Windows Analysis Report QUOTATION_doc.exe

Overview

General Information

Sample Name: QUOTATION_doc.exe
Analysis ID: 510346
MD5: 7c0902852cf17ae5d05ea35d770dcc93
SHA1: bd57aad081ce20140b226b878091164eaf777e11
SHA256: a67796ab32ba225ab871923548c5b98147a848edeffb72089724d6131d20dc0c
Tags: exe
Infos:

Most interesting Screenshot:

Detection

DBatLoader FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected DBatLoader
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Maps a DLL or memory area into another process
Initial sample is a PE file and has a suspicious name
Writes to foreign memory regions
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Sigma detected: Execution from Suspicious Folder
Sigma detected: Suspicious Svchost Process
Tries to detect virtualization through RDTSC time measurements
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Uses code obfuscation techniques (call, push, ret)
Found potential string decryption / allocating functions
Enables debug privileges
PE file contains strange resources
Drops PE files
Checks if the current process is being debugged
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000010.00000000.523957704.0000000072480000.00000040.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.septemberstockevent200.com/ht08/"], "decoy": ["joye.club", "istanbulemlakgalerisi.online", "annikadaniel.love", "oooci.com", "curebase-test.com", "swisstradecenter.com", "hacticum.com", "centercodebase.com", "recbi56ni.com", "mmj0115.xyz", "sharpstead.com", "sprklbeauty.com", "progettogenesi.cloud", "dolinum.com", "amaroqadvisors.com", "traininig.com", "leewaysvcs.com", "nashhomesearch.com", "joy1263.com", "serkanyamac.com", "nursingprogramsforme.com", "huakf.com", "1w3.online", "watermountsteam.top", "tyralruutan.quest", "mattlambert.xyz", "xn--fiqs8sypgfujbl4a.xn--czru2d", "hfgoal.com", "587868.net", "noyoucantridemyonewheel.com", "riewesell.top", "expn.asia", "suplementarsas.com", "item154655544.com", "cdgdentists.com", "deboraverdian.com", "franquiciasexclusivas.tienda", "tminus-10.com", "psychoterapeuta-wroclaw.com", "coachingbywatson.com", "lknitti.net", "belenpison.agency", "facilitetec.com", "99077000.com", "thefitmog.com", "kinmanpowerwashing.com", "escueladelbuenamor.com", "getjoyce.net", "oilelm.com", "maikoufarm.com", "hespresso.net", "timothyschmallrealt.com", "knoxvilleraingutters.com", "roonkingagency.online", "trashwasher.com", "angyfoods.com", "yungbredda.com", "digipoint-entertainment.com", "shangduli.space", "kalaraskincare.com", "ktnsound.xyz", "miabellavita.com", "thenlpmentor.com", "marzhukov.com"]}
Multi AV Scanner detection for submitted file
Source: QUOTATION_doc.exe Virustotal: Detection: 29% Perma Link
Source: QUOTATION_doc.exe ReversingLabs: Detection: 29%
Yara detected FormBook
Source: Yara match File source: 00000010.00000000.523957704.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000000.523481465.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.598500416.0000000007B56000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000000.524496982.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000000.522931849.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Multi AV Scanner detection for domain / URL
Source: www.septemberstockevent200.com/ht08/ Virustotal: Detection: 7% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\Public\Libraries\Huptze\Huptze.exe Virustotal: Detection: 29% Perma Link
Source: C:\Users\Public\Libraries\Huptze\Huptze.exe ReversingLabs: Detection: 29%
Antivirus or Machine Learning detection for unpacked file
Source: 16.0.mobsync.exe.72480000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 16.0.mobsync.exe.72480000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 16.0.mobsync.exe.72480000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 16.0.mobsync.exe.72480000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: QUOTATION_doc.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.septemberstockevent200.com/ht08/
Source: explorer.exe, 00000011.00000000.560901848.000000000095C000.00000004.00000020.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: unknown DNS traffic detected: queries for: onedrive.live.com

