formbook | db4fa159359fbe0ba9857ae0e971dd206f23a7522b14073151b27bb030db8f5f

Analysis

max time kernel
165s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
10/02/2022, 07:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e9433e6f78e64470dbb521320faeee8b.exe
Size 805KB
Sample220210-jjrelageam
SHA256 db4fa159359fbe0ba9857ae0e971dd206f23a7522b14073151b27bb030db8f5f
MD5 e9433e6f78e64470dbb521320faeee8b
SHA1 5a71fe04a8a53966f491b3d3362c7b0a1be05411
SHA512 5ecf31be6a07f4edaf1f069b5b023b937dfe07de2f8bd26faed6d8220b8d32b2a1e1690b72ed651503709a7f788c30bbef5394c00dc7aa05cd814a7139f5d997
MD5 SHA1 SHA512

Score

10^/10

formbook qugo rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

qugo

Decoy

sathapornstainlesssteel.com
everythingisaninvestment.com
appsbyraf.com
superhornygirl.club
christmastreeclass.com
cheatdayztogo.com
aadent7.com
divinitypath.com
figuli563.com
distanzalojistik.com
pricelesslookyto-looktoday.info
pcaaems.com
itsnewmovie.com
4kx.claims
rental-aruyo.com
psiek.com
justnobleempress.com
40daysfor40nights.com
91266w.com
csi-texas.biz
laborbbpjnsumsel.com
chiroxpr.com
vipfb69.com
swedls.com
carmonaforcouncil.com
ezgovtfunds.com
bnqit.com
jonkospellen.online
easygojpn.com
boardwalksnj.com
hinrichs.digital
visionbankfl.com
voteronniboskovich.com
lootproject.club
wajeehi.net
jasapengerjaanskripsi.com
hustlerbandz.com
builtkh.com
theeggsstory.com
doctornotaryservice.com
sportsfanmd.com
matrix-casino.com
jumpandbouncehouserental.com
infoecommercepro.com
flowerdiscount.store
b95213.com
dualipaphiladelphia.com
opalandamber.com
impiantidentalibuscaritaorg.com
mmpluk.com
rpcbtt.space
melancholizm.com
odemix.com
klm-med.store
thinkdelivery.net
lifeonticotime.com
harsors.com
mollymo.online
rab.bet
anubhav.pictures
mauromarchesini.com
tokiwa-test.com
livia-rony.com
sgames.space
monimmo3d.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1388-137-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4000 set thread context of 1388	4000	e9433e6f78e64470dbb521320faeee8b.exe	71

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132891293400110314"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "4.285925"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3976"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1388	e9433e6f78e64470dbb521320faeee8b.exe
1388	e9433e6f78e64470dbb521320faeee8b.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 1388	4000	e9433e6f78e64470dbb521320faeee8b.exe	71
PID 4000 wrote to memory of 1388	4000	e9433e6f78e64470dbb521320faeee8b.exe	71
PID 4000 wrote to memory of 1388	4000	e9433e6f78e64470dbb521320faeee8b.exe	71
PID 4000 wrote to memory of 1388	4000	e9433e6f78e64470dbb521320faeee8b.exe	71
PID 4000 wrote to memory of 1388	4000	e9433e6f78e64470dbb521320faeee8b.exe	71
PID 4000 wrote to memory of 1388	4000	e9433e6f78e64470dbb521320faeee8b.exe	71

C:\Users\Admin\AppData\Local\Temp\e9433e6f78e64470dbb521320faeee8b.exe
"C:\Users\Admin\AppData\Local\Temp\e9433e6f78e64470dbb521320faeee8b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Users\Admin\AppData\Local\Temp\e9433e6f78e64470dbb521320faeee8b.exe
  "C:\Users\Admin\AppData\Local\Temp\e9433e6f78e64470dbb521320faeee8b.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1388-137-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1388-138-0x00000000018F0000-0x0000000001C3A000-memory.dmp

Download

memory/4000-130-0x0000000074AAE000-0x0000000074AAF000-memory.dmp

Download

memory/4000-131-0x00000000005B0000-0x0000000000680000-memory.dmp

Download

memory/4000-132-0x0000000005510000-0x0000000005AB4000-memory.dmp

Download

memory/4000-133-0x0000000005020000-0x00000000050B2000-memory.dmp

Download

memory/4000-134-0x0000000005190000-0x0000000005191000-memory.dmp

Download

memory/4000-135-0x00000000050D0000-0x00000000050DA000-memory.dmp

Download

memory/4000-136-0x0000000000E40000-0x0000000000EDC000-memory.dmp

Download