formbook | 261bc200d0f8ea4598b2f907283268c101b8e8dff6e0604627ba0e98c94d075e

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-en-20211208
submitted
23/12/2021, 12:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4400820_AL TUWAIJRI.exe
Size 528KB
Sample211223-p6cslsafbl
SHA256 261bc200d0f8ea4598b2f907283268c101b8e8dff6e0604627ba0e98c94d075e
MD5 e9bf6f679d853cb6bffe070cb2e8e1ca
SHA1 64f6284590c627427c674606e75227302b609154
SHA512 9ec9f2068958d80d9551f6930cd96e5aea7b02c6683f579f1fc61e9b6d43921d299f427f29fc2802814e9a4f4566f3bce0772a62d2a4f61f4d72f810408ae415
MD5 SHA1 SHA512

Score

10^/10

formbook xloader a6hs loader persistence rat spyware stealer suricata trojan

Malware Config

Extracted

Family

xloader

Version

Campaign

a6hs

Decoy

yousuihz.com
69819112.com
thesunnysoulsisters.com
pawaddictsva.com
quinten-and-sam.com
kareemrestaurant.com
nbkck.com
coralarray.com
thedailybeaglenews.com
vedovomsskrm.quest
invest-signals.net
apelsinkaufa.store
mgav56.xyz
rsferro.com
quaythuocquynhchi.xyz
entrepriseyulove.com
darbodrum.com
thehallowmusic.com
julliancandles.com
saildemo.com
tatsbytalia.com
giftpro365.com
malusecologique.com
sunpanpan.xyz
cryptowavebot.top
brookehirsch.com
click-explore.com
recentdetail.com
cengaoya.com
ptnoor.com
byaliciafryearson.com
charxprime.com
menzafeel.store
turkkahvesiorta.xyz
deathrowrecordscraftbeer.com
yochumlawoffice.com
nefesh.xyz
high-low-ga.info
avantipaintingsandiego.com
changemaker2021.com
baekwoonvill.com
ifoodplayground.com
aaron123.xyz
weststst.com
bramsky.com
jazxwf.xyz
pynch1.com
municipalidaddelaencantada.com
kantor.one
haberlerdunyam.com
createshopfy.com
gestionestrategicadl.com
ivermectinbuyonline.online
pineapplejacks.net
camposfinejewelry.com
personalnourishment.com
cnonlinecourses.com
mehdizayani.com
ether.estate
charleskinzel.com
rebeccaktucker.store
southgate-software.com
fizzadora.com
andrewconnorlaw.com
tejpalmeet.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/1608-57-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1608-58-0x000000000041D4C0-mapping.dmp	xloader
behavioral1/memory/1608-63-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/992-69-0x00000000000D0000-0x00000000000F9000-memory.dmp	xloader
behavioral1/memory/1940-81-0x000000000041D4C0-mapping.dmp	xloader

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wuapp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\HX-DPR3P_27 = "C:\\Program Files (x86)\\Rkz7d\\vgahrtp.exe"	wuapp.exe

Executes dropped EXE 2 IoCs

pid	Process
868	vgahrtp.exe
1940	vgahrtp.exe

Deletes itself 1 IoCs

pid	Process
1396	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
984	4400820_AL TUWAIJRI.exe
868	vgahrtp.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 984 set thread context of 1608	984	4400820_AL TUWAIJRI.exe	27
PID 1608 set thread context of 1448	1608	4400820_AL TUWAIJRI.exe	15
PID 1608 set thread context of 1448	1608	4400820_AL TUWAIJRI.exe	15
PID 992 set thread context of 1448	992	wuapp.exe	15
PID 868 set thread context of 1940	868	vgahrtp.exe	36

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Rkz7d\vgahrtp.exe	wuapp.exe
File created	C:\Program Files (x86)\Rkz7d\vgahrtp.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

resource	yara_rule
behavioral1/files/0x00060000000125ca-75.dat	nsis_installer_1
behavioral1/files/0x00060000000125ca-75.dat	nsis_installer_2
behavioral1/files/0x00060000000125ca-77.dat	nsis_installer_1
behavioral1/files/0x00060000000125ca-77.dat	nsis_installer_2
behavioral1/files/0x00060000000125ca-82.dat	nsis_installer_1
behavioral1/files/0x00060000000125ca-82.dat	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	wuapp.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1608	4400820_AL TUWAIJRI.exe
1608	4400820_AL TUWAIJRI.exe
1608	4400820_AL TUWAIJRI.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe
1940	vgahrtp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1448	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
1608	4400820_AL TUWAIJRI.exe
1608	4400820_AL TUWAIJRI.exe
1608	4400820_AL TUWAIJRI.exe
1608	4400820_AL TUWAIJRI.exe
992	wuapp.exe
992	wuapp.exe
992	wuapp.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1608	4400820_AL TUWAIJRI.exe
Token: SeDebugPrivilege	992	wuapp.exe
Token: SeDebugPrivilege	1940	vgahrtp.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1448	Explorer.EXE
1448	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1448	Explorer.EXE
1448	Explorer.EXE