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 00000010.00000000.523957704.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000000.523481465.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.598500416.0000000007B56000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000000.524496982.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000000.522931849.0000000072480000.00000040.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000010.00000000.523957704.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000000.523957704.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000000.523481465.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000000.523481465.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000000.598500416.0000000007B56000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000000.598500416.0000000007B56000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000000.524496982.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000000.524496982.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000000.522931849.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000000.522931849.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: QUOTATION_doc.exe
Source: initial sample Static PE information: Filename: QUOTATION_doc.exe
Uses 32bit PE files
Source: QUOTATION_doc.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
Yara signature match
Source: 00000011.00000000.624299247.000000000D4FD000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000010.00000000.523957704.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000000.523957704.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000000.523481465.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000000.523481465.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000000.598500416.0000000007B56000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000000.598500416.0000000007B56000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000000.524496982.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000000.524496982.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000000.624322018.000000000D502000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000000.550371526.000000000D4FD000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000010.00000000.522931849.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000000.522931849.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: C:\Users\Public\Libraries\eztpuH.url, type: DROPPED Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: String function: 022F837C appears 90 times
Source: C:\Users\Public\Libraries\Huptze\Huptze.exe Code function: String function: 0274A6A0 appears 96 times
Source: C:\Users\Public\Libraries\Huptze\Huptze.exe Code function: String function: 0274837C appears 104 times
Source: C:\Users\Public\Libraries\Huptze\Huptze.exe Code function: String function: 021FD424 appears 90 times
Source: C:\Users\Public\Libraries\Huptze\Huptze.exe Code function: String function: 0274D424 appears 72 times
Source: C:\Users\Public\Libraries\Huptze\Huptze.exe Code function: String function: 021F837C appears 120 times
PE file contains strange resources
Source: QUOTATION_doc.exe Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Huptze.exe.0.dr Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Memory allocated: 72480000 page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Memory allocated: 72480000 page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Memory allocated: 72480000 page no access Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Memory allocated: 72480000 page read and write Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Memory allocated: 72481000 page read and write Jump to behavior
Source: QUOTATION_doc.exe Virustotal: Detection: 29%
Source: QUOTATION_doc.exe ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\QUOTATION_doc.exe File read: C:\Users\user\Desktop\QUOTATION_doc.exe Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\QUOTATION_doc.exe 'C:\Users\user\Desktop\QUOTATION_doc.exe'
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Process created: C:\Windows\SysWOW64\mobsync.exe C:\Windows\System32\mobsync.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\Public\Libraries\Huptze\Huptze.exe 'C:\Users\Public\Libraries\Huptze\Huptze.exe'
Source: C:\Windows\explorer.exe Process created: C:\Users\Public\Libraries\Huptze\Huptze.exe 'C:\Users\Public\Libraries\Huptze\Huptze.exe'
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\Public\Libraries\Huptze\Huptze.exe 'C:\Users\Public\Libraries\Huptze\Huptze.exe' Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\Public\Libraries\Huptze\Huptze.exe 'C:\Users\Public\Libraries\Huptze\Huptze.exe' Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_doc.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\Huptzeullazkbrfuqvqdlxbsjktmnwu[1] Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@8/3@4/0
Source: C:\Windows\explorer.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Libraries\Huptze\Huptze.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Libraries\Huptze\Huptze.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: QUOTATION_doc.exe Joe Sandbox Cloud Basic: Detection: clean Score: 0 Perma Link
Source: C:\Users\user\Desktop\QUOTATION_doc.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_doc.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_doc.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: QUOTATION_doc.exe Static file information: File size 1052672 > 1048576

Data Obfuscation:

barindex
Yara detected DBatLoader
Source: Yara match File source: 00000015.00000002.631255655.00000000021A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.632108057.00000000026F0000.00000004.00000001.sdmp, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022FA58E push eax; ret 0_3_022FA5C0
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022FA58E push eax; ret 0_3_022FA5C0
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022FA58E push eax; ret 0_3_022FA5C0
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022FA58E push eax; ret 0_3_022FA5C0
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022FA58E push eax; ret 0_3_022FA5C0
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022FA58E push eax; ret 0_3_022FA5C0
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022FA58E push eax; ret 0_3_022FA5C0
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022FA58E push eax; ret 0_3_022FA5C0
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022FA58E push eax; ret 0_3_022FA5C0
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022FA58E push eax; ret 0_3_022FA5C0
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022FA58E push eax; ret 0_3_022FA5C0
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022FA58E push eax; ret 0_3_022FA5C0
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022FA584 push eax; ret 0_3_022FA5C0
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022FA584 push eax; ret 0_3_022FA5C0
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022FA584 push eax; ret 0_3_022FA5C0
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022FA584 push eax; ret 0_3_022FA5C0
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022FA584 push eax; ret 0_3_022FA5C0
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022FA584 push eax; ret 0_3_022FA5C0
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022FA584 push eax; ret 0_3_022FA5C0
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022FA584 push eax; ret 0_3_022FA5C0
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022FA584 push eax; ret 0_3_022FA5C0
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022FA584 push eax; ret 0_3_022FA5C0
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022FA584 push eax; ret 0_3_022FA5C0
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022FA584 push eax; ret 0_3_022FA5C0

