formbook | 9d37fb95eefc5396c3aee5e5c4525b373821cd151f7fc5b2d3805f0fb0056a4a

Analysis

max time kernel
147s
max time network
139s
platform
windows7_x64
resource
win7-en-20211104
submitted
10/11/2021, 05:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Сатып алуға тапсырыс парағы.pdf.exe
Size 445KB
Sample211110-fs53kadecr
SHA256 9d37fb95eefc5396c3aee5e5c4525b373821cd151f7fc5b2d3805f0fb0056a4a
MD5 8bbe7bdb994f598ff65749c2cc6a4538
SHA1 aa7e1760aaaec6086c19c000b884f7507254b13e
SHA512 acbc14d8545a8fc70d032495a13637922931f44dbdff89e90cc71ccd278310a087089ff1519079b0dfa8276d0cd4e3fd852ef29241c249bd1924ec603b8f51c8
MD5 SHA1 SHA512

Score

10^/10

formbook dv9n rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

dv9n

http://www.elianedefalco.com/dv9n/

Decoy

nblvqing.com
delmegebuildingproducts.com
xiongba8.com
latuawebreputation.online
nowcloud.tech
cckghs.com
tradeoo.ltd
ppapo.com
tphoaphuongdo.club
whitefoxy.site
bottle-sentences.net
computersewa.com
lushberryholidays.com
motobotz.com
shadurj.com
amazonlexdeveloper.com
shunli178.xyz
sjzzlmh.com
6eu09rp.xyz
novinmes.com
elizabethdouglas.net
heathy.xyz
forsmarthings.com
mskstyle-77.store
henhencaol.xyz
palncakeswap.com
osflogistics.com
14rinapo45.com
jordinandaustin.com
natsmartultimatebest.rest
perfectelopements.com
xinsaiou.com
92billion.com
hb4um.com
amneatni.xyz
pirigame.com
93335t.xyz
forwardvalley.com
contacttracingusa.com
americanexpress2214.creditcard
gurume-naruki.com
cdminstructors.com
posetac.online
suzhouyscl.com
bakarusgroup.com
epicureanadventuretours.com
goldengooses-outlet.com
glitchking411.com
8xroe84.xyz
https29dgi.xyz
sweetspendingwholesalersllc.com
bitopvip.com
sheraton-international.com
ajansclubturkey.site
communityskiswap.com
sauna-kuu.com
stephkingspilates.com
rosnewmarkextension.net
100daysofml.com
nexbot.biz
ahhhpop.com
marfalow.com
project-candles.com
topdogiadung.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1952-67-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1952-68-0x000000000041F190-mapping.dmp	formbook
behavioral1/memory/1900-77-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1908 set thread context of 1952	1908	Сатып алуға тапсырыс парағы.pdf.exe	32
PID 1952 set thread context of 1384	1952	RegSvcs.exe	15
PID 1900 set thread context of 1384	1900	NAPSTAT.EXE	15

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1200	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1908	Сатып алуға тапсырыс парағы.pdf.exe
1908	Сатып алуға тапсырыс парағы.pdf.exe
1908	Сатып алуға тапсырыс парағы.pdf.exe
1952	RegSvcs.exe
1952	RegSvcs.exe
1632	powershell.exe
1900	NAPSTAT.EXE
1900	NAPSTAT.EXE
1900	NAPSTAT.EXE
1900	NAPSTAT.EXE
1900	NAPSTAT.EXE
1900	NAPSTAT.EXE
1900	NAPSTAT.EXE
1900	NAPSTAT.EXE
1900	NAPSTAT.EXE
1900	NAPSTAT.EXE
1900	NAPSTAT.EXE
1900	NAPSTAT.EXE
1900	NAPSTAT.EXE
1900	NAPSTAT.EXE
1900	NAPSTAT.EXE
1900	NAPSTAT.EXE
1900	NAPSTAT.EXE
1900	NAPSTAT.EXE
1900	NAPSTAT.EXE
1900	NAPSTAT.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1952	RegSvcs.exe
1952	RegSvcs.exe
1952	RegSvcs.exe
1900	NAPSTAT.EXE
1900	NAPSTAT.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1908	Сатып алуға тапсырыс парағы.pdf.exe
Token: SeDebugPrivilege	1952	RegSvcs.exe
Token: SeDebugPrivilege	1632	powershell.exe
Token: SeDebugPrivilege	1900	NAPSTAT.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1384	Explorer.EXE
1384	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1384	Explorer.EXE
1384	Explorer.EXE

