Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
06-12-2024 15:51
Static task
static1
Behavioral task
behavioral1
Sample
Quotation_Dec 2024.exe
Resource
win7-20240708-en
General
-
Target
Quotation_Dec 2024.exe
-
Size
28KB
-
MD5
5ad176cf9482ccedc206fca269089b25
-
SHA1
0b917af3c99023327127aa034d3904888029e2d3
-
SHA256
7190badb11c14706725e06f01dd4dbbd34f82233d3d69f7bd302cfdb947f6021
-
SHA512
9e9c68cd8467f5b08f514b2315025f9e863f66a2d5746f54b5d7d5df89e8b6e9c232bca3fbfedfd6450b2d1ccb37bbd630ea95c0c1bdd5150acd73fb0841d580
-
SSDEEP
192:+YHwHj0yVgOOVinHuCN0Tv2m5g7EDum0KypCkCgS43IhS/rUO50biUU9H+v5mIAf:4AyrgCNkun7EZ3uBIhErX6mPeJACsxh
Malware Config
Extracted
formbook
4.1
o62s
lectrobay.shop
enisehirarnavutkoy.xyz
itoolz.net
otorcycle-loans-40378.bond
opjobsinusa.today
uara228j.shop
ukulbagus10.click
enhealth07.shop
cpoker.pro
ome-remodeling-16949.bond
andu.shop
hubbychicocharmqs.shop
onghi292.top
ussines-web-creators.net
alenspencer.online
ryptogigt.top
epiyiisigorta.online
ental-implants-77717.bond
juta.click
enisehirevleriarnavutkoy.xyz
pertforces.store
kdse.boutique
uccessfulproduct.shop
newrist.online
2045.pictures
epid.dev
oxo.net
utivme.info
arehouse-inventory-65114.bond
axiquynhongiare.asia
etooclaim.store
heterraceongregory.store
orldwise-admission.online
outenbox.shop
kipoxz.xyz
iperliteratura.online
hoccyboxy.dev
iicf72105.vip
regnancy-10606.bond
dambelardino.net
oans-credits-55622.bond
zprintbox.store
3sejzs3.sbs
fi-group.world
iveworks.xyz
gtg.store
4mn.info
aliente.kaufen
ottostar.motorcycles
oker99-ms.christmas
p595.top
artmartuqsa.shop
infundcadastro.site
merp.link
irclemedia.shop
ind.expert
mitrywedkam.online
opcharlottesydimby.shop
mmamartin.info
uikstudy.sbs
estpro.group
card.yachts
mazoui.fun
ooktonook.online
hronika.fun
Signatures
-
Formbook family
-
Formbook payload 1 IoCs
resource yara_rule behavioral1/memory/3020-45-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule behavioral1/memory/2740-37-0x0000000005400000-0x0000000005492000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\Quotation_Dec 2024 = "C:\\Users\\Admin\\Documents\\Quotation_Dec 2024.pif" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2740 set thread context of 3020 2740 Quotation_Dec 2024.exe 36 -
Program crash 1 IoCs
pid pid_target Process procid_target 1252 3020 WerFault.exe 36 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Quotation_Dec 2024.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Quotation_Dec 2024.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 2740 Quotation_Dec 2024.exe 2740 Quotation_Dec 2024.exe 2740 Quotation_Dec 2024.exe 2740 Quotation_Dec 2024.exe 2740 Quotation_Dec 2024.exe 2740 Quotation_Dec 2024.exe 2740 Quotation_Dec 2024.exe 2740 Quotation_Dec 2024.exe 2740 Quotation_Dec 2024.exe 2740 Quotation_Dec 2024.exe 2740 Quotation_Dec 2024.exe 2740 Quotation_Dec 2024.exe 2740 Quotation_Dec 2024.exe 2740 Quotation_Dec 2024.exe 2740 Quotation_Dec 2024.exe 2740 Quotation_Dec 2024.exe 2740 Quotation_Dec 2024.exe 2740 Quotation_Dec 2024.exe 2740 Quotation_Dec 2024.exe 2740 Quotation_Dec 2024.exe 2740 Quotation_Dec 2024.exe 2740 Quotation_Dec 2024.exe 2740 Quotation_Dec 2024.exe 2740 Quotation_Dec 2024.exe 2740 Quotation_Dec 2024.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2740 Quotation_Dec 2024.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2740 wrote to memory of 328 2740 Quotation_Dec 2024.exe 30 PID 2740 wrote to memory of 328 2740 Quotation_Dec 2024.exe 30 PID 2740 wrote to memory of 328 2740 Quotation_Dec 2024.exe 30 PID 2740 wrote to memory of 328 2740 Quotation_Dec 2024.exe 30 PID 328 wrote to memory of 2568 328 cmd.exe 32 PID 328 wrote to memory of 2568 328 cmd.exe 32 PID 328 wrote to memory of 2568 328 cmd.exe 32 PID 328 wrote to memory of 2568 328 cmd.exe 32 PID 2740 wrote to memory of 2680 2740 Quotation_Dec 2024.exe 33 PID 2740 wrote to memory of 2680 2740 Quotation_Dec 2024.exe 33 PID 2740 wrote to memory of 2680 2740 Quotation_Dec 2024.exe 33 PID 2740 wrote to memory of 2680 2740 Quotation_Dec 2024.exe 33 PID 2740 wrote to memory of 2140 2740 Quotation_Dec 2024.exe 35 PID 2740 wrote to memory of 2140 2740 Quotation_Dec 2024.exe 35 PID 2740 wrote to memory of 2140 2740 Quotation_Dec 2024.exe 35 PID 2740 wrote to memory of 2140 2740 Quotation_Dec 2024.exe 35 PID 2740 wrote to memory of 3020 2740 Quotation_Dec 2024.exe 36 PID 2740 wrote to memory of 3020 2740 Quotation_Dec 2024.exe 36 PID 2740 wrote to memory of 3020 2740 Quotation_Dec 2024.exe 36 PID 2740 wrote to memory of 3020 2740 Quotation_Dec 2024.exe 36 PID 2740 wrote to memory of 3020 2740 Quotation_Dec 2024.exe 36 PID 2740 wrote to memory of 3020 2740 Quotation_Dec 2024.exe 36 PID 2740 wrote to memory of 3020 2740 Quotation_Dec 2024.exe 36 PID 3020 wrote to memory of 1252 3020 Quotation_Dec 2024.exe 37 PID 3020 wrote to memory of 1252 3020 Quotation_Dec 2024.exe 37 PID 3020 wrote to memory of 1252 3020 Quotation_Dec 2024.exe 37 PID 3020 wrote to memory of 1252 3020 Quotation_Dec 2024.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation_Dec 2024.exe"C:\Users\Admin\AppData\Local\Temp\Quotation_Dec 2024.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Quotation_Dec 2024" /t REG_SZ /F /D "C:\Users\Admin\Documents\Quotation_Dec 2024.pif"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Quotation_Dec 2024" /t REG_SZ /F /D "C:\Users\Admin\Documents\Quotation_Dec 2024.pif"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2568
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c Copy "C:\Users\Admin\AppData\Local\Temp\Quotation_Dec 2024.exe" "C:\Users\Admin\Documents\Quotation_Dec 2024.pif"2⤵
- System Location Discovery: System Language Discovery
PID:2680
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation_Dec 2024.exe"C:\Users\Admin\AppData\Local\Temp\Quotation_Dec 2024.exe"2⤵PID:2140
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation_Dec 2024.exe"C:\Users\Admin\AppData\Local\Temp\Quotation_Dec 2024.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 363⤵
- Program crash
PID:1252
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b