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\QUOTATION_doc.exe File created: C:\Users\Public\Libraries\Huptze\Huptze.exe Jump to dropped file
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Huptze Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Huptze Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Huptze\Huptze.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Huptze\Huptze.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Windows\SysWOW64\mobsync.exe RDTSC instruction interceptor: First address: 0000000072488604 second address: 000000007248860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\mobsync.exe RDTSC instruction interceptor: First address: 000000007248899E second address: 00000000724889A4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\mobsync.exe Process information queried: ProcessInformation Jump to behavior
Source: explorer.exe, 00000011.00000000.546571356.0000000008430000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000011.00000000.601959319.00000000083E9000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000011.00000000.584670896.00000000062E0000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000011.00000000.586385186.0000000006414000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000011.00000000.601959319.00000000083E9000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000011.00000000.586385186.0000000006414000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000011.00000000.600240165.00000000082E2000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: explorer.exe, 00000011.00000000.549013567.0000000008678000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}1SPS0
Source: explorer.exe, 00000011.00000000.600240165.00000000082E2000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000011.00000000.546571356.0000000008430000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: Huptze.exe, 00000015.00000002.630029726.0000000000808000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 00000011.00000000.560901848.000000000095C000.00000004.00000020.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G

Anti Debugging:

barindex
Enables debug privileges
Source: C:\Windows\SysWOW64\mobsync.exe Process token adjusted: Debug Jump to behavior
Checks if the current process is being debugged
Source: C:\Windows\SysWOW64\mobsync.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Code function: 0_3_022F9EE0 LdrInitializeThunk, 0_3_022F9EE0

HIPS / PFW / Operating System Protection Evasion:

barindex
Maps a DLL or memory area into another process
Source: C:\Windows\SysWOW64\mobsync.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Memory written: C:\Windows\System32\svchost.exe base: 72480000 Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Memory written: C:\Windows\System32\svchost.exe base: 2440000 Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Memory written: C:\Windows\System32\svchost.exe base: 2450000 Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Memory allocated: C:\Windows\System32\svchost.exe base: 72480000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2440000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2450000 protect: page execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Memory written: C:\Windows\System32\svchost.exe base: 72480000 value starts with: 4D5A Jump to behavior
Creates a thread in another existing process (thread injection)
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Thread created: C:\Windows\System32\svchost.exe EIP: 2450000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\QUOTATION_doc.exe Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p Jump to behavior
Source: explorer.exe, 00000011.00000002.642961549.0000000000EE0000.00000002.00020000.sdmp, Huptze.exe, 00000014.00000002.631158026.0000000000E70000.00000002.00020000.sdmp, Huptze.exe, 00000015.00000002.630849928.0000000000D90000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000011.00000000.560363495.00000000008B8000.00000004.00000020.sdmp, Huptze.exe, 00000014.00000002.631158026.0000000000E70000.00000002.00020000.sdmp, Huptze.exe, 00000015.00000002.630849928.0000000000D90000.00000002.00020000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000011.00000002.642961549.0000000000EE0000.00000002.00020000.sdmp, Huptze.exe, 00000014.00000002.631158026.0000000000E70000.00000002.00020000.sdmp, Huptze.exe, 00000015.00000002.630849928.0000000000D90000.00000002.00020000.sdmp Binary or memory string: &Program Manager
Source: explorer.exe, 00000011.00000002.642961549.0000000000EE0000.00000002.00020000.sdmp, Huptze.exe, 00000014.00000002.631158026.0000000000E70000.00000002.00020000.sdmp, Huptze.exe, 00000015.00000002.630849928.0000000000D90000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 00000010.00000000.523957704.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000000.523481465.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.598500416.0000000007B56000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000000.524496982.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000000.522931849.0000000072480000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 00000010.00000000.523957704.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000000.523481465.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.598500416.0000000007B56000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000000.524496982.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000000.522931849.0000000072480000.00000040.00000001.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 510346 Sample: QUOTATION_doc.exe Startdate: 27/10/2021 Architecture: WINDOWS Score: 100 28 onedrive.live.com 2->28 36 Multi AV Scanner detection for domain / URL 2->36 38 Found malware configuration 2->38 40 Malicious sample detected (through community Yara rule) 2->40 42 7 other signatures 2->42 9 QUOTATION_doc.exe 1 17 2->9         started        signatures3 process4 dnsIp5 30 onedrive.live.com 9->30 32 mpc3og.am.files.1drv.com 9->32 34 am-files.fe.1drv.com 9->34 26 C:\Users\Public\Libraries\Huptze\Huptze.exe, PE32 9->26 dropped 46 Writes to foreign memory regions 9->46 48 Allocates memory in foreign processes 9->48 50 Creates a thread in another existing process (thread injection) 9->50 52 Injects a PE file into a foreign processes 9->52 14 mobsync.exe 9->14         started        17 svchost.exe 1 9->17         started        file6 signatures7 process8 signatures9 54 Maps a DLL or memory area into another process 14->54 56 Tries to detect virtualization through RDTSC time measurements 14->56 19 explorer.exe 4 2 17->19 injected process10 process11 21 Huptze.exe 19->21         started        24 Huptze.exe 19->24         started        signatures12 44 Multi AV Scanner detection for dropped file 21->44
No contacted IP infos

Contacted Domains

Name IP Active
onedrive.live.com unknown unknown
mpc3og.am.files.1drv.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.septemberstockevent200.com/ht08/ true
  • 8%, Virustotal, Browse
  • Avira URL Cloud: safe
 low