.exe 2140 Quotation #10091.exe 2140 Quotation #10091.exe 2140 Quotation #10091.exe 2140 Quotation #10091.exe 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of SendNotifyMessage 11 IoCs
pid Process 2140 Quotation #10091.exe 2140 Quotation #10091.exe 2140 Quotation #10091.exe 2140 Quotation #10091.exe 2140 Quotation #10091.exe 2140 Quotation #10091.exe 2140 Quotation #10091.exe 2140 Quotation #10091.exe 2140 Quotation #10091.exe 2140 Quotation #10091.exe 2140 Quotation #10091.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2140 wrote to memory of 2960 2140 Quotation #10091.exe 30 PID 2140 wrote to memory of 2960 2140 Quotation #10091.exe 30 PID 2140 wrote to memory of 2960 2140 Quotation #10091.exe 30 PID 2140 wrote to memory of 2960 2140 Quotation #10091.exe 30 PID 2140 wrote to memory of 2960 2140 Quotation #10091.exe 30 PID 1220 wrote to memory of 2784 1220 Explorer.EXE 31 PID 1220 wrote to memory of 2784 1220 Explorer.EXE 31 PID 1220 wrote to memory of 2784 1220 Explorer.EXE 31 PID 1220 wrote to memory of 2784 1220 Explorer.EXE 31 PID 2784 wrote to memory of 2876 2784 help.exe 32 PID 2784 wrote to memory of 2876 2784 help.exe 32 PID 2784 wrote to memory of 2876 2784 help.exe 32 PID 2784 wrote to memory of 2876 2784 help.exe 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\Quotation #10091.exe"C:\Users\Admin\AppData\Local\Temp\Quotation #10091.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Quotation #10091.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2876
-
-