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1632	1908	Сатып алуға тапсырыс парағы.pdf.exe	28
PID 1908 wrote to memory of 1632	1908	Сатып алуға тапсырыс парағы.pdf.exe	28
PID 1908 wrote to memory of 1632	1908	Сатып алуға тапсырыс парағы.pdf.exe	28
PID 1908 wrote to memory of 1632	1908	Сатып алуға тапсырыс парағы.pdf.exe	28
PID 1908 wrote to memory of 1200	1908	Сатып алуға тапсырыс парағы.pdf.exe	30
PID 1908 wrote to memory of 1200	1908	Сатып алуға тапсырыс парағы.pdf.exe	30
PID 1908 wrote to memory of 1200	1908	Сатып алуға тапсырыс парағы.pdf.exe	30
PID 1908 wrote to memory of 1200	1908	Сатып алуға тапсырыс парағы.pdf.exe	30
PID 1908 wrote to memory of 1952	1908	Сатып алуға тапсырыс парағы.pdf.exe	32
PID 1908 wrote to memory of 1952	1908	Сатып алуға тапсырыс парағы.pdf.exe	32
PID 1908 wrote to memory of 1952	1908	Сатып алуға тапсырыс парағы.pdf.exe	32
PID 1908 wrote to memory of 1952	1908	Сатып алуға тапсырыс парағы.pdf.exe	32
PID 1908 wrote to memory of 1952	1908	Сатып алуға тапсырыс парағы.pdf.exe	32
PID 1908 wrote to memory of 1952	1908	Сатып алуға тапсырыс парағы.pdf.exe	32
PID 1908 wrote to memory of 1952	1908	Сатып алуға тапсырыс парағы.pdf.exe	32
PID 1908 wrote to memory of 1952	1908	Сатып алуға тапсырыс парағы.pdf.exe	32
PID 1908 wrote to memory of 1952	1908	Сатып алуға тапсырыс парағы.pdf.exe	32
PID 1908 wrote to memory of 1952	1908	Сатып алуға тапсырыс парағы.pdf.exe	32
PID 1384 wrote to memory of 1900	1384	Explorer.EXE	33
PID 1384 wrote to memory of 1900	1384	Explorer.EXE	33
PID 1384 wrote to memory of 1900	1384	Explorer.EXE	33
PID 1384 wrote to memory of 1900	1384	Explorer.EXE	33
PID 1900 wrote to memory of 1560	1900	NAPSTAT.EXE	34
PID 1900 wrote to memory of 1560	1900	NAPSTAT.EXE	34
PID 1900 wrote to memory of 1560	1900	NAPSTAT.EXE	34
PID 1900 wrote to memory of 1560	1900	NAPSTAT.EXE	34

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Users\Admin\AppData\Local\Temp\Сатып алуға тапсырыс парағы.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Сатып алуға тапсырыс парағы.pdf.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hPSDyTXdNyKvEB.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1632
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hPSDyTXdNyKvEB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp565A.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1200
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1952
- C:\Windows\SysWOW64\NAPSTAT.EXE
  "C:\Windows\SysWOW64\NAPSTAT.EXE"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:1560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1384-80-0x0000000006280000-0x000000000637B000-memory.dmp

Download

memory/1384-73-0x0000000006C60000-0x0000000006DE8000-memory.dmp

Download

memory/1632-70-0x00000000023C0000-0x000000000300A000-memory.dmp

Download

memory/1900-79-0x0000000000950000-0x00000000009E3000-memory.dmp

Download

memory/1900-78-0x00000000022D0000-0x00000000025D3000-memory.dmp

Download

memory/1900-76-0x0000000000E80000-0x0000000000EC6000-memory.dmp

Download

memory/1900-77-0x0000000000080000-0x00000000000AF000-memory.dmp

Download

memory/1908-58-0x0000000000A60000-0x0000000000A61000-memory.dmp

Download

memory/1908-60-0x0000000000D80000-0x0000000000DCB000-memory.dmp

Download

memory/1908-57-0x00000000765D1000-0x00000000765D3000-memory.dmp

Download

memory/1908-55-0x0000000001240000-0x0000000001241000-memory.dmp

Download

memory/1908-59-0x00000000002B0000-0x00000000002B7000-memory.dmp

Download

memory/1952-67-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1952-72-0x0000000000150000-0x0000000000164000-memory.dmp

Download

memory/1952-71-0x0000000000A80000-0x0000000000D83000-memory.dmp

Download

memory/1952-66-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1952-65-0x0000000000400000-0x000000000042F000-memory.dmp

Download