Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12-11-2024 06:34
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Quotation.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
Quotation.exe
-
Size
673KB
-
MD5
0a4e34ccc6e3e118f225a4f38f731a14
-
SHA1
d8f89c49dbf6376607ea5379963bd95973fbfd18
-
SHA256
5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900
-
SHA512
9fe90ed6095223ee98eb1372708cf77c7b2cd2482899bded7bd9f99f823afdeb89370309e0a087000e4345dab4b10a428ffd1d0afa486b7091f8fc3f30d0cc70
-
SSDEEP
12288:1XFAO9mjNkvzScpPdK/Pr595FUCCVjscJ4nX0q2mY9+QQh3HEc:1XFNQyvzSYlCNIV+nX0q2I3HEc
Malware Config
Extracted
formbook
4.1
hy29
obswell.online
etflix.luxury
ulunguwethu.store
ulbcenter.shop
nswering-service-mi-de-tt.click
upport-marketplace84.click
wepxbd163.lat
mplants-doctors.today
aofexf90yj.top
hermodynamic.space
dfg3n489.cyou
off.gay
alkak.cam
ijanarko.net
7tl.site
yaanincma.store
ires-47022.bond
elek4dalt77.xyz
foxsakepeople.online
ndefeatedqs.shop
ordseetouristik.reisen
eviewmywebsite.xyz
igitalcommandos.net
eqtech.net
5655600.xyz
rbis.site
entures-sharp.today
atrixslotviral.xyz
zrk148.ink
nline-advertising-18349.bond
unnify.net
ylosnackpark.online
sakasouzoku.net
emonslayerlatinclub.xyz
tus.live
tm189vip.live
eintix.store
oinflogo.xyz
nline-gaming-16655.bond
uyglp.one
ihjp69483.vip
n6n.xyz
veriox.xyz
limtightwaistkh.shop
roelitecraft.mom
eifeigou.top
inak.net
audesa.shop
ealclick.club
oktopus.kids
elisiaco.shop
xvsk.global
littlebitoffaith.net
dc188link04.xyz
tagprobe.band
orldlullaby.net
hswe.top
ultankinglogin.world
ustdoit.store
bhishekanand.biz
erminalplanner.app
oopia-faktura.info
a-consulting.online
owboyaero.net
84jys301.top
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/2524-19-0x0000000000400000-0x0000000001462000-memory.dmp formbook behavioral1/memory/2524-21-0x0000000000400000-0x0000000001462000-memory.dmp formbook behavioral1/memory/2524-25-0x0000000000400000-0x0000000001462000-memory.dmp formbook -
Loads dropped DLL 1 IoCs
pid Process 1984 Quotation.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 2524 Quotation.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1984 Quotation.exe 2524 Quotation.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1984 set thread context of 2524 1984 Quotation.exe 30 PID 2524 set thread context of 1240 2524 Quotation.exe 21 PID 2524 set thread context of 1240 2524 Quotation.exe 21 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\fips\beskydende.ini Quotation.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Quotation.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Quotation.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2524 Quotation.exe 2524 Quotation.exe 2524 Quotation.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 1984 Quotation.exe 2524 Quotation.exe 2524 Quotation.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2524 Quotation.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2524 1984 Quotation.exe 30 PID 1984 wrote to memory of 2524 1984 Quotation.exe 30 PID 1984 wrote to memory of 2524 1984 Quotation.exe 30 PID 1984 wrote to memory of 2524 1984 Quotation.exe 30 PID 1984 wrote to memory of 2524 1984 Quotation.exe 30 PID 1984 wrote to memory of 2524 1984 Quotation.exe 30
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD54add245d4ba34b04f213409bfe504c07
SHA1ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA2569111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
SHA5121bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d