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 1608	984	4400820_AL TUWAIJRI.exe	27
PID 984 wrote to memory of 1608	984	4400820_AL TUWAIJRI.exe	27
PID 984 wrote to memory of 1608	984	4400820_AL TUWAIJRI.exe	27
PID 984 wrote to memory of 1608	984	4400820_AL TUWAIJRI.exe	27
PID 984 wrote to memory of 1608	984	4400820_AL TUWAIJRI.exe	27
PID 984 wrote to memory of 1608	984	4400820_AL TUWAIJRI.exe	27
PID 984 wrote to memory of 1608	984	4400820_AL TUWAIJRI.exe	27
PID 1448 wrote to memory of 992	1448	Explorer.EXE	28
PID 1448 wrote to memory of 992	1448	Explorer.EXE	28
PID 1448 wrote to memory of 992	1448	Explorer.EXE	28
PID 1448 wrote to memory of 992	1448	Explorer.EXE	28
PID 1448 wrote to memory of 992	1448	Explorer.EXE	28
PID 1448 wrote to memory of 992	1448	Explorer.EXE	28
PID 1448 wrote to memory of 992	1448	Explorer.EXE	28
PID 992 wrote to memory of 1396	992	wuapp.exe	29
PID 992 wrote to memory of 1396	992	wuapp.exe	29
PID 992 wrote to memory of 1396	992	wuapp.exe	29
PID 992 wrote to memory of 1396	992	wuapp.exe	29
PID 992 wrote to memory of 1776	992	wuapp.exe	34
PID 992 wrote to memory of 1776	992	wuapp.exe	34
PID 992 wrote to memory of 1776	992	wuapp.exe	34
PID 992 wrote to memory of 1776	992	wuapp.exe	34
PID 1448 wrote to memory of 868	1448	Explorer.EXE	35
PID 1448 wrote to memory of 868	1448	Explorer.EXE	35
PID 1448 wrote to memory of 868	1448	Explorer.EXE	35
PID 1448 wrote to memory of 868	1448	Explorer.EXE	35
PID 868 wrote to memory of 1940	868	vgahrtp.exe	36
PID 868 wrote to memory of 1940	868	vgahrtp.exe	36
PID 868 wrote to memory of 1940	868	vgahrtp.exe	36
PID 868 wrote to memory of 1940	868	vgahrtp.exe	36
PID 868 wrote to memory of 1940	868	vgahrtp.exe	36
PID 868 wrote to memory of 1940	868	vgahrtp.exe	36
PID 868 wrote to memory of 1940	868	vgahrtp.exe	36

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\4400820_AL TUWAIJRI.exe
  "C:\Users\Admin\AppData\Local\Temp\4400820_AL TUWAIJRI.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Users\Admin\AppData\Local\Temp\4400820_AL TUWAIJRI.exe
    "C:\Users\Admin\AppData\Local\Temp\4400820_AL TUWAIJRI.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1608
- C:\Windows\SysWOW64\wuapp.exe
  "C:\Windows\SysWOW64\wuapp.exe"
  2⤵
  - Adds policy Run key to start application
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\4400820_AL TUWAIJRI.exe"
    3⤵
    - Deletes itself
    PID:1396
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1776
- C:\Program Files (x86)\Rkz7d\vgahrtp.exe
  "C:\Program Files (x86)\Rkz7d\vgahrtp.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Program Files (x86)\Rkz7d\vgahrtp.exe
    "C:\Program Files (x86)\Rkz7d\vgahrtp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/984-55-0x0000000075831000-0x0000000075833000-memory.dmp

Download

memory/992-69-0x00000000000D0000-0x00000000000F9000-memory.dmp

Download

memory/992-68-0x0000000001350000-0x000000000135B000-memory.dmp

Download

memory/992-70-0x0000000000A20000-0x0000000000D23000-memory.dmp

Download

memory/992-71-0x0000000000D30000-0x0000000000DC0000-memory.dmp

Download

memory/1448-65-0x00000000071C0000-0x00000000072C3000-memory.dmp

Download

memory/1448-62-0x0000000006730000-0x00000000068D2000-memory.dmp

Download

memory/1448-72-0x0000000005000000-0x00000000050E9000-memory.dmp

Download

memory/1608-63-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1608-64-0x00000000003A0000-0x00000000003B1000-memory.dmp

Download

memory/1608-60-0x0000000000820000-0x0000000000B23000-memory.dmp

Download

memory/1608-61-0x00000000002C0000-0x00000000002D1000-memory.dmp

Download

memory/1608-57-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1940-83-0x00000000008A0000-0x0000000000BA3000-memory.dmp

Download