Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-11-2024 06:34

General

  • Target

    Quotation.exe

  • Size

    673KB

  • MD5

    0a4e34ccc6e3e118f225a4f38f731a14

  • SHA1

    d8f89c49dbf6376607ea5379963bd95973fbfd18

  • SHA256

    5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900

  • SHA512

    9fe90ed6095223ee98eb1372708cf77c7b2cd2482899bded7bd9f99f823afdeb89370309e0a087000e4345dab4b10a428ffd1d0afa486b7091f8fc3f30d0cc70

  • SSDEEP

    12288:1XFAO9mjNkvzScpPdK/Pr595FUCCVjscJ4nX0q2mY9+QQh3HEc:1XFNQyvzSYlCNIV+nX0q2I3HEc

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hy29

Decoy

obswell.online

etflix.luxury

ulunguwethu.store

ulbcenter.shop

nswering-service-mi-de-tt.click

upport-marketplace84.click

wepxbd163.lat

mplants-doctors.today

aofexf90yj.top

hermodynamic.space

dfg3n489.cyou

off.gay

alkak.cam

ijanarko.net

7tl.site

yaanincma.store

ires-47022.bond

elek4dalt77.xyz

foxsakepeople.online

ndefeatedqs.shop

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Guloader family
  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Formbook payload 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3368
    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1084
      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
        3⤵
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:944
    • C:\Windows\SysWOW64\cscript.exe
      "C:\Windows\SysWOW64\cscript.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1196
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nss7F54.tmp\System.dll

    Filesize

    12KB

    MD5

    4add245d4ba34b04f213409bfe504c07

    SHA1

    ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

    SHA256

    9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

    SHA512

    1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

  • memory/944-18-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/944-23-0x0000000001660000-0x0000000003B69000-memory.dmp

    Filesize

    37.0MB

  • memory/944-21-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/944-20-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/944-19-0x0000000001660000-0x0000000003B69000-memory.dmp

    Filesize

    37.0MB

  • memory/1084-14-0x0000000005630000-0x0000000007B39000-memory.dmp

    Filesize

    37.0MB

  • memory/1084-17-0x0000000005630000-0x0000000007B39000-memory.dmp

    Filesize

    37.0MB

  • memory/1084-15-0x0000000073E35000-0x0000000073E36000-memory.dmp

    Filesize

    4KB

  • memory/1084-16-0x0000000073E30000-0x0000000073E37000-memory.dmp

    Filesize

    28KB

  • memory/1084-13-0x0000000077741000-0x0000000077861000-memory.dmp

    Filesize

    1.1MB

  • memory/1084-12-0x0000000005630000-0x0000000007B39000-memory.dmp

    Filesize

    37.0MB

  • memory/1196-22-0x0000000000A80000-0x0000000000AA7000-memory.dmp

    Filesize

    156KB

  • memory/1196-24-0x0000000000600000-0x000000000062F000-memory.dmp

    Filesize

    188KB

  • memory/3368-26-0x00000000084F0000-0x000000000866C000-memory.dmp

    Filesize

    1.5MB